Cisco configure SSH - Revision history

Pio2pio: /* Configure ssh server to perform RSA-Based user authentication */

2015-01-02T20:35:10Z

Configure ssh server to perform RSA-Based user authentication

← Older revision		Revision as of 22:35, 2 January 2015
Line 59:		Line 59:
	R2#conf t		R2#conf t
	Enter configuration commands, one per line. End with CNTL/Z.		Enter configuration commands, one per line. End with CNTL/Z.
	R2(config)#ip ssh pubkey-chain		R2(config)#'''ip ssh pubkey-chain'''
	R2(conf-ssh-pubkey)#username admin		R2(conf-ssh-pubkey)#'''username admin'''
	R2(conf-ssh-pubkey-user)#key-string		R2(conf-ssh-pubkey-user)#'''key-string'''
	R2(conf-ssh-pubkey-data)#$AAQEA6jYlf9MBskhkWov+ZOUDKun0ExQIRj1zfWA/YciO02VS		R2(conf-ssh-pubkey-data)#$AAQEA6jYlf9MBskhkWov+ZOUDKun0ExQIRj1zfWA/YciO02VS
	R2(conf-ssh-pubkey-data)#$Xsx123456789012345678901234567uS6A8/mF0A3P/ScRjct		R2(conf-ssh-pubkey-data)#$Xsx123456789012345678901234567uS6A8/mF0A3P/ScRjct
Line 67:		Line 67:
	R2(conf-ssh-pubkey-data)#$bCnZLmv908AeDb1Ac4nPdsn1OhCPIg6fxZjB7DvAMB8Dbr+7Y		R2(conf-ssh-pubkey-data)#$bCnZLmv908AeDb1Ac4nPdsn1OhCPIg6fxZjB7DvAMB8Dbr+7Y
	R2(conf-ssh-pubkey-data)#$apEbGE94luIqnBc61HsMd6JCWbQ== key@comment.us		R2(conf-ssh-pubkey-data)#$apEbGE94luIqnBc61HsMd6JCWbQ== key@comment.us
	R2(conf-ssh-pubkey-data)#exit		R2(conf-ssh-pubkey-data)#'''exit'''
	R2(conf-ssh-pubkey-user)#exit		R2(conf-ssh-pubkey-user)#'''exit'''

	;Copy & paste version		;Copy & paste version

Pio2pio: /* Configure ssh server using aaa new-model */

2015-01-02T20:29:18Z

Configure ssh server using aaa new-model

← Older revision		Revision as of 22:29, 2 January 2015
Line 38:		Line 38:

	;Verify		;Verify
	show ip ssh		# '''show ip ssh''' !version and configuration data
	SSH Enabled - version 2.0		SSH Enabled - version 2.0
	Authentication timeout: 120 secs; Authentication retries: 2		Authentication timeout: 120 secs; Authentication retries: 2
Line 46:		Line 46:
	SRTM94dJkXScrSXoT4dlqBHY+r7H+g25y5Rq7Dqv8AewNR0DKrGaYkIlO3A0O4s6wyK4KM71tdKia+Rc		SRTM94dJkXScrSXoT4dlqBHY+r7H+g25y5Rq7Dqv8AewNR0DKrGaYkIlO3A0O4s6wyK4KM71tdKia+Rc
	darPOEZKcJiFotegARWiWKS87UX0qD5XFYqGPNQZZWhIefp+aw==		darPOEZKcJiFotegARWiWKS87UX0qD5XFYqGPNQZZWhIefp+aw==

			# '''show ssh''' !shows current ssh connections
			Connection Version Mode Encryption Hmac State Username
			0 2.0 IN aes256-cbc hmac-sha1 Session started admin
			0 2.0 OUT aes256-cbc hmac-sha1 Session started admin
			%No SSHv1 server connections running.

	= Configure ssh server to perform RSA-Based user authentication =		= Configure ssh server to perform RSA-Based user authentication =

