SSH
1. What is SSH?
- SSH is a protocol used to connect to devices and configure them through the CLI.
- It allows you to connect to a device remotely without directly connecting to its console port.
- It helps replace less secure protocols such as Telnet.
- SSHv2 is an important upgraded version of SSHv1.
- SSH provides features such as data encryption and authentication.
- SSH uses TCP port 22.
- Enter the command `show ip ssh` to check whether the device supports SSH. If it shows 1.99, it
supports both SSHv1 and SSHv2.
- SSH configuration steps:
+ Create RSA keys to enable SSH. (RSA keys are cryptographic keys essential for various SSH encryption
functions. The keys are used to encrypt and decrypt data and for authentication.) A domain name must
be created because the device's domain name is used to name the RSA keys. A domain name is also
called an FQDN (Fully Qualified Domain Name), which is a combination of the hostname and DNS
domain name.
+ Create RSA keys and specify the key length. (The key length must be at least 768 bits to use SSHv2.)
+ Enter the command `show ip ssh` to check whether SSH has been enabled.
An ACL can be configured like this for a more complete configuration:
SSH configuration steps:
2. Layer 2 Switch Management IP:
- Layer 2 switches do not route packets or create routing tables, but a management IP address can be
configured on them to allow remote connections via SSH.
- We assign an IP address to an SVI, a virtual interface on the switch, to allow remote access to the
switch's command-line interface (CLI), such as through Telnet and SSH.
3. Console Port Security Login:
- By default, no password is required to access the command-line interface (CLI) of a Cisco IOS device
through the console port.
-Ngoài ra ,có thể cấu hình dòng lệnh trên bảng điều khiển để yêu cầu người dùng đăng nhập bằng một
trong những tên người dùng đã cấu hình trên thiết bị
4. Telnet:
- Telnet is rarely used nowadays because of its lack of security. It is used to remotely access the CLI of a
remote host. For example, instead of directly connecting your computer to a device using a console
cable, you can connect to the device remotely through Telnet.
- Telnet sends data in plain text without encryption. Therefore, if an attacker uses Wireshark to monitor
the traffic, they can read the exact data being transmitted.
- The Telnet server (the device being connected to, such as a router) listens for Telnet traffic on TCP port
22.
- The Telnet client is the device initiating the connection.