System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

Secure Shell restrictions

Updated: September 18, 2026

Want to summarize with AI?

Log in

Describes host-key, FIPS, SFTP, authentication, application, cipher, terminal, password, and file-system restrictions that apply to SSH services on Cisco IOS XR routers.

Review these restrictions before configuring SSH, SCP, or SFTP.

SSH host-key requirements

  • An external client requires the router to have an RSA, DSA, or ECDSA host-key pair for an incoming SSHv2 connection.

  • A local RSA, DSA, or ECDSA host-key pair is not required when the router initiates an SSH client connection to an external device. A local host key is also not required when the router operates as an SFTP client.

  • During boot, the router automatically generates missing RSA, DSA, and ECDSA host-key pairs.

  • Do not delete every default crypto key identified by the the_default label. SSH clients cannot establish sessions with the router when no default key remains.

  • Keep at least one default crypto key on the router. In FIPS mode, at least one default RSA or ECDSA key is mandatory.

FIPS algorithm restrictions

These algorithms are supported only when FIPS mode is disabled:

  • Key exchange: diffie-hellman-group1-sha1 and curve25519

  • Cipher: 3des-cbc and chacha20-poly1305@openssh.com

An SSH session fails if one of these non-FIPS algorithms is configured before FIPS mode is enabled.

SFTP requirements and restrictions

  • The remote SSH server must enable the SFTP subsystem.

  • For example, an SSHv2 server can enable the subsystem in /etc/ssh2/sshd2_config with this entry:

    subsystem-sftp /usr/local/sbin/sftp-server

  • Public-domain SSH packages usually include the SFTP server and enable it by default.

  • SFTP requires OpenSSH_2.9.9p2 or later on the remote server.

Authentication and application restrictions

  • SSH, SFTP, and SCP servers support RSA-based user authentication. The SSH client does not support RSA-based user authentication in this source context.

  • Execution shell, SFTP, SCP, and NETCONF are the supported SSH applications.

SSH server cipher preference

The SSH server uses this cipher preference order:

  1. AES128

  2. AES192

  3. AES256

  4. aes128-gcm

  5. aes256-gcm

  6. chacha20-poly1305

The server rejects a client request for an unsupported cipher, and the SSH session does not proceed.

Terminal and password restrictions

  • Use terminal type VT100. The router generates a warning when the client uses another terminal type.

  • The SSH client does not support a password message of none.

File permission and timestamp behavior

  • A file created on the router does not retain its original UNIX-like permission information because the router infrastructure does not provide UNIX-like file permissions.

  • A file created on the remote file system uses the destination host's umask.

  • The modification time and last-access time of a file created on the remote file system are set to the time of the copy.