Detailed steps for configuring the SSH protocol (1)

Due to the special nature of some devices, we need to configure the SSH protocol separately. Now we will introduce how to configure the SSH protocol for Cisco routers. Now let's analyze: when using telnet for remote device maintenance, SSH should be used to replace telnet because passwords and communications are in plain text and are easily listened by sniffer. the SSH (Secure Shell) Service uses tcp port 22. After the client software initiates a connection request, the server accepts the public key and negotiates the encryption method, after successful communication, all communications are encrypted. Cisco devices currently only support SSH v1. v2.Cisco is not supported to achieve SSH. The goal is to provide secure device management connections, it is not applicable to communication encryption between hosts and hosts. Cisco recommends using IPSEC as the end-to-end communication encryption solution ｡

Configure SSH protocol 1:

Configuration of IOS devices (such as 6500 MSFC, 8500, And 7500:

A) software requirements

IOS 12.0. (10) S and later versions contain IPSEC 56 Feature

We recommend that you use IOS 12.2 ip plus ipsec 56C or a later version.

Basically, all Cisco vrouters are supported, but you may need to upgrade the hardware to run the software of the specified version.

B) define users

User mize pass nnwh@163.net

User sense secret ssn

D) define a domain name

Ip domain-name mize.myrice.com // required to configure SSH

E) generate a key

Crypto key generate rsa modulus 2048

Execution result:

The name for the keys will be: 6509-mize.myrice.com % The key modulus size is 2048 bits Generating RSA keys... [OK]

F) specifies the source IP address of the host that can log on to the system using SSH.

Access-list 90 remark Hosts allowed toSSHin // earlier versions may not support the remark keyword access-list 90 permit 10.10.1.100 access-list 90 permit 10.1.101

G) restrict Logon

Line con 0 login local line vty 0 4 login local // use the user name and password defined locally to log on to transport inputSSH // only SSH logon is allowed (note: disable telnet and session from swap engine !) Access-class 90 in // only allow the specified source host to log on