Configure and verify SSH

Why SSH is Important

SSH (Secure Shell) is critical in modern networking because it provides encrypted remote access to network devices. Unlike Telnet, which transmits data in clear text, SSH encrypts all communication between the administrator and the device. This prevents attackers from intercepting sensitive information such as usernames, passwords, and configuration commands. For the CCNA exam, understanding SSH configuration is essential as it represents a fundamental security best practice.

What is SSH?

SSH is a cryptographic network protocol that enables secure remote management of network devices over an unsecured network. It operates on TCP port 22 by default and uses public-key cryptography to authenticate the remote computer and allow it to authenticate the user. SSH comes in two versions:
- SSH Version 1: Older, less secure, and vulnerable to attacks
- SSH Version 2: Current standard, more secure, and recommended for use

How SSH Works

1. The client initiates a TCP connection to port 22 on the server
2. The server sends its public key to the client
3. Both parties negotiate encryption parameters
4. The client authenticates using username/password or public key
5. An encrypted session is established for secure communication

SSH Configuration Steps on Cisco Devices

Step 1: Configure a hostname (required for RSA key generation)
Router(config)# hostname R1

Step 2: Configure a domain name (required for RSA key generation)
R1(config)# ip domain-name example.com

Step 3: Generate RSA key pair
R1(config)# crypto key generate rsa modulus 2048

Step 4: Create local user account
R1(config)# username admin privilege 15 secret MyPassword123

Step 5: Enable SSH version 2
R1(config)# ip ssh version 2

Step 6: Configure VTY lines for SSH access
R1(config)# line vty 0 4
R1(config-line)# transport input ssh
R1(config-line)# login local

SSH Verification Commands

- show ip ssh - Displays SSH version and configuration status
- show ssh - Shows active SSH connections
- show crypto key mypubkey rsa - Displays generated RSA keys
- show running-config | section vty - Shows VTY line configuration

Optional SSH Settings

- ip ssh time-out 60 - Sets authentication timeout in seconds
- ip ssh authentication-retries 3 - Limits login attempts

Exam Tips: Answering Questions on Configure and Verify SSH

1. Remember the Prerequisites: SSH requires a hostname AND domain name before you can generate RSA keys. Questions often test whether you know both are mandatory.

2. Know the Minimum Key Size: For SSH version 2, the RSA key must be at least 768 bits. A key size of 1024 or 2048 bits is commonly recommended.

3. Transport Input Options:
- transport input ssh - Only SSH allowed
- transport input telnet ssh - Both protocols allowed
- transport input all - All protocols allowed
- transport input none - No remote access

4. Login Methods: Know the difference between login (uses line password) and login local (uses local database). SSH typically uses login local.

5. Version Selection: Always configure ip ssh version 2 for security. Exam questions may test your knowledge of why version 2 is preferred.

6. Port Number: SSH uses TCP port 22. This is a frequently tested fact.

7. Order Matters: You must configure hostname and domain name BEFORE generating RSA keys. Watch for questions with commands in incorrect order.

8. Verification Focus: The show ip ssh command reveals the SSH version, timeout values, and authentication retries. Know what output to expect.