- Preface
- Using the Command-Line Interface
-
- Configuring Spanning Tree Protocol
- Configuring Multiple Spanning-Tree Protocol
- Configuring Optional Spanning-Tree Features
- Configuring EtherChannels
- Configuring Link-State Tracking
- Configuring Flex Links and the MAC Address-Table Move Update Feature
- Configuring UniDirectional Link Detection
- Configuring Resilient Ethernet Protocol
-
- Security Features Overview
- Preventing Unauthorized Access
- Controlling Switch Access with Passwords and Privilege Levels
- Configuring TACACS+
- Configuring RADIUS
- Configuring Kerberos
- Configuring Local Authentication and Authorization
- Configuring Secure Shell (SSH)
- Configuring Secure Socket Layer HTTP
- Configuring IPv4 ACLs
- Configuring IPv6 ACLs
- Configuring DHCP
- Configuring IP Source Guard
- Configuring Dynamic ARP Inspection
- Configuring IEEE 802.1x Port-Based Authentication
- Configuring Web-Based Authentication
- Configuring Port-Based Traffic Control
- Configuring IPv6 First Hop Security
- Configuring Cisco TrustSec
- Configuring FIPS
- Index
- Finding Feature Information
- Prerequisites for Configuring the Switch for Secure Shell (SSH) and Secure Copy Protocol (SCP)
- Restrictions for Configuring the Switch for SSH
- Information about SSH
- How to Configure SSH
- Monitoring the SSH Configuration and Status
- Additional References
- Feature Information for SSH
Configuring Secure Shell (SSH)
- Finding Feature Information
- Prerequisites for Configuring the Switch for Secure Shell (SSH) and Secure Copy Protocol (SCP)
- Restrictions for Configuring the Switch for SSH
- Information about SSH
- How to Configure SSH
- Monitoring the SSH Configuration and Status
- Additional References
- Feature Information for SSH
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Prerequisites for Configuring the Switch for Secure Shell (SSH) and Secure Copy Protocol (SCP)
The following are the prerequisites for configuring the switch for secure shell (SSH):
-
For SSH to work, the switch needs an RSA public/private key pair. This is the same with Secure Copy Protocol (SCP), which relies on SSH for its secure transport.
-
Before enabling SCP, you must correctly configure SSH, authentication, and authorization on the switch.
-
Because SCP relies on SSH for its secure transport, the router must have an Rivest, Shamir, and Adelman (RSA) key pair.
-
SCP relies on SSH for security.
-
SCP requires that authentication, authorization, and accounting (AAA) authorization be configured so the router can determine whether the user has the correct privilege level.
-
A user must have appropriate authorization to use SCP.
-
A user who has appropriate authorization can use SCP to copy any file in the Cisco IOS File System (IFS) to and from a switch by using the copy command. An authorized administrator can also do this from a workstation.
Restrictions for Configuring the Switch for SSH
The following are restrictions for configuring the Switch for secure shell.
-
The switch supports Rivest, Shamir, and Adelman (RSA) authentication.
-
SSH supports only the execution-shell application.
-
The SSH server and the SSH client are supported only on DES (56-bit) and 3DES (168-bit) data encryption software.
-
The Switch supports the Advanced Encryption Standard (AES) encryption algorithm with a 128-bit key, 192-bit key, or 256-bit key. However, symmetric cipher AES to encrypt the keys is not supported.
-
This software release does not support IP Security (IPSec).
-
When using SCP, you cannot enter the password into the copy command. You must enter the password when prompted.
Information about SSH
Secure Shell (SSH) is a protocol that provides a secure, remote connection to a device. SSH provides more security for remote connections than Telnet does by providing strong encryption when a device is authenticated. This software release supports SSH Version 1 (SSHv1) and SSH Version 2 (SSHv2).
- SSH and Switch Access
- SSH Servers, Integrated Clients, and Supported Versions
- SSH Configuration Guidelines
- Secure Copy Protocol Overview
- Secure Copy Protocol
SSH and Switch Access
Secure Shell (SSH) is a protocol that provides a secure, remote connection to a device. SSH provides more security for remote connections than Telnet does by providing strong encryption when a device is authenticated. This software release supports SSH Version 1 (SSHv1) and SSH Version 2 (SSHv2).
SSH functions the same in IPv6 as in IPv4. For IPv6, SSH supports IPv6 addresses and enables secure, encrypted connections with remote IPv6 nodes over an IPv6 transport.
SSH Servers, Integrated Clients, and Supported Versions
The SSH feature has an SSH server and an SSH integrated client, which are applications that run on the switch. You can use an SSH client to connect to a switch running the SSH server. The SSH server works with the SSH client supported in this release and with non-Cisco SSH clients. The SSH client also works with the SSH server supported in this release and with non-Cisco SSH servers.
The switch supports an SSHv1 or an SSHv2 server.
The switch supports an SSHv1 client.
SSH supports the Data Encryption Standard (DES) encryption algorithm, the Triple DES (3DES) encryption algorithm, and password-based user authentication.
SSH also supports these user authentication methods:
SSH Configuration Guidelines
Follow these guidelines when configuring the switch as an SSH server or SSH client:
-
An RSA key pair generated by a SSHv1 server can be used by an SSHv2 server, and the reverse.
-
If the SSH server is running on a stack master and the stack master fails, the new stack master uses the RSA key pair generated by the previous stack master.
