SSH Terminal-Line Access

Cisco IOS supports reverse Telnet, which allows users to Telnet through the router--via a certain port range--to connect them to tty (asynchronous) lines. Reverse Telnet has allowed users to connect to the console ports of remote devices that do not natively support Telnet. However, this method has provided very little security because all Telnet traffic goes over the network in the clear. The SSH Terminal-Line Access feature replaces reverse Telnet with SSH. This feature may be configured to use encryption to access devices on the tty lines, which provide users with connections that support strong privacy and session integrity.

SSH is an application and a protocol that provides secure replacement for the suite of Berkeley r-tools such as rsh, rlogin, and rcp. (Cisco IOS supports rlogin.) The protocol secures the sessions using standard cryptographic mechanisms, and the application can be used similarly to the Berkeley rexec and rsh tools. Currently two versions of SSH are available: SSH Version 1 and SSH Version 2. Only SSH Version 1 is implemented in the Cisco IOS software.

The SSH Terminal-Line Access feature enables users to configure their router with secure access and perform the following tasks:

• Connect to a router that has multiple terminal lines connected to consoles or serial ports of other routers, switches, or devices.
• Simplify connectivity to a router from anywhere by securely connecting to the terminal server on a specific line.
• Allow modems attached to routers to be used for dial-out securely.
• Require authentication of each of the lines through a locally defined username and password, TACACS+, or RADIUS.

Note

The session slot command that is used to start a session with a module requires Telnet to be accepted on the virtual tty (vty) lines. When you restrict vty lines only to SSH, you cannot use the command to communicate with the modules. This applies to any Cisco IOS device where the user can telnet to a module on the device.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    line line-number [ending-line-number]

4.    no exec

5.    login {local | authentication listname}

6.    rotary group

7.    transport input {all | ssh}

8.    exit

9.    ip ssh port portnum rotary group

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	line line-number [ending-line-number] Example: Router(config)# line 1 200	Identifies a line for configuration and enters line configuration mode. Note    For router console configurations, each line must be defined in its own rotary, and SSH must be configured to listen in on each rotary. Note    An authentication method requiring a username and password must be configured for each line. This may be done through the use of a local username and password stored on the router, through the use of TACACS+, or through the use of RADIUS. Neither Line passwords nor the enable password are sufficient to be used with SSH.
Step 4	no exec Example: Router(config-line)# no exec	Disables exec processing on each of the lines.
Step 5	login {local | authentication listname} Example: Router(config-line)# login authentication default	Defines a login authentication mechanism for the lines. Note    The authentication method must utilize a username and password.
Step 6	rotary group Example: Router(config-line)# rotary 1	Defines a group of lines consisting of one or more lines. Note    All rotaries used must be defined, and each defined rotary must be used when SSH is enabled.
Step 7	transport input {all | ssh} Example: Router(config-line)# transport input ssh	Defines which protocols to use to connect to a specific line of the router.
Step 8	exit Example: Router(config-line)# exit	Exits line configuration mode.
Step 9	ip ssh port portnum rotary group Example: Router(config)# ip ssh port 2000 rotary 1	Enables secure network access to the tty lines. Use this command to connect the portnum argument with the rotary groupargument, which is associated with a line or group of lines. Note    The group argument must correspond with the rotary group number chosen in Step 6.

To verify that this functionality is working, you can connect to a router using an SSH client.