Explains authentication controls, multifactor access, port forwarding, packet marking, and timeout settings that secure and manage SSH connections on the routers.
Use this chapter to strengthen SSH authentication, control permitted connection behavior, and release resources held by inactive connections or channels.
The chapter covers these functional areas:
-
FIDO2 and Duo multifactor authentication
-
Authentication-attempt limits and permitted server authentication methods
-
SSH port forwarding and DSCP marking during connection establishment
-
Unused-connection and idle-channel timeouts
SSH access and connection controls
Explains the controls that authenticate SSH users, restrict access methods, protect forwarded application traffic, prioritize connection packets, and end inactive sessions on Cisco IOS XR routers.
FIDO2 authentication for SSH
Explains how FIDO2 hardware security keys provide passwordless SSH authentication while retaining private keys on the authenticator and requiring user presence.
SSH authentication attempt limits
Explains the overall SSH authentication-attempt limit and the separate fixed limit for password authentication on Cisco IOS XR SSH servers.
Multifactor authentication for SSH
Explains how SSH login combines user credentials with a token, cryptographic device, or mobile approval to reduce access risks caused by compromised or weak passwords.
Selective SSH server authentication methods
Explains how a Cisco IOS XR SSH server permits selected password, keyboard-interactive, and public-key authentication methods and rejects attempts that use disabled methods.
SSH port forwarding
Explains how SSH tunneling carries application TCP/IP traffic through an encrypted channel between a local client and a remote application server.
DSCP marking for SSH packets
Explains when CiscoSSH marks client and server packets and how connection-phase marking prevents initial SSH handshake packets from being filtered.
SSH server timeouts
Explains how separate connection and channel timers release inactive SSH resources on Cisco IOS XR routers while preserving active connections and independent management operations.