Explore Cisco
How to Buy

Have an account?

  •   Personalized content
  •   Your products and support

Need an account?

Create an account

ASR 5500 System Administration Guide, StarOS Release 21.5

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Book Contents
Find Matches in This Book
Available Languages
Download Options

Book Title

ASR 5500 System Administration Guide, StarOS Release 21.5

Chapter Title

Getting Started

Results

Updated:
November 30, 2017

Chapter: Getting Started

Getting Started

Configuring System Administrative Users

This section describes some of the security features that allow security administrators to control user accounts.

Limiting the Number of Concurrent CLI Sessions

Security administrators can limit the number of concurrent interactive CLI sessions. Limiting the number of concurrent interactive sessions reduces the consumption of system-wide resources. It also prevents a user from potentially accessing sensitive user in formation which is already in use.

Most privileged accounts do not require multiple concurrent logins.

Important:

Configuring the maximum number of sessions is recommended for all privileged accounts.

Security administrators can limit the number of concurrent interactive CLI sessions with three different ways depending on the authentication method which his used for that particular user account.

StarOS supports three login authentication methods:

  • TACACS+ Server users
  • Local-User users
  • AAA Context users

For additional information on configuring the maximum number of sessions for TACACS+ Server users, see Operation. For additional information on configuring the maximum number of sessions for Local-User users and AAA context users, see Configuring Context-Level Administrative Users.

Each authentication method must be configured separately because each of the three authentication methods can use the same user name.

Automatic Logout of CLI Sessions

Security administrators can configure an automatic logout of certain user accounts. Limiting the number of minutes that an interactive CLI session can be in use reduces the consumption of system-wide resources. It also prevents a user from potentially accessing a user account in a terminal window which is left idle. All authentication methods described in this section support both the idle session timeout technique and the absolute session timeout technique.

Most privileged accounts do not require an indefinite login timeout limit.

Important:

Configuring the session timeout is strongly recommended for all privileged accounts.

The idle timeout and session timeout fields in the show tacacs summary and show tacacs session id commands allow administrators to configure an automatic logout of certain accounts.

Session Timeout: allows a security administrator to specify the maximum amount of minutes that a user can be logged in to a session before the session is automatically disconnected.

Idle Timeout: allows a security administrator to specify the maximum amount of minutes that a session can remain in an idle state before the session is automatically disconnected.

Important:

The session timeout and idle timeout fields are not exclusive. If both are specified, then the idle timeout should always be lower than the session timeout since a lower session timeout will always be reached first.

For additional information on configuring the maximum number of minutes that an interactive CLI session can be in use, see the idle-sessions threshold command and the clear tacacs sessions CLI command in the CLI Reference and the show tacacs summary and show tacacs session id in the Statistics and Counter Reference.

Configuring SSH Options

SSHv2 RSA is the only version of SSH supported under StarOS. Keywords previously supported for SSHv1 RSA and SSHv2 DSA have been removed from or concealed within the StarOS CLI.

Important:

A keyword that was supported in a previous release may be concealed in subsequent releases. StarOS continues to parse concealed keywords in existing scripts and configuration files created in a previous release. But the concealed keyword no longer appears in the command syntax for use in new scripts or configuration files. Entering a question mark (?) will not display a concealed keyword as part of the Help text. Removed keywords generate an error message when parsed.

Version 1 of the SSH protocol is now obsolete due to security vulnerabilities. The v1-rsa keyword has been removed for the Context Configuration mode ssh command. Running a script or configuration that uses the SSHv1-RSA key returns an error message and generates an event log. The output of the error message is shown below: 

CLI print failure Failure: SSH V1 contains multiple structural vulnerabilities and is no longer considered secure. Therefore we don't support v1-rsa SSH key any longer, please generate a new v2-rsa key to replace this old one.

If the system boots from a configuration that contains the v1-rsa key, you can expect a boot failure when logging in through SSH. The workaround is to log in via the Console port, re-generate a new ssh v2-rsa key, and configure server sshd. It will then be possible to log in via ssh.

The v2-dsa keyword is now concealed for the Context Configuration mode ssh command

The v1-rsa keyword has been removed from the Exec mode show ssh key CLI command.

