IP Services · Topic 8 of 9

Remote Access with SSH

Configure a Cisco device for secure remote access with SSH, including the hostname, domain name, RSA keys, local users and vty lines, then verify it works.

  • 4 min
  • Exam objective 4.8
In a nutshell
  • Telnet uses TCP 23 and sends clear text. SSH uses TCP 22 and encrypts.
  • Before generating keys, the device needs a hostname and a domain name.
  • crypto key generate rsa creates the keys and enables the SSH server.

What it is

SSH gives you an encrypted command line on a remote device.

For years the tool for remote management was Telnet, on TCP port 23. Telnet sends everything, including usernames and passwords, in clear text, so anyone who captures the traffic can read it.

SSH (Secure Shell) does the same job with encryption, on TCP port 22. The login, the commands and the output are all protected.

A Cisco device can be an SSH server, so you can log in to it. It can also be an SSH client, using the ssh command to reach another device.

SSH relies on public-key cryptography. The device makes an RSA key pair, keeps the private key and shares the public key with anyone who connects.

How it works

Preparation is a short checklist, and the order matters.

hostnamenot the defaultip domain nameforms the key nameRSA keysSSH server turns onvty linestransport input sshAdminSSH clientTCP 22 encryptedR1vty linelogin local checks usernameCLIprivileged mode

The checklist

  1. Set a hostname other than the default.
  2. Set a domain name, because the key name is built from both.
  3. Create a local user for authentication.
  4. Generate the RSA keys, which turns on the SSH server.
  5. Choose SSH version 2.
  6. Configure the vty lines, the virtual lines for remote logins.

A complete example

hostname R1
ip domain name example.com
username admin secret STRONGPASSWORD
crypto key generate rsa modulus 2048
ip ssh version 2
!
line vty 0 15
 login local
 transport input ssh
 exec-timeout 10 0

What the less obvious lines do:

  • username admin secret ... creates a local account. Use secret, because it stores a stronger hash than password.
  • crypto key generate rsa modulus 2048 creates the keys. SSH version 2 needs a modulus of at least 768 bits, and 2048 is the recommended size.
  • login local makes the line check the local usernames.
  • transport input ssh allows only SSH, which closes the Telnet door.
  • exec-timeout 10 0 ends an idle session after 10 minutes.
Watch out

Without transport input ssh, Telnet may still be accepted on the vty lines. Always restrict it.

Platforms number their vty lines differently, so 0 to 15 is common but not universal.

Restricting who can connect

An access list applied with access-class limits logins to approved management addresses. It adds a layer on top of SSH and does not replace it.

A new user lands at the lowest privilege level, so the user may still need the enable password afterwards. Adding privilege 15 to the username command lands the user in privileged mode directly.

Verifying

show ip ssh
show ssh
show crypto key mypubkey rsa
  • show ip ssh shows whether SSH is on, the version, and timers.
  • show ssh lists active SSH sessions.
  • show crypto key mypubkey rsa shows the public key and its size.

To test from another device:

ssh -l admin 10.1.1.1

Generating the keys is what enables the server. You need no separate enable command. Check the version in show ip ssh.

SSH needs an image with crypto features. On older IOS, those are the k9 images, and the crypto key command is missing without one.

What to remember for the exam

Eight facts cover SSH.

  • Telnet uses TCP 23 and sends clear text. SSH uses TCP 22 and encrypts.
  • Before generating keys, the device needs a hostname and a domain name.
  • crypto key generate rsa creates the keys and enables the SSH server.
  • ip ssh version 2 selects the stronger version.
  • transport input ssh blocks Telnet on the vty lines.
  • login local makes the line use the local username database.
  • username NAME secret PASSWORD creates a hashed local account.
  • Check with show ip ssh and show ssh.
Exam tip

Keys fail to generate? Check the hostname and domain name first.

Common mistakes

These six faults trip people up.

No domain name. The device tells you to define a domain name first.

Default hostname. A device still called Router or Switch may not create keys properly.

Forgetting login local. The line may not check your username.

Leaving Telnet open. Clear-text access can remain if transport input is not restricted.

Weak keys. A small modulus gives weak protection.

Locking yourself out. A mistake on the vty lines over a remote session can cut you off, so keep a console connection ready.

Check yourself

Try these three prompts.

  • Why is SSH preferred over Telnet, and which TCP port does each one use?

    Telnet uses TCP 23 and sends everything in clear text, while SSH uses TCP 22 and encrypts the login, commands and output.

  • In what order are the preparation steps done before RSA keys can be generated?

    Set a hostname other than the default, then a domain name because the key name is built from both, then create a local user. After that you generate the RSA keys.

  • What do transport input ssh and login local each change on the vty lines?

    transport input ssh allows only SSH, which blocks Telnet. login local makes the line check the local usernames.

Topic 8 of 9 in IP Services

Test yourself on IP Services

The full Cisco CCNA 200-301 question bank has 1,206 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.