Downloads |
Table Of Contents
Secure Shell Version 1 Support
Related Features and Technologies
Supported Standards, MIBs, and RFCs
Secure Shell Version 1 Support
This feature module describes the Secure Shell server feature. It includes information on the benefits of the new feature, supported platforms, related documents, and so forth.
This document includes the following sections:
•
Supported Standards, MIBs, and RFCs
Feature Overview
Secure Shell (SSH) is a protocol that provides a secure, remote connection to a router. There are currently two versions of SSH available, SSH Version 1 and SSH Version 2. Only SSH Version 1 is implemented in Cisco IOS software.
The SSH server feature enables a SSH client to make a secure, encrypted connection to a Cisco router. This connection provides functionality that is similar to an inbound Telnet connection. The SSH server in Cisco IOS software will work with publicly and commercially available SSH clients.
Note
Benefits
Additional Security
Before SSH, security was limited to Telnet security. SSH allows strong encryption to be used with Cisco IOS software authentication.
Restrictions
RSA Authentication Not Supported
RSA authentication available in SSH clients is not supported in the SSH server for Cisco IOS software.
Supported Authentication Methods
User ID and Password authentication only.
DES and Triple DES Supported
SSH is supported on DES (56-bit) data encryption and Triple DES (168-bit) data encryption software images only. In the DES software images, DES is the only encryption algorithm available. In the Triple DES software images, both DES and Triple DES encryption are available.
Supported Applications
Execution shell is the only application supported.
Strong Encryption Limitations
Cisco IOS software images with strong encryption (including, but not limited to, 56-bit data encryption feature sets) are subject to United States government export controls, and have a limited distribution. Images to be installed outside the United States require an export license. Customer orders might be denied or subject to delay due to United States government regulations. Contact your sales representative or distributor for more information, or send e-mail to export@cisco.com.
Related Features and Technologies
The Secure Shell Version 1 Support feature module is related to the following existing features:
•
•
Related Documents
For related information on the SSH server feature, refer to the following documents:
•
•
Supported Platforms
•
•
•
•
•
•
Supported Standards, MIBs, and RFCs
Standards
No new or modified standards are supported by this feature.
MIBs
No new or modified MIBs are supported by this feature.
For descriptions of supported MIBs and how to use MIBs, see Cisco's MIB web site on CCO at http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml.
RFCs
No new or modified RFCs are supported by this feature.
Prerequisites
IPSec Software Image Required
Before configuring the SSH server feature, you must have an IPSec encryption software image from Cisco IOS Release 12.1(1)T downloaded on your router. For more information on downloading a software image, see the following publications:
•
•
Hostname and IP Domain Name
Before configuring the SSH server feature, you must configure a hostname and host domain for your router.
RSA Key-Pair Required
Before configuring the SSH server, you must generate a RSA key-pair for the router. When you generate an RSA key-pair for the router, you automatically enable SSH. When you delete the RSA key-pair, you automatically disable the SSH server.
User Authentication Required
Before configuring the SSH server, you must configure user authentication for local or remote access. You can configure authentication with or without AAA. For more information, see the following publications:
•
•
SSH Configuration
The SSH configuration commands are optional and are disabled when the SSH server is disabled.
Configuration Tasks
See the following sections for SSH configuration tasks. Each task in the list indicates if it is optional or required:
•
•
•
Configuring SSH Server
To enable and configure a Cisco router for SSH, perform the following tasks in global configuration mode:
•
•
•
Note
Verifying SSH
To verify that the SSH server is enabled, enter the show ip ssh command at the EXEC prompt. If the SSH server is not enabled, the command will generate an error message.
Troubleshooting SSH
•
•
–
You must configure a host name for the router using the hostname global configuration command. For more information, see "Configuration Tasks."
–
You must configure a host domain for the router using the ip domain-name global configuration command. For more information, see "Configuration Tasks."
•
•
Configuration Examples
The following examples are output from the show running configuration global configuration command on a Cisco 7200, Cisco 7500, and Cisco 12000. The SSH configuration commands are bold.