SSH Host Keys

SSH key-based authentication uses two keys, one "public" key that anyone is allowed to see, and another "private" key that only the owner is allowed to see. You create a key pair, securely store the private key on the device you want to log in from, and store the public key on the system () that you wish to log into.

SSH host keys are generated within a specified StarOS context. The context is associated with a user interface.

You set or remove an administrative user name having authorized keys for access to the sshd server associated with context.

Setting SSH Key Size

The Global Configuration mode ssh key-size CLI command configures the key size for SSH key generation for all contexts (RSA host key only).

    Step 1   Enter the Global Configuration mode. 
    [local]host_name# configure
[local]host_name(config)#
    Step 2   Specify the bit size for SSH keys. 
    [local]host_name(config)# ssh key-size { 2048 | 3072 | 4096 | 5120 | 6144 | 7168 | 9216 }
    The default bit size for SSH keys is 2048 bits.

    Configuring SSH Key Generation Wait Time

    SSH keys can only be generated after a configurable time interval has expired since the last key generation. The ssh key-gen wait-time command specifies this wait time in seconds. The default interval is 300 seconds (5 minutes).

      Step 1   Enter the context configuration mode. 
      [local]host_name(config)# context context_name
      [local]host_name(config-ctx)#
      Step 2   Specify the wait time interval. 
      [local]host_name(config-ctx)# ssh key-gen wait-time seconds
      [local]host_name(config-ctx)#

      Notes:

      • seconds is specified as an integer from 0 through 86400. Default = 300

      Specifying SSH Encryption Ciphers

      The SSH Configuration mode ciphers CLI command configures the cipher priority list in sshd for SSH symmetric encryption. It changes the cipher options for that context.

        Step 1   Enter the SSH Configuration mode. 
        [local]host_name(config-ctx)# server sshd
        Step 2   Specify the desired encryption algorithms. 
        [local]host_name(config-sshd)# ciphers algorithms
        Notes:
        • algorithms is a string of 1 through 511 alphanumeric characters that specifies the algorithm(s) to be used as a single string of comma-separated variables (no spaces) in priority order (left to right) from those shown below:
          • blowfish-cbc – symmetric-key block cipher, Cipher Block Chaining, (CBC)
          • 3des-cbc – Triple Data Encryption Standard, CBC
          • aes128-cbc – Advanced Encryption Standard (AES), 128-bit key size, CBC
          • aes128-ctr – AES, 128-bit key size, Counter-mode encryption (CTR)
          • aes192-ctr – AES, 192-bit key size, CTR
          • aes256-ctr – AES, 256-bit key size, CTR
          • aes128-gcm@openssh.com – AES, 128-bit key size, Galois Counter Mode [GCM], OpenSSH
          • aes256-gcm@openssh.com – AES, 256-bit key size, GCM, OpenSSH
          • chacha20-poly1305@openssh.com – ChaCha20 symmetric cipher, Poly1305 cryptographic Message Authentication Code [MAC], OpenSSH

        The default string for algorithms in a Normal build is: 

        blowfish-cbc,3des-cbc,aes128-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,
chacha20-poly1305@openssh.com

        The default string for algorithms in a Trusted build is: 

        aes256-ctr,aes192-ctr,aes128-ctr
        Step 3   Exit the SSH Configuration mode. 
        [local]host_name(config-sshd)# end
[local]host_name#

        Generating SSH Keys

        The ssh generate command generates a public/private key pair which is to be used by the SSH server. The v1-rsa keyword has been removed from and the v2-dsa keyword concealed within the ssh generate CLI command. The only keyword available for generating SSH keys is v2-rsa.

        Important:

        The generated key pair remains in use until the command is issued again.

          Step 1   Enter the context configuration mode: 
          [local]host_name(config)# context context_name
          [local]host_name(config-ctx)#
          Step 2   Generate an SSH key pair. 
          [local]host_name(config-ctx)# ssh generate key type v2-rsa
          [local]host_name(config-ctx)#

          Setting SSH Key Pair

          The ssh key command sets the public/private key pair to be used by the system. The v2-dsa keyword is concealed in the ssh key command.