-
If you get CLI error messages after entering the crypto key generate rsa global configuration command, an RSA key pair has not been generated. Reconfigure the hostname and domain, and then enter the crypto key generate rsa command. For more information, see Related Topics below.
-
When generating the RSA key pair, the message No host name specified might appear. If it does, you must configure a hostname by using the hostname global configuration command.
-
When generating the RSA key pair, the message No domain specified might appear. If it does, you must configure an IP domain name by using the ip domain-name global configuration command.
-
When configuring the local authentication and authorization authentication method, make sure that AAA is disabled on the console.
Secure Copy Protocol Overview
The Secure Copy Protocol (SCP) feature provides a secure and authenticated method for copying switch configurations or switch image files. SCP relies on Secure Shell (SSH), an application and a protocol that provides a secure replacement for the Berkeley r-tools.
For SSH to work, the switch needs an RSA public/private key pair. This is the same with SCP, which relies on SSH for its secure transport.
Because SSH also relies on AAA authentication, and SCP relies further on AAA authorization, correct configuration is necessary.
-
Before enabling SCP, you must correctly configure SSH, authentication, and authorization on the switch.
-
Because SCP relies on SSH for its secure transport, the router must have an Rivest, Shamir, and Adelman (RSA) key pair.
![]() Note | When using SCP, you cannot enter the password into the copy command. You must enter the password when prompted. |
Secure Copy Protocol
The Secure Copy Protocol (SCP) feature provides a secure and authenticated method for copying switch configurations or switch image files. The behavior of SCP is similar to that of remote copy (rcp), which comes from the Berkeley r-tools suite, except that SCP relies on SSH for security. SCP also requires that authentication, authorization, and accounting (AAA) authorization be configured so the switch can determine whether the user has the correct privilege level. To configure the Secure Copy feature, you should understand the SCP concepts.
How to Configure SSH
Setting Up the Switch to Run SSH
Follow these steps to set up your Switch to run SSH:
Configure user authentication for local or remote access. This step is required. For more information, see Related Topics below.
1.
enable
3.
hostname
hostname
4.
ip domain-name
domain_name
5.
crypto key generate rsa
8.
copy running-config
startup-config
DETAILED STEPS
Configuring the SSH Server
Follow these steps to configure the SSH server:
![]() Note | This procedure is only required if you are configuring the Switch as an SSH server. |
1.
enable
3.
ip ssh
version [1 |
2]
4.
ip ssh {timeout
seconds |
authentication-retries
number}
5.
Use one or both
of the following:
6.
end
8.
copy running-config
startup-config
DETAILED STEPS
Command or Action | Purpose | |
---|---|---|
Step 1 |
enable
Example:
Switch> enable
|
Enables privileged EXEC mode. Enter your password if prompted. |
Step 2 | configure
terminal
Example: Switch# configure terminal | |
Step 3 | ip ssh
version [1 |
2]
Example:
Switch(config)# ip ssh version 1
|
(Optional) Configures the Switch to run SSH Version 1 or SSH Version 2. If you do not enter this command or do not specify a keyword, the SSH server selects the latest SSH version supported by the SSH client. For example, if the SSH client supports SSHv1 and SSHv2, the SSH server selects SSHv2. |
Step 4 | ip ssh {timeout
seconds |
authentication-retries
number}
Example:
Switch(config)# ip ssh timeout 90 authentication-retries 2
|
Configures the SSH control parameters:
Repeat this step when configuring both parameters. |
Step 5 | Use one or both
of the following:
Example: Switch(config)# line vty 1 10
or Switch(config-line)# transport input ssh
|
(Optional) Configures the virtual terminal line settings. |
Step 6 | end
Example:
Switch(config-line)# end
|
Returns to privileged EXEC mode. |
Step 7 | show running-config
Example: Switch# show running-config | |
Step 8 | copy running-config
startup-config
Example:
Switch# copy running-config startup-config
|
(Optional) Saves your entries in the configuration file. |
Monitoring the SSH Configuration and Status
Command |
Purpose |
---|---|
show ip ssh |
Shows the version and configuration information for the SSH server. |
show ssh |
Shows the status of the SSH server. |
Additional References
Related Documents
Related Topic | Document Title |
---|---|
Configuring Identity Control policies and Identity Service templates for Session Aware networking. |
Session Aware Networking Configuration Guide, Cisco IOS XE Release 3SE (Catalyst 3850 Switches) |
Configuring RADIUS, TACACS+, Secure Shell, 802.1X and AAA. |
Securing User Services Configuration Guide Library, Cisco IOS XE Release 3SE (Catalyst 3850 Switches) |
Error Message Decoder
Description | Link |
---|---|
To help you research and resolve system error messages in this release, use the Error Message Decoder tool. |
https://www.cisco.com/cgi-bin/Support/Errordecoder/index.cgi |
Standards and RFCs
Standard/RFC | Title |
---|---|
MIBs
MIB | MIBs Link |
---|---|
All supported MIBs for this release. |
To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL: |
Technical Assistance
Description | Link |
---|---|
The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies. To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds. Access to most tools on the Cisco Support website requires a Cisco.com user ID and password. |
Feature Information for SSH
Release | Feature Information |
---|---|
Cisco IOS 15.0(2)EX1 | This feature was introduced. |