WISEKUMASearching knowledge on IT and languages

Cisco SSH configuration   Filed Under: Networks

Authentication

To configure SSH on the switch we will need to configure first AAA (Authentication, Authorization and Accounting) in the switch using the following commands.

To configure AAA and a user in the local database

aaa new-model
username randomuser password randompasswd

The aaa new-model command will modify the default settings for authentication and will force the usage of the local database for authenticating the user in case of no other AAA statements. (I will concentrate at this moment in just configuration of authentication using the local database but may be in the future I will extend the tutorial to include authentication using a RADIUS or TACACS+ server plus the local database).

At this point it will be a good idea to test that the authentication works before we move to the configuration of SSH.

SSH configuration

Before we generate the crypto key for the switch we will need to specify the domain name of the switch just in case we don’t have in place.

ip domain-name wisekuma.net

To generate the crypto key to use with SSH

(config-t)#crypto key generate rsa

The name for the keys will be: switch.wisekuma.net
Choose the size of the key modulus in the range of 360 to 2048 for your
  General Purpose Keys. Choosing a key modulus greater than 512 may take
  a few minutes.

How many bits in the modulus [512]: 1024

Or you can use also the command

crypto key generate rsa modulus 1024

With the crypto key generated we can configure some of the specific settings for SSH

To allow only version 2 of ssh

ip ssh version 2

To specify the time out once a session is finished in case of inactivity

ip ssh time-out 60

The number of retries to login to the switch.

ip ssh authentication-retries 3

The last thing to do having configured SSH in the switch is to just allow only SSH connections to the switch (no need of access through telnet while having SSH).

line vty 0 15
   transport input ssh

Tags: cisco, configuration, ssh