From IOS 15 we can log on Cisco IOS with RSA public key authentication.

However we still have to assign a password to the user. If we don't the user can log on without any password (and without the private key).

That means that the password can still be brute-forced.

What I'm looking for is a way for users to log on to the switch with privilege 15 without entering any password and totally disabling the password authentication for those users.

Is it possible?

I found for example (among others) this answer on Cisco forums that says it isn't possible but I hope that 5 years latter a solution has been found to this security issue.

  • You could only do that on the CON and AUX lines, but the VTY lines require a password.
    – Ron Maupin
    Feb 21, 2017 at 15:23
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 15, 2017 at 3:56
  • Are you restricting which ip addresses can ssh to the switch? If you’re worried about brute forcing passwords, this is the best place to start. Aug 18, 2018 at 16:24

1 Answer 1


This works on 2960x software 152-7.E4:

ip ssh version 2
no ip ssh server algorithm authentication password
no ip ssh server algorithm authentication keyboard
line vty 0 15
transport input ssh

This should remove telnet login also

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.