the Cisoc router.
Set the logon mode and click "Open ".
Here is the certificate issued to us.
R2 (config) # aaa new-model enable AAA
R2 (config) # aaa authentication login default local enable aaa authentication, set authentication on the local server
R2 (config) # username Cisco pass Cisco create a user Cisco and set its password to
the IP address 192.168.2.1 of the vro. Then, a dialog box will pop up for "renew". Let's choose whether to use the SSH key we just set, click "yes" to enter the logon command line, and enter the SSH Login User and its password ctocio set on the vro. You can see that the logon to the vro is successful.Then, we checked the packet capture result of the sniffer tool
the same time, data is compressed to greatly speed up transmission.This document describes how to configure Secure logon Using SSH on a Cisco router. This method is simple, secure, and suitable for promotion and use in network maintenance.
2. Configure the SSH service on the Cisco Router
In the
Set an instance for SSH on a Cisco device
Http://www.pcdog.com unknown
When using telnet for remote device maintenance, SSH should be used instead of Telnet because passwords and communications are in plain text and are ea
Rm-rf mydir/* Delete the mydir directory */Cd mydir/* enter the mydir directory */Cd-/* Go back to the upper-level directory */Cd ~ /* Return to the root directory */Mv tools tool/* rename the tools directory to tool */Ln-s tool bac
/* Create a symbolic link named bac for the tool directory. The most familiar thing is that www in FTP is linked to the public_html directory */
Cp-a tool/home/leavex/www/* Copy all files in the tool directory to the www directory */Rm go.tar/* Delete the go.tar file
1, execute command and script on remote host based on password and secret keySsh-t IP "CLI or shell.sh";The 2,C program implements the above functions--based on password-lessPorting the simple C program above to a different system to use the testAuthorized_keys;Copy the ~/.ssh/id_rsa.pub itself to the host that needs passwordless and append the id_rsa.pub content to the ~/.
supports SSH. log on to your vro or vswitch and check whether you have loaded an IPSec IOS image that supports SSH.
In our example, we will use the Cisco IOS command. Run the following command:
Router> Show flash
This command dis
user Names and PasswordsServer (config) #username admin Privilege 0 Secret Cisco// here if privilege is not 0 The privileged mode is automatically entered when SSH (i.e. no enable command is required and the enable password is not required)④ Configuring the Enable passwordServer (config) #enable secret Cisco⑤ Configur
1. TELNET Remote logon Configuration
1. Configure the Logon account, password, and account level on the CISCO router, as shown below. The account name is abc, the password is abc123, And the account level is 15 to the highest level)
R1 # configure terminal
R1 (config) # username abc privilege 15 secret abc123
R1 (config) # end
R1 #
2. Configure the remote logon authentication mechanism for the CISCO route
iOS supports SSH for high-end products such as the 7200 series, 7500 series, and 12000 Series (GSR) in the Cisco routers product family. The iOS version of the general support SSH file name is K3 or K4 words, K3 for 56bit SSH encryption, K4 represents 168bit SSH encryption.
service, you can use show ip SSH command to view authentication
R1 (config) #ip domain-name IDC
R1 (config) #crypto key generate RSA
The name for the keys to BE:R1.IDC
Choose the size of the key modulus in the range of 360 to 2048 foryour
General purpose keys.choosing A key modulus greater than the May take
A few minutes.
How many bits in the modulus [512]: 1024
% generating 1024 bit RSA keys, keys
whether you have loaded an IPSec IOS image that supports SSH.
In our example, we will use the Cisco IOS command. Run the following command:Router> Show flashThis command displays the name of the loaded IOS image. You can use the result to compare the list of supported features of your supplier.After you verify that yo
Telnet to the Cisco router for remote management is the choice of many network management, but the data transmitted through Telnet is in plain text, so this login method has a great security risk. A malicious user may use a Sniffer tool like Sniffer to perform local monitoring on the Administrator host or an appropriate interface to obtain the Administrator's password for logging on to the Cisoc router.
1. Security Testing
I installed sniffer locally
1. CISCO's most basic experiment and password settingsGlobal passwordR1 # configure terminalR1 (config) # enable password XXXXConsole Logon password:Router # config terminalRouter (config) # line console 0Router (config-line) # exec-timeout 0 0 // set the console timeout value to zero, that is, never time out. The default value is 10 minutes.Router (config-line) # logging synchronous // block annoying console information caused by instabilityRouter (config-line) # password XXXXXXRouter (config-l
Ciscoasa (config) # Crypto key generate RSA modulus 1024Specifies the size of the RSA coefficients, the larger the value, the longer it takes to generate RSA, the Cisco recommends using 1024.Warning:you has a RSA keypair already defined named Warning: You have an RSA key pair defined by the named Do you really want to replace them? [yes/no]: YDo you really want to replace them? [Yes/no]:yKeypair generation process begin. Please wait ...The start of th
In order to allow Cisco switched remote connections to the security of the account password improved, you can use SSH to connect the terminal, but many factory switches default iOS is not supported by the SSH feature, in order to enable Cisco switches to support SSH, must up
One, Cisco Discovery Protocol (CDP)The Cisco Discovery Protocol (Cdp,cisco Discovery Protocol) enables the collection of hardware and protocol information for adjacent devices for troubleshooting and network judgment.1. Get CDP timer and hold time informationR0#show CDP #查看整个路由器的CDP信息R0#sh CDP Interface #查看每个接口的路由信息2. Set CDP timeR0 #cdp Time 60R0#CDP Holdtime 18
The user checks network security and requires SSH logon to the core device. Previously, the device used Telnet logon, and the user name and password are transmitted in plaintext, which does not meet the security check requirements.
In fact, the SSH login configuration is very simple, mainly divided into the following steps:
1. Configure the Domain Name
Sd_core_r7600 (config) # IP domain-name sdcore
2. gener
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.