How do you set up SSH on a Cisco router and lock down management access?
Show the answer
Say this first
Set a hostname and a domain name, generate an RSA key of at least 2048 bits, force SSH version 2, and
create a local user with a strong type 9 (scrypt) secret. On the VTY lines allow only transport input ssh, with an access-class that permits only the management subnet. Add an idle timeout, brute-force
protection with login block-for, and turn off what I do not use, like Telnet and the HTTP server.
Go deeper
Configuration
hostname R1
ip domain name corp.example.com
crypto key generate rsa general-keys modulus 2048
ip ssh version 2
ip ssh time-out 60
ip ssh authentication-retries 3
!
username netadmin privilege 15 algorithm-type scrypt secret Str0ng-Admin-2026
enable algorithm-type scrypt secret Str0ng-Enable-2026
!
ip access-list standard MGMT-ONLY
10 permit 10.99.0.0 0.0.0.255
20 deny any log
!
line vty 0 15
access-class MGMT-ONLY in
transport input ssh
login local
exec-timeout 10 0
!
login block-for 120 attempts 5 within 60
login on-failure log
no ip http server
no ip http secure-serverWith aaa new-model, the VTY lines use AAA method lists instead of login local.
R1# show ip ssh
SSH Enabled - version 2.0
Authentication timeout: 60 secs; Authentication retries: 3Password types on IOS
| Type | Meaning | Use |
|---|---|---|
| 0 | clear text | never |
| 7 | reversible (service password-encryption) | only hides from shoulder surfing |
| 5 | salted MD5 | legacy |
| 8 | PBKDF2 with SHA-256 | good |
| 9 | scrypt | good |
They will ask next
Why does the key size matter?
SSH version 2 on IOS needs a modulus of at least 768 bits, and anything under 2048 is considered weak today. Many IOS-XE releases also let you restrict the SSH ciphers, key exchange and MAC algorithms to modern ones.
Your management network is in a VRF and the access-class blocks everything. Why?
A VTY access-class without the
vrf-alsokeyword does not accept connections arriving in a VRF. Useaccess-class MGMT-ONLY in vrf-also.How would you move from passwords to keys?
Add users' public keys under
ip ssh pubkey-chain, or better, use AAA with central accounts and MFA at the jump host, so local secrets become break-glass only.
Traps
- Calling
service password-encryptionencryption. Type 7 can be reversed instantly. - Forgetting
transport input ssh, which leaves Telnet open on some releases.