Hot answers tagged

37 votes
Accepted

Why use SSH and VPN in combination?

The reasoning behind your current setup is probably some combination of the following three reasons. The VPN is a security solution for outside your company's network (See #1 below). SSH however, ...
user avatar
  • 551
22 votes

Why use SSH and VPN in combination?

SSH is an extremely popular target for brute-forcing attempts. If you have an SSH server directly on the Internet, within minutes, you will see login attempts with all kinds of user names (and ...
user avatar
10 votes
Accepted

Does anyone know how to import ssh public key to ASR9K (IOS-XR)?

I got response from Cisco Tech support and there are a few things not correctly described in the manual. First, ASR router supports key size 1024 bit or smaller contrary to its manual(supporting up ...
user avatar
9 votes
Accepted

Authenticate ssh key via Cisco ACS (TACACS+)

It looks like, "No". There's nothing specific in TACACS+ to transport a certificate exchange, however an ASCII data payload could suffice. (the RFC is a decade old) The real question is if ACS has ...
user avatar
  • 29.5k
8 votes
Accepted

SSH to Cisco ASA 5505

The ability to SSH to the firewall and ping outbound are usually two unrelated events and configuration. Since you're unable to ping the firewall's own 192.168.0.10 from itself, the interface appears ...
user avatar
8 votes
Accepted

How to assign a static IP to a Cisco Layer 3 switch in order to connect using SSH?

interface FastEthernet0 switchport switchport mode access switchport access vlan 1 ! interface GigabitEthernet0/1 switchport switchport mode access switchport access vlan 1 ! interface ...
user avatar
  • 151
7 votes

Why use SSH and VPN in combination?

The VPN allows you to connect to your employer's private network and acquire an IP address of that private network. Once you're connected to the VPN, it's like you are using one of the computers ...
user avatar
  • 1,289
6 votes
Accepted

How to specify username for SSH in Juniper router?

For some reason the Juniper documentation (http://www.juniper.net/techpubs/en_US/junos13.2/topics/reference/command-summary/ssh.html) doesn't mention it, but it is possible. The command is: ssh <...
user avatar
  • 1,899
6 votes

Bypassing a Cisco Terminal Server Menu

does anyone have experience with these things? Centuries, actually. And that experience says to leave things you know very little (or nothing) about alone, especially when they're systems that (a) ...
user avatar
  • 29.5k
6 votes
Accepted

Cisco 3750G - SSH Diffie Hellman Group 1 SHA1 Error

Your SSH client is saying "we can't agree on the cipher: server wants X but I'm configured not to speak X". This is a completely general SSH problem, not specifically related to this model of switch, ...
user avatar
  • 15.9k
5 votes
Accepted

Could accessed sites over an SSH tunnel be tracked by ISP?

The DNS is issued by default from your local host, not from the proxy, when using SOCKS (probably because SOCKS4 didn't support other way). Make sure you have checked the checkbox "Remote DNS" in the ...
user avatar
  • 168
5 votes

Telnet or SSH into a Cisco router

You'll need to have a hostname and a domain and generate the keys for ssh to work. My notebook says: hostname gw99 ip domain name example.com crypto key generate rsa modulus 2048 ip access-list ...
user avatar
  • 15.9k
4 votes

Why use SSH and VPN in combination?

You can drive additional layers of security through the VPN as well. Such as device criteria checks, 2 factor authentication, etc.
user avatar
  • 161
4 votes
Accepted

Why http + ssh is not popular?

If we ignore all the cryptography involved in the Confidentiality and Integrity services that both of these services provide, the only main remaining difference between SSH and SSL are how they engage ...
user avatar
  • 13.9k
4 votes

Why use SSH and VPN in combination?

You need the VPN to get into the local network. You don't then need to secure your connection to individual servers, as it'll already be encrypted by the VPN link. However, how else would you ...
user avatar
4 votes

Why use SSH and VPN in combination?

