System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

Selective SSH server authentication methods

Updated: September 18, 2026

Want to summarize with AI?

Log in

Explains how a Cisco IOS XR SSH server permits selected password, keyboard-interactive, and public-key authentication methods and rejects attempts that use disabled methods.

Selective SSH server authentication is a control that

  • allows password, keyboard-interactive, and public-key methods to be disabled individually

  • limits clients to the remaining permitted methods, and

  • rejects login attempts that use a disabled method.

Public-key authentication includes certificate-based authentication. Disabling public-key authentication therefore disables certificate-based authentication.

Table 1. Feature History Table

Feature Name

Release Information

Feature Description

Selective Authentication Methods for SSH Server

Release 25.4.1

Introduced in this release on: Fixed Systems (8010 [ASIC: A100]) (select variants only*)

*This feature is supported on:

  • 8011-32Y8L2H2FH

  • 8011-12G12X4Y-A/D

Selective Authentication Methods for SSH Server

Release 25.1.1

Introduced in this release on: Fixed Systems (8700 [ASIC: K100], 8010 [ASIC: A100]) (select variants only*)

*This feature is supported on:

  • 8712-MOD-M

  • 8011-4G24Y4H-I

Selective Authentication Methods for SSH Server

Release 24.4.1

Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100])(select variants only*); Modular Systems (8800 [LC ASIC: P100]) (select variants only*)

*This feature is supported on:

  • 8212-48FH-M

  • 8711-32FH-M

  • 88-LC1-36EH

  • 88-LC1-12TH24FH-E

  • 88-LC1-52Y8H-EM

Selective Authentication Methods for SSH Server

Release 7.8.1

You now have the flexibility to choose the preferred SSH server authentication methods on the router. These methods include password authentication, keyboard-interactive authentication, and public-key authentication. This feature allows you to selectively disable these authentication methods. By allowing the SSH clients to connect to the server only through these permitted authentication methods, this functionality brings in additional security for router access through SSH. Before this release, by default, the SSH server allowed all these authentication methods for establishing SSH connections.

The feature introduces these changes:

  • CLI: New disable auth-methods command

  • YANG Data Model: New XPaths for Cisco-IOS-XR-crypto-ssh-cfg.yang Cisco native model (see GitHub)

Disable SSH server authentication methods

Prevent clients from using an authentication method that is not permitted by the router's access policy.

This example disables keyboard-interactive authentication. You can similarly disable password or public-key authentication.

Procedure

  1. Disable keyboard-interactive authentication and commit the SSH server configuration.

    Example:

    Router# configure
Router(config)# ssh server
Router(config-ssh)# disable auth-methods keyboard-interactive
Router(config-ssh)# commit

  2. Verify the permitted SSH server authentication methods.

    Example:

    Router# show ssh server
Authentication Method Supported
------------------------------------
PublicKey := Yes
Password := Yes
Keyboard-Interactive := No
Certificate Based := Yes

The server rejects keyboard-interactive login attempts and continues to accept the other displayed methods.