Table Of Contents

Secure Shell Commands on Cisco IOS XR Software

clear ssh

sftp

show ssh

show ssh session details

ssh

ssh client knownhost

ssh client source-interface

ssh client vrf

ssh server

ssh server logging

ssh server rate-limit

ssh server session-limit

ssh server v2

ssh timeout

Secure Shell Commands on Cisco IOS XR Software

---

This module describes the Cisco IOS XR software commands used to configure Secure Shell (SSH).

For detailed information about SSH concepts, configuration tasks, and examples, see the Implementing Secure Shell on Cisco IOS XR Software configuration module of Cisco IOS XR System Security Configuration Guide.

clear ssh

To terminate an incoming or outgoing Secure Shell (SSH) connection, use the clear ssh command in EXEC mode.

clear ssh {session-id | outgoing session-id}

Syntax Description

session-id	Session ID number of an incoming connection as displayed in the show ssh command output. Range is from 0 to 1024.
outgoing session-id	Specifies the session ID number of an outgoing connection as displayed in the show ssh command output. Range is from 1 to 10.

Defaults

No default behavior or values

Command Modes

EXEC

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.
Release 3.3.0	No modification.
Release 3.4.0	No modification.
Release 3.5.0	No modification.
Release 3.6.0	No modification.
Release 3.7.0	No modification.
Release 3.8.0	No modification.

Usage Guidelines

To use this command, your Cisco IOS XR software system administrator must assign you to a user group associated with a task group that includes the corresponding command task IDs. If you need assistance with your task group assignment, contact your system administrator. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of Cisco IOS XR System Security Configuration Guide.

Use the clear ssh command to disconnect incoming or outgoing SSH connections. Incoming connections are managed by the SSH server running on the local networking device. Outgoing connections are initiated from the local networking device.

To display the session ID for a connection, use the show ssh command.

Task ID

Task ID	Operations
crypto	execute

Examples

In the following example, the show ssh command is used to display all incoming and outgoing connections to the router. The clear ssh command is then used to terminate the incoming session with the ID number 0.

RP/0/RP0/CPU0:router# show ssh

SSH version: Cisco-2.0 

session     pty  location   state       userid     host        ver 

--------------------------------------------------------------------

Incoming sessions 

0           vty0 0/33/1  SESSION_OPEN   cisco   172.19.72.182   v2

1           vty1 0/33/1  SESSION_OPEN   cisco   172.18.0.5      v2

2           vty2 0/33/1  SESSION_OPEN   cisco   172.20.10.3     v1

3           vty3 0/33/1  SESSION_OPEN   cisco   3333::50        v2

Outgoing sessions 

1               0/33/1  SESSION_OPEN    cisco   172.19.72.182   v2 

2               0/33/1  SESSION_OPEN    cisco   3333::50        v2

RP/0/RP0/CPU0:router# clear ssh 0

Related Commands

Command	Description
show ssh	Displays the incoming and outgoing connections to the router.

sftp

To start the secure FTP (SFTP) client, use the sftp command in EXEC mode.

sftp [username@ host:remote-filename] {source-filename} {dest-filename} [source-interface type path-id] [vrf vrf-name]

Syntax Description

username	(Optional) Name of the user performing the file transfer. The at symbol (@) following the username is required.
hostname:remote-filename	(Optional) Name of the Secure Shell File Transfer Protocol (SFTP) server. The colon (:) following the hostname is required.
source-filename	SFTP source, including the path.
dest-filename	SFTP destination, including the path.
source-interface	(Optional) Specifies the source IP address of a selected interface for all outgoing SSH connections.
type	Interface type. For more information, use the question mark (?) online help function.
path-id	Physical interface or virtual interface. Note Use the show interfaces command in EXEC mode to see a list of all interfaces currently configured on the router. For more information about the syntax for the router, use the question mark (?) online help function.
vrf vrf-name	Specifies the name of the VRF associated with the source interface.