SSH is an encryption protocol used for several things. Encrypting traffic in a VPN tunnel is one of them. Your traffic is encrypted using SSH, but it then needs to be wrapped in valid IP packets (...
user avatar
  • 92.9k
4 votes
Accepted

How to detect port changes in real time on Cisco 4506

From configuration mode, type logging monitor info end then from enable mode type term[inal] mon[itor] this will send console messages to your vty session.
user avatar
  • 62k
4 votes
Accepted

How to fiter non SSH traffic in Wireshark

The ACK packets are not recognised as SSH packets, so the "not ssh" part of your filter doesn't match on them. How about simply using ip.addr == 10.0.0.31 && tcp.port != 22
user avatar
  • 2,628
4 votes
Accepted

Telnet or SSH into a Cisco router

You can use these commands to set up telnet access ! Set username/password username Lea password Shhh! ! Create standard ACL to control access ip access-list standard ONLY-THESE-GUYS permit 192.168....
user avatar
  • 62k
4 votes
Accepted

Can you SSH to a Cisco switch without a Username

You need some sort of credentials for SSH to work. You can either set it up using passwords like normally, or you can use a certificate to authenticate. Here's a discussion that might be helpful: ...
user avatar
  • 2,229
4 votes
Accepted

Remote access ssh on Ubuntu

Try ssh user@84.x.x.x from a computer on a different network. It's likely that your router doesn't have "loopback NAT" (or it has it but it's not enabled), which would explain why you can't ssh to ...
user avatar
  • 15.9k
4 votes
Accepted

CISCO IOS's feature Secure Shell Version 2 Enhancements for RSA Keys

Cisco maintains the Cisco Feature Navigator page where you can look up which features are available for which hardware or OS versions. It doesn't appear that what you are looking for is available for ...
user avatar
  • 92.9k
3 votes

Is the Nth ports on 127.0.0.1 and 127.0.0.2 same ?

Can I use the same port numbers for both but binding one of them to 127.0.0.1:N and the other to 127.0.0.2:N ? Yes, you can use the same port number on two different 127.X.X.X addresses. Are ...
user avatar
  • 1,616
3 votes
Accepted

Configure SSH cipher on Cisco IOS 12.2(55)SE7

As stated by @Teun Vink in comment, no way to do so but the given workaround using ssh -oHostKeyAlgorithms=+ssh-dss -oKexAlgorithms=+diffie-hellman-group1-sha1 $HOST do the trick.
user avatar
  • 18.3k
3 votes

Cisco IOS public-key auth with privilege 15 and no password

This works on 2960x software 152-7.E4: ip ssh version 2 no ip ssh server algorithm authentication password no ip ssh server algorithm authentication keyboard line vty 0 15 transport input ssh This ...
user avatar
3 votes
Accepted

Cisco SSH disconnect

[EDIT: updates at bottom] It turns out to be to do with the encryption algorithm, and thus indirectly related to the version of Cisco IOS. The router on the bench is just to help me debug the ...
user avatar
  • 15.9k
3 votes

Switches 'HPE OfficeConnect 1920S' - Enable SSH / TFTP Services

Well, actually you CAN enable telnet and ssh. It's completely unsupported, but anyway: Update firmware to latest version, I used PD.02.06.stk. Go to Maintenance -> Backup and Update Manage, click ...
user avatar
  • 131
3 votes
Accepted

Login local , login synchronous

login local tells the router to use the local database for authentication. You add account to the local database using the username command. logging synchronous (not login synchronous) formats the ...
user avatar
  • 62k
3 votes
Accepted

cisco catalyst creating user fails

The configuration has to include: A hostname (hostname sw99) A domain name (ip domain-name example.com) You have to have generated the keys (crypto key generate rsa) Enable the SSH server (ip ssh) ...
user avatar
  • 15.9k

Only top scored, non community-wiki answers of a minimum length are eligible