liveBook · Manning

SSH version 2

As explained in Acing the CCNA Exam: Volume 2 Advanced Networking and Security

SSH version 2 is the later major version of the Secure Shell protocol with security and performance improvements over version 1.

SSH version 2 (SSHv2) is the later major Secure Shell protocol version, offering security and performance advantages over SSHv1. Cisco IOS enables SSH 1.99 by default after RSA keys are created; this compatibility mode accepts both SSHv1 and SSHv2 connections. Use SSHv2-only operation for normal deployments. section 5.3.1 section 5.3.2

Key implementation facts:

  • Generate an RSA key pair before enabling SSH; the modulus determines encryption strength. Cisco recommends at least 2,048 bits, while SSHv2 requires at least 768 bits. section 5.3.1 section 5.4
  • Configure ip ssh version 2 to reject SSHv1, and use transport input ssh on the VTY lines to reject Telnet. section 5.3.2
  • SSH servers listen on TCP port 22. Cisco IOS clients use ssh -l username ip-address; ssh username@ip-address is not supported by Cisco IOS. section 5.3.2 section 5.4

Enable SSHv2 on a switch

Configure a hostname and domain name, generate RSA keys, restrict SSH to version 2, and secure all VTY lines: enable secret cisco; username jeremy secret ccna; ip ssh version 2; line vty 0 15; login local; transport input ssh. Verify operation with show ip ssh, which should report SSH Enabled - version 1.99 unless SSHv2-only behavior is otherwise displayed by the platform. section 5.3.1 section 5.3.2

SW1(config)# enable secret cisco                            #1
SW1(config)# username jeremy secret ccna                    #1
SW1(config)# access-list 1 permit 192.168.1.0 0.0.0.255     #2
SW1(config)# ip ssh version 2                               #3
SW1(config)# line vty 0 15                                  #4
SW1(config-line)# login local                               #5
SW1(config-line)# exec-timeout 20                           #6
SW1(config-line)# transport input ssh                       #7
SW1(config-line)# access-class 1 in                         #8
#1 Configures an enable secret and user account
#2 Creates an ACL to limit access to the VTY lines
#3 Limits connections to SSH version 2 only
#4 Configures all 16 VTY lines
#5 Requires users to log in with a user account
#6 Logs out users after 20 minutes of inactivity
#7 Allows only SSH connections
#8 Applies the ACL

Use the annotated Cisco IOS configuration to review local authentication, VTY selection, inactivity timeout, SSH-only transport, and an access-class restriction. section 5.3.2

How Acing the CCNA Exam: Volume 2 Advanced Networking and Security covers it

How deep it goes
Explains RSA prerequisites, protocol compatibility, VTY configuration, connection syntax, verification, and key-size limits.
Examples
Uses Cisco IOS switch configuration, show ip ssh verification, and SSH connections from a host or router.
What it assumes
Assumes basic Cisco IOS configuration and VTY familiarity while teaching RSA generation, SSH versions, authentication, and transport restrictions.
What you can do after
Operate/configure Cisco IOS SSHv2 access, verify RSA-backed enablement, and connect with the supported SSH command.
How it connects
Links SSHv2 with SSHv1, RSA keys, VTY lines, Telnet, local authentication, access control lists, and TCP.
Cover of Acing the CCNA Exam: Volume 2 Advanced Networking and Security
liveBookmanning.com
Read Acing the CCNA Exam: Volume 2 Advanced Networking and Security on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Acing the CCNA Exam: Volume 2 Advanced Networking and Security. The section links point to the parts of the book it draws on.