The Ssh Server; Key Management; Managing The Ssh Server - Cisco SCE8000 Configuration Manual

Chapter 5 Configuring the Management Interface and Security

The SSH Server

A shortcoming of the standard telnet protocol is that it transfers password and data over the net
unencrypted, thus compromising security. Where security is a concern, using a Secure Shell (SSH)
server rather than telnet is recommended.
An SSH server is similar to a telnet server, but it uses cryptographic techniques that allow it to
communicate with any SSH client over an insecure network in a manner which ensures the privacy of
the communication. CLI commands are executed over SSH in exactly the same manner as over telnet.
The SSH server supports both the SSH-1 and SSH-2 protocols.

Key Management

Each SSH server should define a set of keys (DSA2, RSA2 and RSA1) to be used when communicating
with various clients. The key sets are pairs of public and private keys. The server publishes the public
key while keeping the private key in non-volatile memory, never transmitting it to SSH clients.
Note The keys are kept on the tffs0 file system, which means that a person with knowledge of the 'enable'
password can access both the private and public keys. The SSH server implementation provides
protection against eavesdroppers who can monitor the management communication channels of the SCE
platform, but it does not provide protection against a user with knowledge of the 'enable' password.
Key management is performed by the user via a special CLI command. A set of keys must be generated
at least once before enabling the SSH server.
Size of the encryption key is always 2048 bits.

Managing the SSH Server

•
Use these commands to manage the SSH server. These commands do the following:
•
•
•
•
How to Generate a Set of SSH Keys
Remember that you must generate a set of SSH keys before you enable the SSH server.
From the SCE(config)# prompt, type ip ssh key generate and press Enter.
Step 1
Generates a new SSH key set and immediately saves it to non-volatile memory. (Key set is not part of
the configuration file). Key size is always 2048 bits.
OL-16479-01
How to Monitor the Status of the SSH Server, page 5-24
Generate an SSH key set
Enable/disable the SSH server
Enable/disable SSHv1. (Disabling SSHv1 allows you to run SSHv2 only.)
Delete existing SSH keys
Configuring the Available Interfaces
Cisco SCE8000 Software Configuration Guide, Rel 3.1.6S
5-23