2

The requirement is that when DH min size is set to group 14 (2048) a session using DH group 1 (1024) is not allowed

How can I really test this requirement on 2 CISCO routers.

Do I need to configure ip ssh dh min size both on ssh client and server.

Thanks, Network_freak

1
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 11, 2017 at 3:33

2 Answers 2

2

Use ip ssh dh min size

This is a configuration command...

sw1> enable
Password:
sw1# conf t
sw1(config)# ip ssh dh min size 2048

The doc link above lists it as an EXEC mode command, which is incorrect on my version of IOS...

sw1#sh ver | i IOS
Cisco IOS Software, C3560 Software (C3560-IPSERVICESK9-M), Version 12.2(58)SE2, 
RELEASE SOFTWARE (fc1)
sw1#ip ssh dh min size 4096
       ^
% Invalid input detected at '^' marker.

sw1#

All this assumes you have an IOS "K9" image to begin with...

7
  • That's an IOS-XE reference document.
    – Ricky
    Jan 22, 2015 at 8:16
  • ios-xe is ios running on a linux kernel... The OP didn't specify which one he is running anyway, and it's very rare that ios vs xe matters for anything other than platform specific features Jan 22, 2015 at 8:17
  • 1
    IOS-XE handles sshd at the linux os level, so setting from EXEC mode makes some sense. I wonder if it then shows up in the switch config? (I don't have anything that runs XE)
    – Ricky
    Jan 22, 2015 at 8:26
  • I have IOS-XE 03.04.01, and it is a configuration command too... I think this was an Wireless BU doc writer's copy/paste error Jan 22, 2015 at 8:33
  • Wait a minute... Cisco IOS XE Release 3SE (Cisco WLC 5700 Series) That's a ref for a wireless lan controller, that's not even IOS :)
    – Ricky
    Jan 22, 2015 at 8:47
1

A commandline ssh client (eg. linux slogin) will show the key size used:

% slogin -vv -l foo switch
...
debug2: bits set: 2051/4096
...

That was with the size set to 4096. It also takes a lot longer to connect with it set like that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.