SSH instead of Telnet

Telnet versus SSH

Turning on SSH

1. A hostname other than Router: hostname R1.
2. A domain name: ip domain name example.com.
3. RSA keys: crypto key generate rsa (at least 768 bits for SSH version 2; use 2048).
4. A way to log in: local users + login local on the vty lines (SSH always needs a user name).
5. Then: ip ssh version 2, and transport input ssh on the vty lines so Telnet is refused.

In NetLab

▶ R1
R1>enable
R1#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
R1(config)#ip domain name example.com
R1(config)#crypto key generate rsa
The name for the keys will be: R1.example.com
Choose the size of the key modulus in the range of 360 to 4096 for your
  General Purpose Keys. Choosing a key modulus greater than 512 may take
  a few minutes.
How many bits in the modulus [512]: 2048
% Generating 2048 bit RSA keys, keys will be non-exportable...
[OK] (elapsed time was 2 seconds)
*Mar  1 00:00:05.000: %SSH-5-ENABLED: SSH 1.99 has been enabled
R1(config)#ip ssh version 2
R1(config)#username admin privilege 15 secret Adm1n!2026
R1(config)#line vty 0 4
R1(config-line)#login local
R1(config-line)#transport input ssh
R1(config-line)#end
*Mar  1 00:00:11.000: %SYS-5-CONFIG_I: Configured from console by console
R1#show ip ssh | include SSH|Keys
SSH Enabled - version 2.0
IOS Keys in SECSH format(ssh-rsa, base64 encoded): R1.example.com
▶ ADMIN
NetLab Windows-style command prompt. Type help to see the commands.
C:\Users\student>telnet 10.1.1.1
Connecting To 10.1.1.1...Could not open connection to the host, on port 23: Connect failed
C:\Users\student>ssh -l admin 10.1.1.1
Warning: Permanently added '10.1.1.1' (RSA) to the list of known hosts.
admin@10.1.1.1's password: 
R1#show users
    Line       User       Host(s)              Idle       Location
   0 con 0                idle                 00:00:00   
* 388 vty 0     admin      idle                 00:00:02 10.1.1.10

  Interface    User               Mode         Idle     Peer Address
R1#show ssh
Connection Version Mode Encryption  Hmac	     State		   Username
0          2.0     IN   aes256-ctr  hmac-sha2-256 Session started       admin
0          2.0     OUT  aes256-ctr  hmac-sha2-256 Session started       admin
R1#exit
Connection to 10.1.1.1 closed.

A router can be an SSH client too. From R1 to R2 (which already has SSH on), use ssh -l USER ADDRESS. exit on R2 brings you back to R1:

In NetLab

▶ R1
R1>enable
R1#ssh -l admin 10.0.12.2
Password: 
R2#show users
    Line       User       Host(s)              Idle       Location
   0 con 0                idle                 00:00:00   
* 388 vty 0     admin      idle                 00:00:02 10.0.12.1

  Interface    User               Mode         Idle     Peer Address
R2#exit

[Connection to 10.0.12.2 closed by foreign host]

Tip: transport input ssh telnet allows both, transport input none neither (console only).

Remember: Hostname, domain name, RSA keys, users + login local, ip ssh version 2, transport input ssh.