Defaults

If no username argument is provided, the login name on the router is used. If no hostname argument is provided, the file is considered local.

Command Modes

EXEC

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.
Release 3.3.0	No modification.
Release 3.4.0	No modification.
Release 3.5.0	No modification.
Release 3.6.0	No modification.
Release 3.7.0	No modification.
Release 3.8.0	The srcfile keyword was removed and was replaced by an argument for this same purpose. Support was added for the vrf and the source-interface keywords.

Usage Guidelines

To use this command, your Cisco IOS XR software system administrator must assign you to a user group associated with a task group that includes the corresponding command task IDs. If you need assistance with your task group assignment, contact your system administrator. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of Cisco IOS XR System Security Configuration Guide.

SFTP provides for the secure (and authenticated) copying of files between a router and a remote host. Like the copy command, the sftp command can be invoked only in EXEC mode.

If a username is not provided, the login name on the router is used as the default. If a host name is not provided, the file is considered local.

If the source interface is specified in the sftp command, the sftp interface takes precedence over the interface specified in the ssh client source-interface command.

When the file destination is a local path, all of the source files should be on remote hosts, and vice versa.

When multiple source files exist, the destination should be a preexisting directory. Otherwise, the destination can be either a directory name or destination filename. The file source cannot be a directory name.

If you download files from different remote hosts, that is, the source points to different remote hosts, the SFTP client spawns SSH instances for each host, which may result in multiple prompts for user authentication.

Task ID

Task ID	Operations
crypto	execute
basic-services	execute

Examples

In the following example, user abc is downloading the file ssh.diff from the SFTP server ena-view1 to disk0:

RP/0/RP0/CPU0:router# sftp abc@ena-view1:ssh.diff disk0

In the following example, user abc is uploading multiple files from disk 0:/sam_* to /users/abc/ on a remote SFTP server called ena-view1:

RP/0/RP0/CPU0:router# sftp disk0:/sam_* abc@ena-view1:/users/abc/

Related Commands

Command	Description
ssh client source-interface	Specifies the source IP address of a selected interface for all outgoing SSH connections.
ssh client vrf	Configures a new VRF for use by the SSH client.

show ssh

To display all incoming and outgoing connections to the router, use the show ssh command in EXEC mode.

show ssh

Syntax Description

This command has no arguments or keywords.

Defaults

No default behavior or values

Command Modes

EXEC

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.
Release 3.3.0	No modification.
Release 3.4.0	No modification.
Release 3.5.0	No modification.
Release 3.6.0	No modification.
Release 3.7.0	No modification.
Release 3.8.0	No modification.

Usage Guidelines

To use this command, your Cisco IOS XR software system administrator must assign you to a user group associated with a task group that includes the corresponding command task IDs. If you need assistance with your task group assignment, contact your system administrator. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of Cisco IOS XR System Security Configuration Guide.

Use the show ssh command to display all incoming and outgoing Secure Shell (SSH) Version 1 (SSHv1) and SSH Version 2 (SSHv2) connections.

Task ID

Task ID	Operations
crypto	read

Examples

The following sample output is from the show ssh command when SSH is enabled:

RP/0/RP0/CPU0:router# show ssh

SSH version: Cisco-2.0

id pty      location      state        userid        host           ver

------------------------------------------------------------------------

Incoming sessions

0 vty0      0/0/CPU0    SESSION_OPEN    cisco       172.19.72.182    v2

1 vty1      0/0/CPU0    SESSION_OPEN    cisco       172.18.0.5       v2

2 vty2      0/0/CPU0    SESSION_OPEN    cisco       172.20.10.3      v1

3 vty3      0/0/CPU0    SESSION_OPEN    cisco       3333::50         v2

Outgoing sessions

1           0/0/CPU0    SUSPENDED       root        172.19.72.182    v2

Table 32 describes the significant fields shown in the display.

