The Secure Shell Protocol (SSH) server feature enables a SSH client to make a secure, encrypted connection to a Cisco Nexus 3000 Series switch. SSH uses strong encryption for authentication. The SSH server in the Cisco Nexus 3000 Series switch interoperates with publicly and commercially available SSH clients.

The user authentication mechanisms supported for SSH are RADIUS, TACACS+, and the use of locally stored user names and passwords.

The SSH client feature is an application running over the SSH protocol to provide device authentication and encryption. The SSH client enables a Cisco Nexus 3000 Series switch to make a secure, encrypted connection to another Cisco Nexus 3000 Series switch or to any other device running an SSH server. This connection provides an outbound connection that is encrypted. With authentication and encryption, the SSH client allows for a secure communication over an insecure network.

The SSH client in the Cisco Nexus 3000 Series switch works with publicly and commercially available SSH servers.

SSH requires server keys for secure communications to the Cisco Nexus 3000 Series switch. You can use SSH keys for the following SSH options:

• SSH version 2 using Rivest, Shamir, and Adelman (RSA) public-key cryptography
• SSH version 2 using the Digital System Algrorithm (DSA)

Be sure to have an SSH server key-pair with the appropriate version before enabling the SSH service. You can generate the SSH server key-pair according to the SSH client version used. The SSH service accepts three types of key-pairs for use by SSH version 2:

• The dsa option generates the DSA key-pair for the SSH version 2 protocol.
• The rsa option generates the RSA key-pair for the SSH version 2 protocol.

By default, the Cisco Nexus 3000 Series switch generates an RSA key using 1024 bits.

SSH supports the following public key formats:

• OpenSSH
• IETF Secure Shell (SECSH)

Caution

If you delete all of the SSH keys, you cannot start the SSH services.

The Telnet protocol enables TCP/IP connections to a host. Telnet allows a user at one site to establish a TCP connection to a login server at another site, and then passes the keystrokes from one system to the other. Telnet can accept either an IP address or a domain name as the remote system address.

The Telnet server is enabled by default on the Cisco Nexus 3000 Series switch.

SSH has the following configuration guidelines and limitations:

• The Cisco Nexus 3000 Series switch supports only SSH version 2 (SSHv2).

You can generate an SSH server key based on your security requirements. The default SSH server key is an RSA key that is generated using 1024 bits.

You can configure an SSH public key to log in using an SSH client without being prompted for a password. You can specify the SSH public key in one of three different formats:

• Open SSH format
• IETF SECSH format
• Public Key Certificate in PEM format

You can start SSH sessions to connect to remote devices from your Cisco Nexus 3000 Series switch.

When you download a file from a server using SCP or SFTP, you establish a trusted SSH relationship with that server.

By default, the SSH server is enabled on the Cisco Nexus 3000 Series switch.

You can delete SSH server keys after you disable the SSH server.

Note	To reenable SSH, you must first generate an SSH server key.

You can clear SSH sessions from the Cisco Nexus 3000 Series switch.

The following example shows how to configure SSH:

By default, the Telnet server is enabled. You can disable the Telnet server on your Cisco Nexus 3000 Series switch.

Before you start a Telnet session to connect to remote devices, you should do the following:

• Obtain the hostname for the remote device and, if needed, obtain the username on the remote device.
• Enable the Telnet server on the Cisco Nexus 3000 Series switch.
• Enable the Telnet server on the remote device.

You can clear Telnet sessions from the Cisco Nexus 3000 Series switch.

To display the SSH configuration information, perform one of the following tasks:

The following table lists the default settings for SSH parameters.