•
•
•
Note
Example 1 Cisco 7200 Series Router Configuration
In the following example, SSH is configured on a Cisco 7200 with a timeout that is not to exceed 60 seconds, and no more than 2 authentication retries. Also, before configuring the SSH server feature on the router, TACACS+ is specified as the method of authentication.
version 12.0no service padservice timestamps debug datetime msec localtime show-timezoneservice timestamps log datetime msec localtime show-timezoneno service password-encryptionservice udp-small-serversservice tcp-small-servershostname cisco7200boot buffersize 150000aaa new-modelaaa authentication login default tacacs+aaa authentication login aaa7200kw noneenable password enable7200pwusername mcisco password 0 maryspwusername jcisco password 0 johnspwip subnet-zerono ip domain-lookupip domain-name cisco.comip ssh time-out 60ip ssh authentication-retries 2controller E1 2/0controller E1 2/1interface Ethernet1/0ip address 192.168.110.2 255.255.255.0 secondaryip address 192.168.109.2 255.255.255.0no ip directed-broadcastno ip route-cacheno ip mroute-cacheno keepaliveno cdp enableinterface Ethernet1/1no ip addressno ip directed-broadcastno ip route-cacheno ip mroute-cacheshutdownno cdp enableinterface Ethernet1/2no ip addressno ip directed-broadcastno ip route-cacheno ip mroute-cacheshutdownno cdp enableno ip classlessip route 192.168.1.0 255.255.255.0 10.1.10.1ip route 192.168.9.0 255.255.255.0 10.1.1.1ip route 192.168.10.0 255.255.255.0 10.1.1.1map-list atmip 10.1.10.1 atm-vc 7 broadcastno cdp runtacacs-server host 192.168.109.216 port 9000tacacs-server key ciscoradius-server host 192.168.109.216 auth-port 1650 acct-port 1651radius-server key ciscoline con 0exec-timeout 0 0login authentication aaa7200kwtransport input noneline aux 0line vty 0 4password enable7200pwendExample 2 Cisco 7500 Series Router Configuration
In the following example, SSH is configured on a Cisco 7500 with a timeout that is not to exceed 60 seconds, and no more than 5 authentication retries. Also, before configuring the SSH server feature on the router, RADIUS is specified as the method of authentication.
version 12.0service timestamps debug uptimeservice timestamps log uptimeno service password-encryptionservice udp-small-serversservice tcp-small-servershostname cisco7500aaa new-modelaaa authentication login default radiusaaa authentication login aaa7500kw noneenable password enable7500pwusername mcisco password 0 maryspwusername jcisco password 0 johnspwip subnet-zerono ip cefno ip domain-lookupip domain-name cisco.comip ssh time-out 60ip ssh authentication-retries 5controller E1 3/0channel-group 0 timeslots 1controller E1 3/1channel-group 0 timeslots 1channel-group 1 timeslots 2interface Ethernet0/0/0no ip addressno ip directed-broadcastno ip route-cache distributedshutdowninterface Ethernet0/0/1no ip addressno ip directed-broadcastno ip route-cache distributedshutdowninterface Ethernet0/0/2no ip addressno ip directed-broadcastno ip route-cache distributedshutdowninterface Ethernet0/0/3no ip addressno ip directed-broadcastno ip route-cache distributedshutdowninterface Ethernet1/0ip address 192.168.110.2 255.255.255.0 secondaryip address 192.168.109.2 255.255.255.0no ip directed-broadcastno ip route-cacheno ip mroute-cacheinterface Ethernet1/1ip address 192.168.109.2 255.255.255.0no ip directed-broadcastno ip route-cacheno ip mroute-cacheshutdowninterface Ethernet1/2no ip addressno ip directed-broadcastno ip route-cacheno ip mroute-cacheinterface Ethernet1/3no ip addressno ip directed-broadcastno ip route-cacheno ip mroute-cacheshutdowninterface Ethernet1/4no ip addressno ip directed-broadcastno ip route-cacheno ip mroute-cacheshutdowninterface Ethernet1/5no ip addressno ip directed-broadcastno ip route-cacheno ip mroute-cacheshutdowninterface Serial2/0ip address 10.1.1.2 255.0.0.0no ip directed-broadcastencapsulation pppno ip route-cacheno ip mroute-cacheip classlessip route 192.168.9.0 255.255.255.0 10.1.1.1ip route 192.168.10.0 255.255.255.0 10.1.1.1tacacs-server host 192.168.109.216 port 9000tacacs-server key ciscoradius-server host 192.168.109.216 auth-port 1650 acct-port 1651radius-server key ciscoline con 0exec-timeout 0 0login authentication aaa7500kwtransport input noneline aux 0transport input allline vty 0 4endExample 3 Cisco 12000 Gigabit Switch Router Configuration
In the following example, SSH is configured on a Cisco 12000 with a timeout that is not to exceed 60 seconds, and no more than 2 authentication retries. Also, before configuring the SSH server feature on the router, TACACS+ is specified as the method of authentication.