Table 32 show ssh Field Descriptions

Field	Description
session	Session identifier for the incoming and outgoing SSH connections.
pty	pty-id allocated for the incoming session. Null for outgoing SSH connection.
location	Specifies where the SSH server is running for incoming connection. For an outgoing connection, location specifies from which route processor the SSH session is initiated.
state	The SSH state that the connection is currently in.
userid	Authentication, authorization and accounting (AAA) username used to connect to or from the router.
host	IP address of the remote peer.
ver	Specifies if the connection type is SSHv1 or SSHv2.

Related Commands

Command	Description
show sessions	Displays information about open Telnet or rlogin connections. For more information, see Cisco IOS XR System Management Command Reference.
show ssh session details	Displays the details for all the incoming and outgoing SSHv2 connections to the router.
show user	Displays information about the active lines on the router.

show ssh session details

To display the details for all incoming and outgoing Secure Shell Version 2 (SSHv2) connections, use the show ssh session details command in EXEC mode.

show ssh session details

Syntax Description

This command has no arguments or keywords.

Defaults

No default behavior or values

Command Modes

EXEC

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.
Release 3.3.0	No modification.
Release 3.4.0	No modification.
Release 3.5.0	No modification.
Release 3.6.0	No modification.
Release 3.7.0	No modification.
Release 3.8.0	No modification.

Usage Guidelines

To use this command, your Cisco IOS XR software system administrator must assign you to a user group associated with a task group that includes the corresponding command task IDs. If you need assistance with your task group assignment, contact your system administrator. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of Cisco IOS XR System Security Configuration Guide.

Use the show ssh session details command to display a detailed report of the SSHv2 connections to or from the router, including the cipher chosen for the specific session.

Task ID

Task ID	Operations
crypto	read

Examples

The following is sample output from the show ssh session details command to display the details for all the incoming and outgoing SSHv2 connections:

RP/0/RP0/CPU0:router# show ssh session details

SSH version: Cisco-2.0

session     key-exchange   pubkey   incipher   outcipher    inmac     outmac

-------------------------------------------------------------------------------

Incoming Session

0           diffie-hellman ssh-dss  3des-cbc   3des-cbc     hmac-md5  hmac-md5

Outgoing connection

1           diffie-hellman ssh-dss  3des-cbc   3des-cbc     hmac-md5  hmac-md5

Table 33 describes the significant fields shown in the display.

Table 33 show ssh session details Field Descriptions

Field	Description
session	Session identifier for the incoming and outgoing SSH connections.
key-exchange	Key exchange algorithm chosen by both peers to authenticate each other.
pubkey	Public key algorithm chosen for key exchange.
incipher	Encryption cipher chosen for the Rx traffic.
outcipher	Encryption cipher chosen for the Tx traffic.
inmac	Authentication (message digest) algorithm chosen for the Rx traffic.
outmac	Authentication (message digest) algorithm chosen for the Tx traffic.

Related Commands

Command	Description
show sessions	Displays information about open Telnet or rlogin connections. For more information, see Cisco IOS XR System Management Command Reference.
show ssh	Displays all the incoming and outgoing connections to the router.
show user	Displays information about the active lines on the router.

ssh

To start the Secure Shell (SSH) client and to ensure an outbound connection to an SSH server, use the ssh command in EXEC mode.

ssh [vrf vrf-name] {ipv4-address | ipv6-address | hostname} [username user-id] [cipher aes {128-cbc | 192-cbc | 256-cbc}] [source-interface type path-id]

