3

From IOS 15 we can log on Cisco IOS with RSA public key authentication.

However we still have to assign a password to the user. If we don't the user can log on without any password (and without the private key).

That means that the password can still be brute-forced.

What I'm looking for is a way for users to log on to the switch with privilege 15 without entering any password and totally disabling the password authentication for those users.

Is it possible?

I found for example (among others) this answer on Cisco forums that says it isn't possible but I hope that 5 years latter a solution has been found to this security issue.

  • You could only do that on the CON and AUX lines, but the VTY lines require a password. – Ron Maupin Feb 21 '17 at 15:23
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 15 '17 at 3:56
  • Are you restricting which ip addresses can ssh to the switch? If you’re worried about brute forcing passwords, this is the best place to start. – Mike Pennington Aug 18 '18 at 16:24
2

I think it may work. try this.

ip ssh version 2
no ip ssh server authenticate user password
line vty 0 15
transport input ssh

and, should be remove telnet login,
or remove your username and password it will work.

before test your ssh login.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.