Configure network devices for remote access using SSH

Why SSH and not Telnet

You will not walk to the wiring closet with a console cable every time a switch needs a change. Remote access to the command line is essential, and there are two protocols for it. Telnet (TCP port 23) sends everything, including your username and password, as clear text; anyone capturing packets on the path reads it. Secure Shell (SSH) (TCP port 22) encrypts the whole session and authenticates the server with a cryptographic key, so an attacker cannot read your password or impersonate the router. Telnet should be disabled everywhere; SSH version 2 is the standard.

The ingredients

SSH on IOS needs an RSA key pair to encrypt the session. IOS names the key pair after the device’s hostname and domain name, so both must be set before generating the key. Then you need a user account to log in as, and the vty lines (the virtual terminals that remote sessions land on) must be told to use local usernames and accept only SSH.

Full configuration

Router(config)# hostname SW1
! 1. Domain name (required for RSA key generation)
SW1(config)# ip domain-name example.com
! 2. Generate the RSA key pair; 2048 bits is the modern minimum
SW1(config)# crypto key generate rsa modulus 2048
The name for the keys will be: SW1.example.com
% The key modulus size is 2048 bits
% Generating 2048 bit RSA keys, keys will be non-exportable...
[OK] (elapsed time was 2 seconds)
! 3. Require SSH version 2 only
SW1(config)# ip ssh version 2
! 4. Local user with a hashed password
SW1(config)# username admin privilege 15 secret Str0ngPass!
! 5. Optional: an ACL limiting which hosts may connect
SW1(config)# access-list 5 permit 192.168.1.0 0.0.0.255
! 6. Configure all 16 vty lines
SW1(config)# line vty 0 15
SW1(config-line)# login local
SW1(config-line)# transport input ssh
SW1(config-line)# access-class 5 in
SW1(config-line)# exec-timeout 10 0
SW1(config-line)# exit
! On a Layer 2 switch, it also needs a management IP and gateway
SW1(config)# interface Vlan1
SW1(config-if)# ip address 192.168.1.2 255.255.255.0
SW1(config-if)# no shutdown
SW1(config-if)# exit
SW1(config)# ip default-gateway 192.168.1.1

What each step does:

• hostname and ip domain-name: without both, crypto key generate rsa refuses with an error about the domain name. The key is named hostname.domain.
• crypto key generate rsa modulus 2048: creates the key pair. If you omit modulus, IOS prompts for the size; the default on older IOS was 512, which is too weak for SSHv2 (SSHv2 requires at least 768 bits; 2048 is recommended). Generating the key automatically enables the SSH server.
• ip ssh version 2: SSH version 1 has known weaknesses. This command forces version 2 only. (show ip ssh reports version “1.99” when both are allowed.)
• username admin secret ...: stores a hashed password. Use secret, not password, so the running-config does not contain a reversible string. privilege 15 drops the user straight into privileged mode.
• line vty 0 15: routers and switches typically have 16 vty lines (0 to 15), so up to 16 simultaneous remote sessions. Older devices had only 0 to 4; check with line vty ?. Configure all of them or attackers may find a line you missed.
• login local: authenticate against the local username database. Plain login would use the line password instead and ignore the username you created; if no line password is set, every connection is refused with Password required, but none set.
• transport input ssh: accept only SSH on these lines; Telnet connections are refused. transport input all or transport input telnet ssh would allow both; transport input none blocks everything.
• access-class 5 in: applies a standard ACL to the vty lines so only the listed source addresses can even attempt to connect. This is the standard way to restrict management access. (access-class, not access-group; the latter is for interfaces.)
• exec-timeout 10 0: log the session out after 10 minutes 0 seconds of inactivity.

Optional hardening: ip ssh time-out 60 (seconds allowed to complete login), ip ssh authentication-retries 3, and service password-encryption for any remaining plain-text passwords.

Verifying SSH

SW1# show ip ssh
SSH Enabled - version 2.0
Authentication methods:publickey,keyboard-interactive,password
Authentication Publickey Algorithms:x509v3-ssh-rsa,ssh-rsa
Hostkey Algorithms:x509v3-ssh-rsa,ssh-rsa
Encryption Algorithms:aes128-ctr,aes192-ctr,aes256-ctr
MAC Algorithms:hmac-sha2-256,hmac-sha2-512,hmac-sha1
KEX Algorithms:diffie-hellman-group14-sha1
Authentication timeout: 120 secs; Authentication retries: 3
Minimum expected Diffie Hellman key size : 2048 bits
IOS Keys in SECSH format(ssh-rsa, base64 encoded): SW1.example.com

SSH Enabled - version 2.0 confirms the server is up and locked to v2. If it says SSH Disabled, no RSA key exists. show ssh lists active SSH sessions (user, version, encryption). show crypto key mypubkey rsa displays the generated key. show users or show line shows which vty lines are in use.

Connecting from another IOS device

Cisco devices include an SSH client, handy for hopping from one device to the next:

R1# ssh -l admin 192.168.1.2
Password:
SW1>

-l (lowercase L) specifies the login username. Other options: -v 2 forces version 2, -p 2222 uses a non-default port. From a PC, the equivalent is ssh admin@192.168.1.2 in PuTTY, Windows Terminal, or a Linux shell.