Syntax Description

vrf vrf-name	Specifies the name of the VRF associated with this connection.
ipv4-address	IPv4 address in A:B:C:D format.
ipv6-address	IPv6 address in X:X::X format.
hostname	Hostname of the remote node. If the hostname has both IPv4 and IPv6 addresses, the IPv6 address is used.
username user-id	(Optional) Specifies the username to use when logging in on the remote networking device running the SSH server. If no user ID is specified, the default is the current user ID.
cipher aes	(Optional) Specifies Advanced Encryption Standard (AES) as the cipher for the SSH client connection. Note If there is no specification of a particular cipher by the administrator, the client proposes 3DES as the default to ensure compatibility.
128-CBC	128-bit keys in CBC mode.
192-CBC	192-bit keys in CBC mode.
256-CBC	256-bit keys in CBC mode.
source interface	(Optional) Specifies the source IP address of a selected interface for all outgoing SSH connections.
type	Interface type. For more information, use the question mark (?) online help function.
path-id	Physical interface or virtual interface. Note Use the show interfaces command in EXEC mode to see a list of all interfaces currently configured on the router. For more information about the syntax for the router, use the question mark (?) online help function.

Defaults

3DES cipher is the default.

Command Modes

EXEC

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.
Release 3.3.0	No modification.
Release 3.4.0	No modification.
Release 3.5.0	No modification.
Release 3.6.0	No modification.
Release 3.7.0	No modification.
Release 3.8.0	Support was added for the following: •Association of a specific VRF for the client connection was added. •Advanced Encryption Standard (AES) cipher with three bit lengths.

Usage Guidelines

To use this command, your Cisco IOS XR software system administrator must assign you to a user group associated with a task group that includes the corresponding command task IDs. If you need assistance with your task group assignment, contact your system administrator. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of Cisco IOS XR System Security Configuration Guide.

Use the ssh command to make an outbound client connection. The SSH client tries to make an SSHv2 connection to the remote peer. If the remote peer supports only the SSHv1 server, it internally spawns an SSHv1 connection to the remote server. The process of the remote peer version detection and spawning the appropriate client connection is transparent to the user.

If a VRF is specified in the ssh command, the ssh interface takes precedence over the interface specified in the ssh client source-interface command.

When you configure the cipher aes keyword, an SSH client makes a proposal, including one or more of the key sizes you specified, as part of its request to the SSH server. The SSH server chooses the best possible cipher, based both on which ciphers that server supports and on the client proposal.

---

Note AES encryption algorithm is not supported on the SSHv1 server and client. Any requests for an AES cipher sent by an SSHv2 client to an SSHv1 server are ignored, with the server using 3DES instead.

---

A VRF is required to run SSH, although this may be either the default VRF or a VRF specified by the user. If no VRF is specified while configuring the ssh client source-interface or ssh client knownhost commands, the default VRF is assumed.

Task ID

Task ID	Operations
crypto	execute
basic-services	execute

Examples

The following sample output is from the ssh command to enable an outbound SSH client connection:

RP/0/RP0/CPU0:router# ssh vrf green username userabc

Related Commands

Command	Description
show ssh	Displays all the incoming and outgoing connections to the router.

ssh client knownhost

To authenticate a server public key (pubkey), use the ssh client knownhost command in global configuration mode. To disable authentication of a server pubkey, use the no form of this command.

ssh client knownhost device:/filename

no ssh client knownhost device:/filename

Syntax Description

device:/filename

Complete path of the filename (for example, slot0:/server_pubkey). The colon (:) and slash (/) are required.

Defaults

No default behavior or values

Command Modes

Global configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.
Release 3.3.0	No modification.
Release 3.4.0	No modification.
Release 3.5.0	No modification.
Release 3.6.0	No modification.
Release 3.7.0	No modification.
Release 3.8.0	No modification.

Usage Guidelines

To use this command, your Cisco IOS XR software system administrator must assign you to a user group associated with a task group that includes the corresponding command task IDs. If you need assistance with your task group assignment, contact your system administrator. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of Cisco IOS XR System Security Configuration Guide.

The server pubkey is a cryptographic system that uses two keys at the client end—a public key known to everyone and a private, or secret, key known only to the owner of the keys. In the absence of certificates, the server pubkey is transported to the client through an out-of-band secure channel. The client stores this pubkey in its local database and compares this key against the key supplied by the server during the early stage of key negotiation for a session-building handshake. If the key is not matched or no key is found in the local database of the client, users are prompted to either accept or reject the session.