Pio2pio: /* Configure ssh server to perform RSA-Based user authentication */

2014-06-08T19:08:01Z

Configure ssh server to perform RSA-Based user authentication

← Older revision		Revision as of 21:08, 8 June 2014
Line 57:		Line 57:
	R2(conf-ssh-pubkey-user)#key-string		R2(conf-ssh-pubkey-user)#key-string
	R2(conf-ssh-pubkey-data)#$AAQEA6jYlf9MBskhkWov+ZOUDKun0ExQIRj1zfWA/YciO02VS		R2(conf-ssh-pubkey-data)#$AAQEA6jYlf9MBskhkWov+ZOUDKun0ExQIRj1zfWA/YciO02VS
	R2(conf-ssh-pubkey-data)#$~~XsxM7SqNkRSQOR7y7HBMoxTHV7o+R/uS6A8~~/mF0A3P/ScRjct		R2(conf-ssh-pubkey-data)#$Xsx123456789012345678901234567uS6A8/mF0A3P/ScRjct
	R2(conf-ssh-pubkey-data)#$~~JrNGACGaFy1njD9PrrvrU4o4hx6XDr6xVXF4sP4OCSXIn~~+Cp8		R2(conf-ssh-pubkey-data)#$JrN1234567890123456789012345676xVXF4sP4OCSXIn+Cp8
	R2(conf-ssh-pubkey-data)#$bCnZLmv908AeDb1Ac4nPdsn1OhCPIg6fxZjB7DvAMB8Dbr+7Y		R2(conf-ssh-pubkey-data)#$bCnZLmv908AeDb1Ac4nPdsn1OhCPIg6fxZjB7DvAMB8Dbr+7Y
	R2(conf-ssh-pubkey-data)#$apEbGE94luIqnBc61HsMd6JCWbQ== key@comment.us		R2(conf-ssh-pubkey-data)#$apEbGE94luIqnBc61HsMd6JCWbQ== key@comment.us
Line 69:		Line 69:
	username $username		username $username
	key-string		key-string
	%Censored - ~~Pablic~~ lines from putty gen %		%Censored - Public lines from putty gen %
	%Censored - ~~Pablic~~ lines from putty gen %		%Censored - Public lines from putty gen %
	%Censored - ~~Pablic~~ lines from putty gen %		%Censored - Public lines from putty gen %
	%Censored - ~~Pablic~~ lines from putty gen %		%Censored - Public lines from putty gen %
	%Censored - ~~Pablic~~ lines from putty gen %		%Censored - Public lines from putty gen %
	%Censored - ~~Pablic~~ lines from putty gen ==%		%Censored - Public lines from putty gen ==%
	exit		exit
	exit		exit
Line 86:		Line 86:
	ip ssh pubkey-chain		ip ssh pubkey-chain
	username admin		username admin
	key-hash ssh-rsa ~~C20B739F2645D6850C591C6A11780CB5~~ key@comment.us		key-hash ssh-rsa C20B739F2641234567891C6A11000111 key@comment.us

	;Remove user's public key		;Remove user's public key

Pio2pio: /* Configure ssh server to perform RSA-Based user authentication */

2014-04-11T07:53:58Z

Configure ssh server to perform RSA-Based user authentication

@@ Line 63: / Line 63: @@
   R2(conf-ssh-pubkey-data)#exit
   R2(conf-ssh-pubkey-user)#exit
 ;Verify

Pio2pio: /* References */

2014-02-27T21:16:20Z

References

← Older revision		Revision as of 23:16, 27 February 2014
Line 109:		Line 109:
	*[http://www.cisco.com/en/US/docs/ios-xml/ios/net_mgmt/config_library/15-mt/netmgmt-15-mt-library.html Network Management Configuration Guide Library, Cisco IOS Release 15M&T] Last Updated: November 29, 2012		*[http://www.cisco.com/en/US/docs/ios-xml/ios/net_mgmt/config_library/15-mt/netmgmt-15-mt-library.html Network Management Configuration Guide Library, Cisco IOS Release 15M&T] Last Updated: November 29, 2012
	*[http://www.cisco.com/en/US/docs/ios-xml/ios/sec_usr_ssh/configuration/15-mt/sec-ssh-config-auth.html#reference_9181864E7E0C4FB2B6123473D0A6EAF3 Secure Shell—Configuring User Authentication Methods] Feature is supported on IOS 15.3(3)M		*[http://www.cisco.com/en/US/docs/ios-xml/ios/sec_usr_ssh/configuration/15-mt/sec-ssh-config-auth.html#reference_9181864E7E0C4FB2B6123473D0A6EAF3 Secure Shell—Configuring User Authentication Methods] Feature is supported on IOS 15.3(3)M
			*[http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_ssh/configuration/xe-3s/sec-usr-ssh-xe-3s-book/sec-ssh-config-auth.html#reference_D19E50574B0F4E0FA72704C873343C45 Example: Disabling User Authentication Methods] Cisco Systems, Inc. Secure Shell Configuration Guide Cisco IOS XE Release 3S

Pio2pio: /* Configure ssh server using aaa new-model */

2013-11-17T22:25:09Z

Configure ssh server using aaa new-model

← Older revision		Revision as of 00:25, 18 November 2013
Line 27:		Line 27:
	<span style="color: green">crypto key generate rsa label ''key-pair-label'' general-keys modulus 1024</span>		<span style="color: green">crypto key generate rsa label ''key-pair-label'' general-keys modulus 1024</span>
	<span style="color: blue">!--- choose which key use for server authentication</span>		<span style="color: blue">!--- choose which key use for server authentication</span>
	ip ssh rsa keypair-name ''key-pair-label''</span>		<span style="color: green">ip ssh rsa keypair-name ''key-pair-label''</span>
	ip ssh time-out 60		ip ssh time-out 60
	ip ssh authentication-retries 2		ip ssh authentication-retries 2

