Cisco ssh username password

Cisco ssh username password

Устанавливаем дату и время (нужны для генерации ключа);

cisco# clock set 17:57:20 03 Nov 2022

Входим в режим конфигурирования;

cisco# conf t

Указываем домен и имя устройства (для генерации ключа);

cisco(config)# ip domain name domain.local
cisco(config)# hostname cisco-ssh

Генерируем ключ для SSH;

cisco-ssh(config)# crypto key generate rsa

Храним пароли в зашифрованном виде;

cisco-ssh(config)# service password-encryption

Создаем пользователя admin с паролем Pa$$w0rd и максимальными привилегиями;

cisco-ssh(config)# username admin privilege 15 secret Pa$$w0rd

Задаем пароль для привилегированного режима;

cisco-ssh(config)# enable secret Pa$$w0rd

Активируем протокол ААА;

cisco-ssh(config)# aaa new-model

Разрешаем компьютерам внутренней сети заходить на Cisco по SSH;

cisco-ssh(config)# access-list 23 permit 192.168.0.0 0.0.0.255

Входим в режим конфигурирования терминальный линий;

cisco-ssh(config)# line vty 0 4

Запрещаем все, кроме SSH;

cisco-ssh(config-line)# transport input ssh

Активируем автоматическое поднятие строки после ответа системы на проделанные изменения;

cisco-ssh(config-line)# logging synchronous

Позволяем входить сразу в привилигированный режим;

cisco-ssh(config-line)# privilege level 15

Настраиваем автоматическое закрытие SSH сессии через 60 минут;

cisco-ssh(config-line)# exec-timeout 60 0

Привязываем группу доступа, созданную на шаге 10, к терминальной линии;

cisco-ssh(config-line)# access-class 23 in

Выходим из настроек и сохраняем конфигурацию.

Источник

Secure Shell Configuration Guide, Cisco IOS Release 15S

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Book Title

Secure Shell Configuration Guide, Cisco IOS Release 15S

Configuring Secure Shell

View with Adobe Reader on a variety of devices

View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone

Results

Chapter: Configuring Secure Shell

Configuring Secure Shell

The Secure Shell (SSH) feature is an application and a protocol that provides a secure replacement to the Berkeley r-tools. The protocol secures sessions using standard cryptographic mechanisms, and the application can be used similarly to the Berkeley rexec and rsh tools. Two versions of SSH are available: SSH Version 1 and SSH Version 2. Unless otherwise noted, the term “SSH” denotes “SSH Version 1” only. For information about SSH Version 2, see the “ Secure Shell Version 2 Support” feature module.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Читайте также:  1с не сохраняются настройки принтера этикеток

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

Prerequisites for Configuring SSH


Note

Unless otherwise noted, the term “SSH” denotes “SSH Version 1” only.

Download the required image on the device. The Secure Shell (SSH) server requires an IPsec (Data Encryption Standard [DES] or 3DES) encryption software image; the SSH client requires an IPsec (DES or 3DES) encryption software image.) For information about downloading a software image, see the Loading and Managing System Images Configuration Guide.

Configure a hostname and host domain for your device by using the hostname and ip domain-name commands in global configuration mode.

Generate a Rivest, Shamir, and Adleman (RSA) key pair for your device. This key pair automatically enables SSH and remote authentication when the crypto key generate rsa command is entered in global configuration mode.


Note

To delete the RSA key pair, use the crypto key zeroize rsa global configuration command. Once you delete the RSA key pair, you automatically disable the SSH server.

Configure user authentication for local or remote access. You can configure authentication with or without authentication, authorization, and accounting (AAA). For more information, see the Authentication, Authorization, and Accounting Configuration Guide.

Restrictions for Configuring SSH


Note

Unless otherwise noted, the term “SSH” denotes “SSH Version 1” only.

The Secure Shell (SSH) server and SSH client are supported on Data Encryption Standard (DES) (56-bit) and 3DES (168-bit) data encryption software images only. In DES software images, DES is the only encryption algorithm available. In 3DES software images, both DES and 3DES encryption algorithms are available.

Execution shell is the only application supported.

The login banner is not supported in Secure Shell Version 1. It is supported in Secure Shell Version 2.

Information About Secure Shell (SSH)


Note

Unless otherwise noted, the term “SSH” denotes “SSH Version 1” only.

SSH Server


Note

Unless otherwise noted, the term “SSH” denotes “SSH Version 1” only.

The Secure Shell (SSH) Server feature enables an SSH client to make a secure, encrypted connection to a Cisco device. This connection provides functionality that is similar to that of an inbound Telnet connection. Before SSH, security was limited to Telnet security. SSH allows a strong encryption to be used with the Cisco software authentication. The SSH server in Cisco software works with publicly and commercially available SSH clients.

SSH Integrated Client


Note

Unless otherwise noted, the term “SSH” denotes “SSH Version 1” only.

The Secure Shell (SSH) Integrated Client feature is an application that runs over the SSH protocol to provide device authentication and encryption. The SSH client enables a Cisco device to make a secure, encrypted connection to another Cisco device or to any other device running the SSH server. This connection provides functionality similar to that of an outbound Telnet connection except that the connection is encrypted. With authentication and encryption, the SSH client allows for secure communication over an unsecured network.

The SSH client in Cisco software works with publicly and commercially available SSH servers. The SSH client supports the ciphers of Data Encryption Standard (DES), 3DES, and password authentication. User authentication is performed like that in the Telnet session to the device. The user authentication mechanisms supported for SSH are RADIUS, TACACS+, and the use of locally stored usernames and passwords.