version 12.0no service padservice timestamps debug uptimeservice timestamps log uptimeno service password-encryptionhostname cisco12000boot system flash slot0:gsr-tpgen-mz.082098aaa new-modelaaa authentication login default tacacs+aaa authentication login aaa12000kw noneenable password enable12000pwusername mcisco password 0 maryspwusername jcisco password 0 johnspwredundancymain-cpuauto-sync startup-configip subnet-zerono ip domain-lookupip domain-name cisco.comip ssh time-out 60ip ssh authentication-retries 2interface ATM0/0no ip addressno ip directed-broadcastno ip route-cache cefshutdowninterface POS1/0ip address 10.100.100.2 255.255.255.0no ip directed-broadcastencapsulation pppno ip route-cache cefno keepalivecrc 16no cdp enableinterface POS1/1no ip addressno ip directed-broadcastno ip route-cache cefshutdowncrc 32interface POS1/2no ip addressno ip directed-broadcastno ip route-cache cefshutdowncrc 32interface POS1/3no ip addressno ip directed-broadcastno ip route-cache cefshutdowncrc 32interface POS2/0ip address 10.1.1.1 255.255.255.0no ip directed-broadcastencapsulation pppno ip route-cache cefcrc 16interface Ethernet0ip address 172.17.110.91 255.255.255.224no ip directed-broadcastrouter ospf 1network 0.0.0.0 255.255.255.255 area 0.0.0.0ip classlessip route 0.0.0.0 0.0.0.0 172.17.110.65logging trap debuggingtacacs-server host 172.17.116.138tacacs-server key ciscoradius-server host 172.17.116.138 auth-port 1650 acct-port 1651radius-server key ciscoline con 0exec-timeout 0 0login authentication aaa12000pwtransport input noneline aux 0line vty 0 4no scheduler max-task-timeno exception linecard slot 0 sqe-registersno exception linecard slot 1 sqe-registersno exception linecard slot 2 sqe-registersno exception linecard slot 3 sqe-registersno exception linecard slot 4 sqe-registersno exception linecard slot 5 sqe-registersno exception linecard slot 6 sqe-registersendCommand Reference
This section documents new commands. All other commands used with this feature are documented in the Cisco IOS Release 12.1 command reference publications.
ip ssh
To configure SSH control parameters on your router, use the ip ssh global configuration command. Use the no form of this command to restore the default value.
[no] ip ssh {[timeout seconds]} | [authentication-retries integer]}
Syntax Description
Defaults
120 seconds for the timeout timer.
3 authentication-retries.
Command Modes
Global configuration
Command History
12.0(5)S
This command was introduced in Cisco IOS Release 12.0 S.
12.1(1)T
This command was introduced in Cisco IOS Release 12.1 T.
Usage Guidelines
Before you configure SSH on your router, you must enable the SSH server using the crypto key generate rsa command.
Examples
The following examples configure SSH control parameters on your router:
ip ssh timeout 120ip ssh authentication-retires 3show ip ssh
To display your router's SSH connections, use the show ip ssh privileged EXEC command.
show ip ssh
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
12.0(5)S
This command was introduced in Cisco IOS Release 12.0 S.