The operative assumption is that the first time the server pubkey is retrieved through an out-of-band secure channel, it is stored in the local database. This process is identical to the current model adapted by Secure Shell (SSH) implementations in the UNIX environment.

Task ID

Task ID	Operations
crypto	read, write

Examples

The following sample output is from the ssh client knownhost command:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# ssh client knownhost disk0:/ssh.knownhost

RP/0/RP0/CPU0:router(config)# commit

RP/0/RP0/CPU0:router# ssh host1 username user1234

Host key not found from the list of known hosts. 

Are you sure you want to continue connecting (yes/no)? yes 

Password: 

RP/0/RP0/CPU0:host1# exit

RP/0/RP0/CPU0:router# ssh host1 username user1234

ssh client source-interface

To specify the source IP address of a selected interface for all outgoing Secure Shell (SSH) connections, use the ssh client source-interface command in global configuration mode. To disable use of the specified interface IP address, use the no form of this command.

ssh client source-interface type path-id

no ssh client source-interface type path-id

Syntax Description

type	Interface type. For more information, use the question mark (?) online help function.
path-id	Physical interface or virtual interface. Note Use the show interfaces command in EXEC mode to see a list of all interfaces currently configured on the router. For more information about the syntax for the router, use the question mark (?) online help function.

Defaults

No source interface is used.

Command Modes

Global configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.
Release 3.3.0	No modification.
Release 3.4.0	No modification.
Release 3.5.0	No modification.
Release 3.6.0	No modification.
Release 3.7.0	No modification.
Release 3.8.0	No modification.

Usage Guidelines

To use this command, your Cisco IOS XR software system administrator must assign you to a user group associated with a task group that includes the corresponding command task IDs. If you need assistance with your task group assignment, contact your system administrator. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of Cisco IOS XR System Security Configuration Guide.

Use the ssh client source-interface command to set the IP address of the specified interface for all outgoing SSH connections. If this command is not configured, TCP chooses the source IP address when the socket is connected, based on the outgoing interface used—which in turn is based on the route required to reach the server. This command applies to outbound shell over SSH as well as Secure Shell File Transfer Protocol (SFTP) sessions, which use the ssh client as a transport.

The source-interface configuration affects connections only to the remote host in the same address family. The system database (Sysdb) verifies that the interface specified in the command has a corresponding IP address (in the same family) configured.

Task ID

Task ID	Operations
crypto	read, write

Examples

The following example shows how to set the IP address of the Management Ethernet interface on 0/0/CPU0/0 for all outgoing SSH connections:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# ssh client source-interface MgmtEth 0/0/CPU0/0

ssh client vrf

To configure a new VRF for use by the SSH client, use the ssh client vrf command in global configuration mode. To remove the specified VRF, use the no form of this command.

ssh client vrf vrf-name

no ssh client vrf vrf-name

Syntax Description

vrf-name

Specifies the name of the VRF to be used by the SSH client.

Defaults

No default behavior or values

Command Modes

Global configuration

Command History

Release	Modification
Release 3.8.0	This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, your Cisco IOS XR software system administrator must assign you to a user group associated with a task group that includes the corresponding command task IDs. If you need assistance with your task group assignment, contact your system administrator. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of Cisco IOS XR System Security Configuration Guide.

An SSH client can have only one VRF.

If a specific VRF is not configured for the SSH client, the default VRF is assumed when applying other SSH client-related commands, such as ssh client knownhost or ssh client source-interface.

Task ID

Task ID	Operations
crypto	read, write

Examples

The following example shows the SSH client being configured to start with the specified VRF:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# ssh client vrf green

ssh server

To bring up the Secure Shell (SSH) server and to configure one or more VRFs for its use, use the ssh server command in global configuration mode. To stop the SSH server from receiving any further connections for the specified VRF, use the no form of this command.

ssh server [vrf vrf-name]

no ssh server [vrf vrf-name]

Syntax Description

vrf vrf-name

Specifies the name of the VRF to be used by the SSH server. The maximum VRF length is 32 characters. Note If no VRF is specified, the default VRF is assumed.