Pio2pio: /* Configure ssh server using aaa new-model */

2013-11-17T22:24:33Z

Configure ssh server using aaa new-model

← Older revision		Revision as of 00:24, 18 November 2013
Line 6:		Line 6:
	*<span style="color: black">black - basic configuration</span>		*<span style="color: black">black - basic configuration</span>
	*<span style="color: green">green - enhanced config</span>		*<span style="color: green">green - enhanced config</span>
			*<span style="color: blue">blue - comments</span>

	<span style="color: blue">!--- The aaa new-model command causes the local username and password on the router		<span style="color: blue">!--- The aaa new-model command causes the local username and password on the router
Line 13:		Line 14:
	<span style="color: blue">!--- Instead of aaa new-model, you can use the login local command.</span>		<span style="color: blue">!--- Instead of aaa new-model, you can use the login local command.</span>

	<span style="color: blue">!--- assign domain name to the router/switch, this will be used to sign ~~off~~ SSH key</span>		<span style="color: blue">!--- assign domain name to the router/switch, this will be used to sign SSH key, also called 'keypair-name' or 'label'</span>
	ip domain-name rtp.cisco.com		ip domain-name rtp.cisco.com
	ip ssh version 2		ip ssh version 2
Line 21:		Line 22:
	<span style="color: green">source-interface Loopback0</span>		<span style="color: green">source-interface Loopback0</span>

	<span style="color: blue">!--- Generate an ~~SSH~~ key to be used ~~with SSH here 1024bit long~~</span>		<span style="color: blue">!--- Generate an server authentication key - 1024 bit long, domain name will be used as key-pair-label</span>
	crypto key generate rsa modulus 1024		crypto key generate rsa modulus 1024
			<span style="color: blue">!--- Generate ssh key, giving label to distinguishes different key-pairs</span>
			<span style="color: green">crypto key generate rsa label ''key-pair-label'' general-keys modulus 1024</span>
			<span style="color: blue">!--- choose which key use for server authentication</span>
			ip ssh rsa keypair-name ''key-pair-label''</span>
	ip ssh time-out 60		ip ssh time-out 60
	ip ssh authentication-retries 2		ip ssh authentication-retries 2

Pio2pio: /* Configure ssh server using aaa new-model */

2013-11-17T21:13:37Z

Configure ssh server using aaa new-model

← Older revision		Revision as of 23:13, 17 November 2013
Line 4:		Line 4:
	= Configure ssh server using aaa new-model =		= Configure ssh server using aaa new-model =
	Color code explained:		Color code explained:
	*<span style="color: black">basic configuration</span>		*<span style="color: black">black - basic configuration</span>
	*<span style="color: green">enhanced config</span>		*<span style="color: green">green - enhanced config</span>

	<span style="color: blue">!--- The aaa new-model command causes the local username and password on the router		<span style="color: blue">!--- The aaa new-model command causes the local username and password on the router

Pio2pio: /* Configure ssh server using aaa new-model */

2013-11-17T21:13:13Z

Configure ssh server using aaa new-model

← Older revision		Revision as of 23:13, 17 November 2013
Line 3:		Line 3:

	= Configure ssh server using aaa new-model =		= Configure ssh server using aaa new-model =
			Color code explained:
	<span style="color: black">basic configuration</span>		*<span style="color: black">basic configuration</span>
	<span style="color: green">enhanced config</span>		*<span style="color: green">enhanced config</span>

	<span style="color: blue">!--- The aaa new-model command causes the local username and password on the router		<span style="color: blue">!--- The aaa new-model command causes the local username and password on the router

Pio2pio: /* Configure Cisco IOS ssh server to perform RSA-Based user authentication */

2013-11-17T21:07:30Z

Configure Cisco IOS ssh server to perform RSA-Based user authentication

← Older revision		Revision as of 23:07, 17 November 2013
Line 42:		Line 42:
	darPOEZKcJiFotegARWiWKS87UX0qD5XFYqGPNQZZWhIefp+aw==		darPOEZKcJiFotegARWiWKS87UX0qD5XFYqGPNQZZWhIefp+aw==

	= Configure ~~Cisco IOS~~ ssh server to perform RSA-Based user authentication =		= Configure ssh server to perform RSA-Based user authentication =
	This feature is only supported in IOS 15.0(1)M and later versions.		This feature is only supported in IOS 15.0(1)M and later versions.
	;Add public-key for user authentication		;Add public-key for user authentication