          Specify the SSH key pair parameters. 
          [local]host_name(config-ctx)# ssh key data length octets type v2-rsa
          Notes:
          • data is the encrypted key expressed as an alphanumeric string of 1 through 1023 characters
          • length octets is the length of the encrypted key in octets expressed as an integer from 0 through 65535
          • type specifies the key type; v2-rsa is the only supported type.
          Important:

          For releases prior to 20.0, StarOS supports a maximum of 64 configurable authorized SSH keys. For release 20.0 and higher, StarOS supports a maximum of 200 configurable authorized SSH keys.


          Authorized SSH User Access

          You must authorize users to access a StarOS context from a specific host with an SSH authentication-key pair.

          Authorizing SSH User Access

          The SSH Configuration mode authorized-key command grants user access to a context from a specified host.

            Step 1   Go to the SSH Configuration mode. 
            [local]host_name(config-ctx)# server sshd
            [local]host_name(config-sshd)#
            Step 2   Specify administrative user access via the authorized-key command. 
            [local]host_name(config-sshd)# authorized-key username user_name host host_ip [ type { v2-dsa | v2-rsa } ]
            Notes:
            • username user_name specifies an existing StarOS administrator user name as having authorized keys for access to the sshd server. The user_name is expressed as an alphanumeric string of 1 through 255 characters. User names should have been previously created via the Context Configuration mode administrator command using the nopassword option to prevent bypassing of the sshd keys. Refer to the System Settings chapter for additional information on creating administrators.
            • host host_ip specifies the IP address of an SSH host having the authorization keys for this username. The IP address must be in IPv4 dotted-decimal or IPv6 colon-separated-hexadecimal notation.
            • type specifies the key type; v2-rsa is the only supported type.

            SSH User Login Restrictions

            An administrator can restrict SSH access to the StarOS CLI to a "white list" of allowed users. Access to a service may be restricted to only those users having a legitimate need. Only explicitly allowed users will be able connect to a host via SSH. The user name may optionally include a specific source IP address.

            The AllowUsers list consists of user name patterns, separated by space. If the pattern takes the form 'USER' then login is restricted for that user. If pattern is in the format 'USER@IP_ADDRESS' then USER and IP address are separately checked, restricting logins to those users from the specified IP address.

            The default is to allow unrestricted access by any user.

            Creating an Allowed Users List

            The allowusers add command allows an administrator to create a list of users who may log into the StarOS CLI.

              Step 1   Enter the context configuration mode. 
              [local]host_name(config)# context context_name
              [local]host_name(config-ctx)#
              Step 2   Go to the SSH Configuration mode. 
              [local]host_name(config-ctx)# server sshd
              Step 3   Configure the SSH user list. 
              [local]host_name(config-sshd)# allowusers add user_list

              user_list specifies a list of user name patterns, separated by spaces, as an alphanumeric string of 1 through 999 characters. If the pattern takes the form 'USER' then login is restricted for that user.

              If the pattern is in the format 'USER@IP_ADDRESS' then user name and IP address are separately checked, restricting logins to those users from that particular IP address.

              If the pattern is in the format 'USER@<context>@IP_ADDRESS' then user name, StarOS context and IP address are separately checked, restricting logins to those users associated with the specific context from that particular IP address.

              The following limits apply to the user_list:

              • The maximum length of this string is 3000 bytes including spaces.

              • The maximum number of AllowUsers, which is counted by spaces, is 256, which is consistent with the limit from OpenSSH.

              Important:

              If you exceed either of the above limits, an error message is displayed. The message prompts you to use a regular expression pattern to shorten the string, or remove all the allowusers with no allowusers add or default allowusers add and re-configure.

              For additional information, see the SSH Configuration Mode Commands chapter in the Command Line Interface Reference.

              Step 4   Exit the SSH Configuration mode. 
              [local]host_name(config-sshd)# end
              [local]host_name#

              SSH User Login Authentication

              StarOS authenticates SSH user login attempts via authorized-key/user-account pairings for the following scenarios:

              • User tries to login with local context username through local context (VPN) interface with authorized-key configured on local context.

              • User tries to login with non-local context username through non-local context interface with authorized-key configured on non-local context.