Defaults

The default SSH server version is 2 (SSHv2), which falls back to 1 (SSHv1) if the incoming SSH client connection is set to SSHv1. This fallback does not occur if the ssh server v2 command is used.

Command Modes

Global configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.
Release 3.3.0	No modification.
Release 3.4.0	No modification.
Release 3.5.0	No modification.
Release 3.6.0	No modification.
Release 3.7.0	No modification.
Release 3.8.0	The vrf keyword was supported on the Cisco CRS-1 and Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, your Cisco IOS XR software system administrator must assign you to a user group associated with a task group that includes the corresponding command task IDs. If you need assistance with your task group assignment, contact your system administrator. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of Cisco IOS XR System Security Configuration Guide.

An SSH server must be configured at minimum for one VRF. If you delete all configured VRFs, including the default, the SSH server process stops. If you do not configure a specific VRF for the SSH client when applying other commands, such as ssh client knownhost or ssh client source-interface, the default VRF is assumed.

The SSH server listens for an incoming client connection on port 22. This server handles both Secure Shell Version 1 (SSHv1) and SSHv2 incoming client connections for both IPv4 and IPv6 address families.

To verify that the SSH server is up and running, use the show process sshd command.

Task ID

Task ID	Operations
crypto	read, write

Examples

In the following example, the SSH server is brought up and receiving connections for VRF "green:"

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# ssh server vrf green

Related Commands

Command	Description
show processes	Displays information about the SSH server. For more information, see Cisco IOS XR System Management Command Reference.
ssh server v2	Forces the SSH server version to be only 2 (SSHv2).

ssh server logging

To enable SSH server logging, use the ssh server logging command in global configuration mode. To discontinue SSH server logging, use the no form of this command.

ssh server logging

no ssh server logging

Syntax Description

This command has no arguments or keywords.

Command Default

No default behaviors or values

Command Modes

Global configuration

Command History

Release	Modification
Release 3.8.0	This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, your Cisco IOS XR software system administrator must assign you to a user group associated with a task group that includes the corresponding command task IDs. If you need assistance with your task group assignment, contact your system administrator. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of Cisco IOS XR System Security Configuration Guide.

Following configuration of logging, you see one of the two following messages:

•Warning: The requested term-type is not supported

•SSH v2 connection from %s succeeded (user:%s, cipher:%s, mac:%s, pty:%s)

The warning message appears if you try to connect using an unsupported terminal type. Routers running Cisco IOS XRsoftware support only the vt100 terminal type.

The second message confirms a successful login.

Task ID

Task ID	Operations
crypto	read, write

Examples

The following example shows initiation of SSH server logging:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# ssh server logging

ssh server rate-limit

To limit the number of incoming Secure Shell (SSH) connection requests allowed per minute, use the ssh server rate-limit command in global configuration mode. To return to the default value, use the no form of this command.

ssh server rate-limit rate-limit

no ssh server rate-limit

Syntax Description

rate-limit

Number of incoming SSH connection requests allowed per minute. Range is from 1 to 120.

Defaults

rate-limit: 60 connection requests per minute

Command Modes

Global configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.
Release 3.3.0	No modification.
Release 3.4.0	No modification.
Release 3.5.0	No modification.
Release 3.6.0	No modification.
Release 3.8.0	No modification.

Usage Guidelines

To use this command, your Cisco IOS XR software system administrator must assign you to a user group associated with a task group that includes the corresponding command task IDs. If you need assistance with your task group assignment, contact your system administrator. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of Cisco IOS XR System Security Configuration Guide.

Use the ssh server rate-limit command to limit the incoming SSH connection requests to the configured rate. Any connection request beyond the rate limit is rejected by the SSH server. Changing the rate limit does not affect established SSH sessions.

