Cisco Equipment Configuration SSH login

Cisco's products currently only support SSH-1, does not support SSH-2, IOS support SSH features Version includes K3 or K4(K3 is a 56bit SSH encryption 、 K4 is a 168bit SSH encryption), Now is the K8 K9

 

1、 Configuration “hotstneme” and “ip domain-name”

Router#configure terminal  Router(config)#hostname test test(config)#ip domain-name toerd18f    -------Configuration SSH Necessary

 

2、 Configuration“userneme” and “password”

test(config)#username test password 0 test Note:add a user ： test ， password ： test test(config)#line vty 0 4 test(config-line)#login local   test(config-line)#transport input ssh       ----- Only allowed to log on using SSH Note ： Prohibition telnet and Switching engine session!

 

3、 Configuration SSH Server

test(config)#crypto key generate rsa The name for the keys will be: TEST-GSR12008.jx.cn.net Note ： SSH the keyword is hostname + . +ip domain-name Choose the size of the key modulus in the range of 360 to 2048 for your General Purpose Keys. Choosing a key modulus greater than 512 may take a few minuts How many bits in the modulus [512]: Note: Select the encryption digits, default Generating RSA keys ... [OK]

Usr command “show ip ssh”

SSH Enabled - version 1.99 Authentication timeout: 120 secs; Authentication retries:3

Now SSH service is started, if you need to stop SSH service, use the following command

test(config)#crypto key zeroize rsa

 

4、 Configuration SSH parameter

Usr “show run”command see the SSH default parameters ： timeout is limited 120seconds ， Authentication the number of retries to 3 times ， use following command can be modified ： test(config)#ip ssh {[time-out seconds]} │ [authentication-retries interger]}   ensample timeout limited 180seconds ： //ensample ： test(config)# ip ssh time-out 180   Ensample the number of retries to 5 times ： //ensample ： test(config)# ip ssh authentication-retries

 

NOTE:

1、 Use SSH login must use SSH1

2、 Do not use any compression format

 

Enable aaa the SSH configuration

test(config) # ip domain-name runway.cn.net    设置域名 test(config) # aaa new-modle   启用 AAA 服务 test(config) # crypto key generate rsa   生成秘钥 The name for the keys will be: Router1.runway.cn.net Choose the size of the key modulus in the range of 360 to 2048 for your General Purpose Keys. Choosing a key modulus greater than 512 may take a few minutes. How many bits in the modulus [512]: 1024  指定 1024 位秘钥 % Generating 1024 bit RSA keys ...[OK] test(config) # username sshuser secret sshpassword   指定 SSH 登陆用户名和密码 test(config) # ip ssh time-out 30   设定 SSH 超时值 test(config) # no ip ssh version   启用 SSH V1 V2 test(config) # aaa authentication login ssh local line none   设定 SSH 登陆信息存储地方 test(config) # ip access-list standard forssh   定义 SSH 登陆源地址 permit any   test(config) # line vty 0 4 test(config-line)#exec-timeout 30  设置线路登陆超时值 test(config-line) # login authentication ssh   指定验证登陆用户信息存储的地方 test(config-line) # transport input ssh   设置线路登陆模式为 SSH test(config) # access-class forssh in   应用访问列表

 

Is not enable aaa the SSH configuration

test(config) # hostname Router1 test(config) # ip domain-name runway.cn.net test(config) # crypto key generate rsa The name for the keys will be: Router1.runway.cn.net Choose the size of the key modulus in the range of 360 to 2048 for your General Purpose Keys. Choosing a key modulus greater than 512 may take a few minutes. How many bits in the modulus [512]: 1024 % Generating 1024 bit RSA keys ...[OK] test(config) # username sshuser secret sshpassword test(config) # ip ssh time-out 30 test(config) # no ip ssh version test(config) # ip access-list standard forssh test(config) # permit any   test(config) # line vty 0 4 test(config-line) # exec-timeout 30 test(config-line) # login local test(config-line) # transport input ssh test(config) # access-class forssh in