              • User tries to login with local context username through non-local context interface with authorized-key configured on local context.

              • User tries to login with non-local context username through local context interface with authorized-key configured on non-local context.

              A failure to authenticate based on the current system configuration prevents the login and generates an error message.

              StarOS does not permit users with different user IDs but having the same public SSH key to login to an unauthorized context. Authentication of the user takes into account the authorized-key/user-account pairing.

              Important:

              For StarOS release 21.0 onwards, a user cannot access the /flash directory if the user logs in from a non-local context.

              Secure Session Logout

              When StarOS is disconnected from an SSH client, the default behavior has sshd terminate the CLI or SFTP session in about 45 seconds (using default parameters). Two SSH Configuration mode CLI commands allow you to disable or modify this default sshd disconnect behavior.

              Important:

              For higher security, Cisco recommends at least a client-alive-countmax of 2 and client-alive-interval of 5. Smaller session logout values may lead to occasional ssh session logouts. Adjust values to balance security and user friendliness.

              The client-active-countmax command sets the number of client-alive messages which may be sent without sshd receiving any messages back from the SSH client (default =3). If this threshold is reached while the client-alive messages are being sent, sshd disconnects the SSH client thus terminating the session.

              The client-alive-interval command sets a timeout interval in seconds (default = 15) after which if no data has been received from the SSH client, sshd sends a message through the encrypted channel to request a response from the client. The number of times that the message is sent is determined by the client-alive-countmax parameter. The approximate amount of time before sshd disconnects an SSH client disconnect = client-alive-countmax X client-alive-interval.

              The client-alive mechanism is valuable when the client or server depend on knowing when a connection has become inactive.

              Important:

              The client-alive messages are sent through the encrypted channel and, therefore, are not spoofable.

              Important:

              These parameter apply to SSH protocol version 2 only.

              Changing Default sshd Secure Session Logout Parameters

              The following command sequence modifies the default settings for the ClientAliveCountmax (default = 3) and ClientAliveInterval (default = 15 seconds) parameters.
                Step 1   Enter the context configuration mode. 
                [local]host_name# configure
                Step 2   Go to the SSH Configuration mode. 
                [local]host_name(config)# context context_name
                Step 3   Set the ClientAliveCountmax parameter to 2. 
                [local]host_name(config-sshd)# client-alive-countmax 2
                Step 4   Set the ClientAliveInterval parameter to 5 seconds. 
                [local]host_name(config-sshd)# client-alive-interval 5
                Step 5   Exit the SSH Configuration mode. 
                [local]host_name(config-sshd)# end
[local]host_name#

                SSH Client Login to External Servers

                StarOS supports public key authentication for SSH/SFTP access from the StarOS gateway to external servers. You configure this feature by generating SSH client key pairs and pushing the client public key to external servers


                Note

                By default StarOS only supports username-password authentication to external servers.

                Setting SSH Client Ciphers

                The SSH Client Configuration mode ciphers CLI command configures the cipher priority list when logging into an external server.

                  Step 1   Enter the SSH Client Configuration mode. 
                  [local]host_name(config)# client ssh
                  Step 2   Specify the desired encryption algorithms. 
                  [local]host_name(config-ssh)# ciphers algorithms
                  Notes:
                  • algorithms is a string of 1 through 511 alphanumeric characters that specifies the algorithm(s) to be used as a single string of comma-separated variables (no spaces) in priority order (left to right) from those shown below:
                    • blowfish-cbc – symmetric-key block cipher, Cipher Block Chaining, (CBC)
                    • 3des-cbc – Triple Data Encryption Standard, CBC
                    • aes128-cbc – Advanced Encryption Standard (AES), 128-bit key size, CBC
                    • aes128-ctr – AES, 128-bit key size, Counter-mode encryption (CTR)
                    • aes192-ctr – AES, 192-bit key size, CTR
                    • aes256-ctr – AES, 256-bit key size, CTR
                    • aes128-gcm@openssh.com – AES, 128-bit key size, Galois Counter Mode [GCM], OpenSSH
                    • aes256-gcm@openssh.com – AES, 256-bit key size, GCM, OpenSSH
                    • chacha20-poly1305@openssh.com – ChaCha20 symmetric cipher, Poly1305 cryptographic Message Authentication Code [MAC], OpenSSH