If, for example, the rate-limit argument is set to 30, then 30 requests are allowed per minute, or more precisely, a two-second interval between connections is enforced.

Task ID

Task ID	Operations
crypto	read, write

Examples

The following example shows how to set the limit of incoming SSH connection requests to 20 per minute:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# ssh server rate-limit 20

ssh server session-limit

To configure the number of allowable concurrent incoming Secure Shell (SSH) sessions, use the ssh server session-limit command in global configuration mode. To return to the default value, use the no form of this command.

ssh server session-limit sessions

no ssh server session-limit

Syntax Description

sessions

Number of incoming SSH sessions allowed across the router. The range is from 1 to 1024.

Defaults

sessions: 64 per router

Command Modes

Global configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.
Release 3.3.0	No modification.
Release 3.4.0	No modification.
Release 3.5.0	No modification.
Release 3.6.0	No modification.
Release 3.7.0	No modification.
Release 3.8.0	No modification.

Usage Guidelines

To use this command, your Cisco IOS XR software system administrator must assign you to a user group associated with a task group that includes the corresponding command task IDs. If you need assistance with your task group assignment, contact your system administrator. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of Cisco IOS XR System Security Configuration Guide.

Use the ssh server session-limit command to configure the limit of allowable concurrent incoming SSH connections. Outgoing connections are not part of the limit.

Task ID

Task ID	Operations
crypto	read, write

Examples

The following example shows how to set the limit of incoming SSH connections to 50:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# ssh server session-limit 50

Related Commands

Command	Description
show processes	Displays information about the SSH server. For more information, see Cisco IOS XR System Management Command Reference.

ssh server v2

To force the SSH server version to be only 2 (SSHv2), use the ssh server v2 command in global configuration mode. To bring down an SSH server for SSHv2, use the no form of this command.

ssh server v2

no ssh server v2

Syntax Description

This command has no arguments or keywords.

Defaults

No default behavior or values

Command Modes

Global configuration

Command History

Release	Modification
Release 3.3.0	This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.
Release 3.4.0	No modification.
Release 3.5.0	No modification.
Release 3.6.0	No modification.
Release 3.7.0	No modification.
Release 3.8.0	No modification.

Usage Guidelines

To use this command, your Cisco IOS XR software system administrator must assign you to a user group associated with a task group that includes the corresponding command task IDs. If you need assistance with your task group assignment, contact your system administrator. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of Cisco IOS XR System Security Configuration Guide.

Only SSHv2 client connections are allowed.

Task ID

Task ID	Operations
crypto	read, write

Examples

The following example shows how to initiate the SSH server version to be only SSHv2:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# ssh server v2

Related Commands

Command	Description
ssh server	Initiates the SSH server.

ssh timeout

To configure the timeout value for authentication, authorization, and accounting (AAA) user authentication, use the ssh timeout command in global configuration mode. To set the timeout value to the default time, use the no form of this command.

ssh timeout seconds

no ssh timeout seconds

Syntax Description

seconds

Time period (in seconds) for user authentication. The range is from 5 to 120.

Defaults

seconds: 30

Command Modes

Global configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was supported on the Cisco XR 12000 Series Router.
Release 3.3.0	No modification.
Release 3.4.0	No modification.
Release 3.5.0	No modification.
Release 3.6.0	No modification.
Release 3.7.0	No modification.
Release 3.8.0	No modification.

Usage Guidelines

To use this command, your Cisco IOS XR software system administrator must assign you to a user group associated with a task group that includes the corresponding command task IDs. If you need assistance with your task group assignment, contact your system administrator. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of Cisco IOS XR System Security Configuration Guide.

Use the ssh timeout command to configure the timeout value for user authentication to AAA. If the user fails to authenticate itself within the configured time to AAA, the connection is aborted. If no value is configured, the default value of 30 seconds is used.

Task ID

Task ID	Operations
crypto	read, write

Examples

In the following example, the timeout value for AAA user authentication is set to 60 seconds:

RP/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# ssh timeout 60