12.1(1)T
This command was introduced in Cisco IOS Release 12.1 T.
Usage Guidelines
You must enable the SSH server before using this command. If the SSH server is not enabled, this command will generate an error message.
Examples
The following is sample output from the show ip ssh command. The number of connections displayed is the same as the number of VTYs used. For example, if "0" connections are displayed, "0" VTYs are defined. By default, there are 5 VTYs defined for 5 possible terminal sessions:
Router# show ip sshConnection Version Encryption State Username0 1.5 3DES 4 guestdisconnect ssh
To terminate a SSH connection on your router, use the disconnect ssh privileged EXEC command.
disconnect ssh [vty] session-id
Syntax Description
vty
(Optional) Virtual terminal for remote console access.
session-id
The session-id is the number of connections displayed in the show ip ssh command output.
Command Modes
Privileged EXEC
Command History
12.0(5)S
This command was introduced in Cisco IOS Release 12.0 S.
12.1(1)T
This command was introduced in Cisco IOS Release 12.1 T.
Usage Guidelines
•
•
Examples
The following example terminates SSH connection number 1:
Router# disconnect ssh 1Related Commands
clear line vty n
Return a terminal line to idle state using the privileged EXEC command.
Debug Commands
This section documents the new debug command related to the SSH server.
debug ip ssh
To display debug messages for SSH, use the debug ip ssh EXEC command. Use the no form of the command to disable debugging output.
[no] debug ip ssh
Syntax Description
This command has no arguments or keywords.
Defaults
Debugging for SSH is not enabled.
Command History
12.0(5)S
This command was introduced in Cisco IOS Release 12.0 S.
12.1(1)T
This command was introduced in Cisco IOS Release 12.1 T.
Usage Guidelines
Use the debug ssh command to ensure normal operation of the SSH server.
Examples
The following example shows the SSH debugging output:
Router# debug ssh00:53:46: SSH0: starting SSH control process00:53:46: SSH0: Exchanging versions - SSH-1.5-Cisco-1.2500:53:46: SSH0: client version is - SSH-1.5-1.2.2500:53:46: SSH0: SSH_SMSG_PUBLIC_KEY message sent00:53:46: SSH0: SSH_CMSG_SESSION_KEY message received00:53:47: SSH0: keys exchanged and encryption on00:53:47: SSH0: authentication request for userid guest00:53:47: SSH0: authentication successful for jcisco00:53:47: SSH0: starting exec shellGlossary
AAA—authentication, authorization, and accounting. A framework of security services that provide the method for identifying users (authentication), for remote access control (authorization), and for collecting and sending security server information used for billing, auditing, and reporting (accounting).
authentication, authorization, and accounting—See AAA.
IP Security Protocol—See IPSec.
IPSec—IP Security Protocol. A framework of open standards that provides data confidentiality, data integrity, and data authentication between participating peers. IPSec provides these security services at the IP layer. IPSec uses IKE to handle negotiation of protocols and algorithms based on local policy and to generate the encryption and authentication keys to be used by IPSec. IPSec can be used to protect one or more data flows between a pair of hosts, between a pair of security gateways, or between a security gateway and a host.
Secure Shell—See SSH.
SSH—Secure Shell Protocol. A protocol that provides a secure remote connection to a router through a Transmission Control Protocol (TCP) application.
TACACS+—Terminal Access Controller Access Control System Plus. A security protocol that provides detailed accounting information and flexible administrative control over authentication and authorization processes. TACACS+ is facilitated through AAA and can be enabled only through AAA commands.
TCP—Transmission Control Protocol. A connection-oriented transport layer protocol that provides reliable full-duplex data transmission.
Terminal Access Controller Access Control System Plus—See TACACS+.
Transmission Control Protocol—See TCP.
RADIUS—Remote Authentication Dial-In User Service. A distributed client/server system that secures networks against unauthorized access. RADIUS clients run on Cisco routers and send authentication requests to a central RADIUS server that contains all user authentication and network service access information.
Remote Authentication Dial-In User Service—See RADIUS.