Note

The SSH client functionality is available only when the SSH server is enabled.

RSA Authentication Support

Rivest, Shamir, and Adleman (RSA) authentication available in Secure Shell (SSH) clients is not supported on the SSH server for Cisco software by default. For more information about RSA authentication support, see the “Configuring a Router for SSH Version 2 Using RSA Pairs” section of the “Secure Shell Version 2 Support” module.

How to Configure SSH

Configuring an SSH Server


Note

Unless otherwise noted, the term “SSH” denotes “SSH Version 1” only.

2. configure terminal

DETAILED STEPS

Command or Action Purpose
Step 1 enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2 configure terminal

Enters global configuration mode.

Configures Secure Shell (SSH) control parameters.

This command can also be used to establish the number of password prompts provided to the user. The number is the lower of the following two values:

Value proposed by the client using the ssh -o numberofpasswordprompt command.

Value configured on the device using the ip ssh authentication-retries integer command, plus one.

(Optional) Configures a time-based rekey or a volume-based rekey for SSH.

Step 5 exit

Returns to privileged EXEC mode.

Step 6 show ip ssh

(Optional) Verifies that the SSH server is enabled and displays the version and configuration data for the SSH connection.

Invoking an SSH Client


Note

Unless otherwise noted, the term “SSH” denotes “SSH Version 1” only.

Perform this task to invoke the Secure Shell (SSH) client. The SSH client runs in user EXEC mode and has no specific configuration tasks.

2. ssh -l username -vrf vrf-name ip-address

DETAILED STEPS

Command or Action Purpose
Step 1 enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2 ssh -l username -vrf vrf-name ip-address

Invokes the SSH client to connect to an IP host or address in the specified virtual routing and forwarding (VRF) instance.

Troubleshooting Tips


Note

Unless otherwise noted, the term “SSH” denotes “SSH Version 1” only.

If your Secure Shell (SSH) configuration commands are rejected as illegal commands, you have not successfully generated an Rivest, Shamir, and Adleman (RSA) key pair for your device. Make sure that you have specified a hostname and domain. Then use the crypto key generate rsa command to generate an RSA key pair and enable the SSH server.

    When configuring the RSA key pair, you might encounter the following error messages:
      No hostname specified.

      You must configure a hostname for the device using the hostname global configuration command. See the “IPsec and Quality of Service” module for more information.

      No domain specified.

      You must configure a host domain for the device using the ip domain-name global configuration command. See the “IPsec and Quality of Service” module for more information

      The number of allowable SSH connections is limited to the maximum number of vtys configured for the device. Each SSH connection uses a vty resource.

      SSH uses either local security or the security protocol that is configured through AAA on your device for user authentication. When configuring Authentication, Authorization, and Accounting ( AAA), you must ensure that AAA is disabled on the console for user authentication. AAA authorization is disabled on the console by default. If AAA authorization is enabled on the console, disable it by configuring the no aaa authorization console command during the AAA configuration stage.

      Configuration Examples for SSH

      Example SSH on a Cisco 7200 Series Router

      In the following example, SSH is configured on a Cisco 7200 with a timeout that is not to exceed 60 seconds and no more than 2 authentication retries. Before the SSH server feature is configured on the router, TACACS+ is specified as the method of authentication.

      Example SSH on a Cisco 7500 Series Router

      In the following example, SSH is configured on a Cisco 7500 with a timeout that is not to exceed 60 seconds and no more than 5 authentication retries. Before the SSH server feature is configured on the router, RADIUS is specified as the method of authentication.

      Example SSH on a Cisco 12000 Series Router

      In the following example, SSH is configured on a Cisco 12000 with a timeout that is not to exceed 60 seconds and no more than two authentication retries. Before the SSH server feature is configured on the router, TACACS+ is specified as the method of authentication.

      Example: Verifying SSH


      Note

      Unless otherwise noted, the term “SSH” denotes “SSH Version 1” only.

      To verify that the Secure Shell (SSH) server is enabled and to display the version and configuration data for your SSH connection, use the show ip ssh command. The following example shows that SSH is enabled:

      The following example shows that SSH is disabled:

      To verify the status of your SSH server connections, use the show ssh command. The following example shows the SSH server connections on the device when SSH is enabled:

      The following example shows that SSH is disabled:

      Additional References

      Cisco IOS commands

      Authentication, authorization, and accounting (AAA)

      Authentication, Authorization, and Accounting Configuration Guide

      “IPsec and Quality of Service” module

      “Secure Shell Version 2 Support” module

      Downloading a software image

      Loading and Managing System Images Configuration Guide

      Technical Assistance

      The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

      Feature Information for Configuring Secure Shell

      The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

      Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

      Table 1 Feature Information for Configuring Secure Shell

      Cisco IOS 12.0(5)S

      Cisco IOS 15.1(1)SY

      The Secure Shell (SSH) feature is an application and a protocol that provides a secure replacement to the Berkeley r-tools. The protocol secures sessions using standard cryptographic mechanisms, and the application can be used similarly to the Berkeley rexec and rsh tools. Two versions of SSH are available: SSH Version 1 and SSH Version 2. This document describes SSH Version 1.

      This document also includes information about the Secure Shell SSH Version 1 Integrated Client feature and the Secure Shell SSH Version 1 Server Support feature. Both features are part of the Secure Shell functionality.

      Источник

      Поделиться с друзьями
      КомпСовет
      Adblock
      detector