                  The default string for algorithms in a Normal build is: 

                  aes256-ctr,aes192-ctr,aes128-ctr,aes256-gcm@openssh.com,aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,
blowfish-cbc,3des-cbc,aes128-cbc

                  The default string for algorithms in a Trusted build is: 

                  aes256-ctr,aes192-ctr,aes128-ctr
                  Step 3   Exit the SSH Client Configuration mode. 
                  [local]host_name(config-ssh)# end
[local]host_name#

                  Setting Preferred Authentication Methods

                  The SSH Client Configuration mode preferredauthentications CLI command configures the preferred methods of authentication.

                    Step 1   Enter the SSH Client Configuration mode. 
                    [local]host_name(config)# client ssh
                    Step 2   Specify the preferred authentication methods. 
                    [local]host_name(config-ssh)# preferredauthentications methods
                    Notes:
                    • methods – specifies the preferred methods of authentication to be used as a single string of comma-separated variables (no spaces) in priority order (left to right) from those shown below:

                      • publickey – authentication via SSH v2-RSA protocol.

                      • keyboard-interactive – request for an arbitrary number of pieces of information. For each piece of information the server sends the label of the prompt.

                      • password – simple request for a single password

                    • default – resets the value of methods to: publickey,password

                    Step 3   Exit the SSH Client Configuration mode. 
                    [local]host_name(config-ssh)# exit
[local]host_name(config)#

                    Generating SSH Client Key Pair

                    You use commands in the SSH Client Configuration mode to specify a private key and generate the SSH client key pair.

                      Step 1   Enter the SSH client configuration mode. 
                      [local]host_name(config)# client ssh
                      [local]host_name(config-ssh)#
                      Step 2   Enter SSH private key information and key type. 
                      [local]host_name(config-ssh)# ssh key private_key_string length key_length [ type v2-rsa ]
                      [local]host_name(config-ssh)#

                      key private_key_string specifies a private key value as an alphanumeric string of 1 through 4499 characters.

                      length key_length specifies the length of the key in bytes as an integer from 0 through 65535.

                      type v2-rsa specifies the SSH client key type. The only supported SSH client key type is v2-rsa.

                      Step 3   Generate SSH client key pair. 
                      [local]host_name(config-ssh)# ssh generate key [ type v2-rsa ]
                      [local]host_name(config-ssh)#

                      type v2-rsa specifies the SSH client key type. The only supported SSH client key type is v2-rsa.

                      Step 4   Verify that the SSH client key has been generated. 
                      [local]host_name(config-ssh)# do show ssh client key
                      Step 5   Exit the SSH Client Configuration mode. 
                      [local]host_name(config-ssh)# exit
                      [local]host_name(config)#

                      Pushing an SSH Client Public Key to an External Server

                      You must push the SSH client public key to an external server to support SSH/SFTP access to that server.

                        Step 1   From the Exec mode run the push ssh-key command. 
                        [local]host_name# push ssh-key { host_name | host_ip_address } user username [ context context_name ]
                        [local]host_name#

                        host_name specifies the remote server using its logical host name which must be resolved via DNS lookup. It is expressed as an alphanumeric string of 1 to 127 characters.

                        host_ip_address is expressed in IPv4 dotted-decimal or IPv6 colon-separated-hexadecimal notation.

                        user username specifies a valid username on the external server as an alphanumeric string of 1 to 79 characters.

                        context context_name specifies a valid context name. The context name is optional. If it is not provided the current context is used for processing.

                        Step 2   Repeat Step 1 to support SSH/SFTP access on other external servers.
                        Step 3   Test SSH client login to an external server. 
                        local]host_name# ssh { hostname | ip_address } user username port port_number

                        Enabling NETCONF

                        An SSH key is a requirement before NETCONF protocol and the ConfD engine can be enabled in support of Cisco Network Service Orchestrator (NSO).

                        Refer to the NETCONF and ConfD appendix in this guide for detailed information on how to enable NETCONF.

                        Was this Document Helpful?

                        FeedbackFeedback

                        Contact Cisco