SSH On Cisco Router

Last week we had and very peculiar requirement and requirement is like that in our Indian datacenter some engineers are trying to enable HDV (High density voice module) for voice call routing with our existing EPBAX. I am helping them too from different continent itself. But unfortunately I am not able to access that router on our dedicated MPLS circuit. But from my hotel room I am able to access that router because one of its interface is also connected to internet. And its my requirement to access router till time its not get configured properly because I am also doing lots or R&D on that . Suddenly after one day some one raised an security concern because I am accessing that router through telnet session (Means clear text password transfer on internet) Very dangerous man. And then research started to enable the SSH on router too ASAP. Although with small effort its started working . Enclosed steps evolved.

Configure Host Name

Router(config)# hostname Keekar-Router
Keekar-Router(config)#

Configure a domain name on your router using the ip domain-name command.

Keekar-Router(config)# ip domain-name keekar.com
Keekar-Router(config)#

Then, create an RSA encryption key pair for the router to use for authentication and encryption of the SSH data.

Keekar-Router(config)# crypto key generate rsa
The name for the keys will be: Keekar-Router.keekar.com

Choose the size of the key modulus in the range of 360 to 2048 for your General Purpose Keys. Choosing a key modulus greater than 512 may take a few minutes.

How many bits in the modulus [512]: 768
% Generating 768 bit RSA keys ...[OK]

Keekar-Router(config)#
*Mar 1 00:17:13.337: %SSH-5-ENABLED: SSH 1.5 has been enabled
Keekar-Router(config)#

As you can see from this example, after the system generates the key, you'll receive a message that it has automatically enabled SSH 1.5 on the router.
What is this SSH 1.5 ? (We are wondering)
Then got to know CISCO call SSH1 --> SSH 1.5. Its quite funny Yes I know . :) Imagine 1.5 Man, In palce of Willian-2 , William-1.5 . OK thats enough concentrate.
If the system has enabled support for both SSH1 and SSH2, this message would say SSH 1.99. :)) (Sorry buddy I am not able to control my self.
If the system has only enabled support for SSH2, the message would say SSH 2.0.

You can also configure SSH settings if you choose. To do so, use the ip ssh command with which ever parameters you choose to set. (Different IOS versions have different
options because they support different versions of SSH.) Here's an example:

Keekar-Router(config)# ip ssh ?
authentication-retries Specify number of authentication retries
Port Starting (or only) port number to listen
on
Rsa Configure RSA keypair name for SSH
source-interface Specify interface for source address in SSH
connections
time-out Specify SSH time-out interval

Keekar-Router(config)# ip ssh

Configuring optional SSH settings completes the process of configuring SSH on the router. Now, let's take a look at showing the SSH status.
To view the status of SSH, you can use the following commands:

* Use show ip ssh to view SSH settings.
* Use show ssh to view SSH connections.

Here's an example:

Keekar-Router# show ip ssh
SSH Enabled - version 1.5
Authentication timeout: 120 secs; Authentication retries: 3
Keekar-Router# show ssh
%No SSH server connections running.
Keekar-Router#

SSH debug commands are also available by using the debug ip ssh command.

You can use a device's built-in SSH client to connect to other SSH servers. The Privileged Mode command is ssh. Here's an example:

Keekar-Router# ssh ?
-c Select encryption algorithm
-l Log in using this username
-o Specify options
-p Connect to this port
WORD IP address or hostname of a remote system

Keekar-Router# ssh