37
votes
Accepted
Why use SSH and VPN in combination?
The reasoning behind your current setup is probably some combination of the following three reasons.
The VPN is a security solution for outside your company's network (See #1 below). SSH however, ...
- 551
22
votes
Why use SSH and VPN in combination?
SSH is an extremely popular target for brute-forcing attempts. If you have an SSH server directly on the Internet, within minutes, you will see login attempts with all kinds of user names (and ...
- 489
10
votes
Accepted
Does anyone know how to import ssh public key to ASR9K (IOS-XR)?
I got response from Cisco Tech support and there are a few things not correctly described in the manual.
First, ASR router supports key size 1024 bit or smaller contrary to its manual(supporting up ...
- 356
9
votes
Accepted
Authenticate ssh key via Cisco ACS (TACACS+)
It looks like, "No". There's nothing specific in TACACS+ to transport a certificate exchange, however an ASCII data payload could suffice. (the RFC is a decade old) The real question is if ACS has ...
- 29.5k
8
votes
Accepted
SSH to Cisco ASA 5505
The ability to SSH to the firewall and ping outbound are usually two unrelated events and configuration. Since you're unable to ping the firewall's own 192.168.0.10 from itself, the interface appears ...
- 6,999
8
votes
Accepted
How to assign a static IP to a Cisco Layer 3 switch in order to connect using SSH?
interface FastEthernet0
switchport
switchport mode access
switchport access vlan 1
!
interface GigabitEthernet0/1
switchport
switchport mode access
switchport access vlan 1
!
interface ...
- 151
7
votes
Why use SSH and VPN in combination?
The VPN allows you to connect to your employer's private network and acquire an IP address of that private network. Once you're connected to the VPN, it's like you are using one of the computers ...
- 1,289
6
votes
Accepted
How to specify username for SSH in Juniper router?
For some reason the Juniper documentation (http://www.juniper.net/techpubs/en_US/junos13.2/topics/reference/command-summary/ssh.html) doesn't mention it, but it is possible. The command is:
ssh <...
- 1,899
6
votes
Bypassing a Cisco Terminal Server Menu
does anyone have experience with these things?
Centuries, actually. And that experience says to leave things you know very little (or nothing) about alone, especially when they're systems that (a) ...
- 29.5k
6
votes
Accepted
Cisco 3750G - SSH Diffie Hellman Group 1 SHA1 Error
Your SSH client is saying "we can't agree on the cipher: server wants X but I'm configured not to speak X". This is a completely general SSH problem, not specifically related to this model of switch, ...
- 15.9k
5
votes
Accepted
Could accessed sites over an SSH tunnel be tracked by ISP?
The DNS is issued by default from your local host, not from the proxy, when using SOCKS (probably because SOCKS4 didn't support other way).
Make sure you have checked the checkbox "Remote DNS" in the ...
- 168
5
votes
Telnet or SSH into a Cisco router
You'll need to have a hostname and a domain and generate the keys for ssh to work. My notebook says:
hostname gw99
ip domain name example.com
crypto key generate rsa modulus 2048
ip access-list ...
- 15.9k
4
votes
Why use SSH and VPN in combination?
You can drive additional layers of security through the VPN as well. Such as device criteria checks, 2 factor authentication, etc.
- 161
4
votes
Accepted
Why http + ssh is not popular?
If we ignore all the cryptography involved in the Confidentiality and Integrity services that both of these services provide, the only main remaining difference between SSH and SSL are how they engage ...
- 13.9k
4
votes
Why use SSH and VPN in combination?
You need the VPN to get into the local network.
You don't then need to secure your connection to individual servers, as it'll already be encrypted by the VPN link.
However, how else would you ...
4
votes
Why use SSH and VPN in combination?
SSH is an encryption protocol used for several things. Encrypting traffic in a VPN tunnel is one of them. Your traffic is encrypted using SSH, but it then needs to be wrapped in valid IP packets (...
- 92.9k
4
votes
Accepted
How to detect port changes in real time on Cisco 4506
From configuration mode, type
logging monitor info
end
then from enable mode type
term[inal] mon[itor]
this will send console messages to your vty session.
- 62k
4
votes
Accepted
How to fiter non SSH traffic in Wireshark
The ACK packets are not recognised as SSH packets, so the "not ssh" part of your filter doesn't match on them.
How about simply using
ip.addr == 10.0.0.31 && tcp.port != 22
- 2,628
4
votes
Accepted
Telnet or SSH into a Cisco router
You can use these commands to set up telnet access
! Set username/password
username Lea password Shhh!
! Create standard ACL to control access
ip access-list standard ONLY-THESE-GUYS
permit 192.168....
- 62k
4
votes
Accepted
Can you SSH to a Cisco switch without a Username
You need some sort of credentials for SSH to work. You can either set it up using passwords like normally, or you can use a certificate to authenticate.
Here's a discussion that might be helpful: ...
- 2,229
4
votes
Accepted
Remote access ssh on Ubuntu
Try ssh user@84.x.x.x from a computer on a different network.
It's likely that your router doesn't have "loopback NAT" (or it has it but it's not enabled), which would explain why you can't ssh to ...
- 15.9k
4
votes
Accepted
CISCO IOS's feature Secure Shell Version 2 Enhancements for RSA Keys
Cisco maintains the Cisco Feature Navigator page where you can look up which features are available for which hardware or OS versions.
It doesn't appear that what you are looking for is available for ...
- 92.9k
3
votes
Is the Nth ports on 127.0.0.1 and 127.0.0.2 same ?
Can I use the same port numbers for both but binding one of them to
127.0.0.1:N and the other to 127.0.0.2:N ?
Yes, you can use the same port number on two different 127.X.X.X addresses.
Are ...
- 1,616
3
votes
Accepted
Configure SSH cipher on Cisco IOS 12.2(55)SE7
As stated by @Teun Vink in comment, no way to do so but the given workaround using
ssh -oHostKeyAlgorithms=+ssh-dss -oKexAlgorithms=+diffie-hellman-group1-sha1 $HOST
do the trick.
- 18.3k
3
votes
Cisco IOS public-key auth with privilege 15 and no password
This works on 2960x software 152-7.E4:
ip ssh version 2
no ip ssh server algorithm authentication password
no ip ssh server algorithm authentication keyboard
line vty 0 15
transport input ssh
This ...
3
votes
Accepted
Cisco SSH disconnect
[EDIT: updates at bottom]
It turns out to be to do with the encryption algorithm, and thus indirectly related to the version of Cisco IOS.
The router on the bench is just to help me debug the ...
- 15.9k
3
votes
Switches 'HPE OfficeConnect 1920S' - Enable SSH / TFTP Services
Well, actually you CAN enable telnet and ssh. It's completely unsupported, but anyway:
Update firmware to latest version, I used PD.02.06.stk.
Go to Maintenance -> Backup and Update Manage, click ...
- 131
3
votes
Accepted
Login local , login synchronous
login local tells the router to use the local database for authentication. You add account to the local database using the username command.
logging synchronous (not login synchronous) formats the ...
- 62k
3
votes
Accepted
cisco catalyst creating user fails
The configuration has to include:
A hostname (hostname sw99)
A domain name (ip domain-name example.com)
You have to have generated the keys (crypto key generate rsa)
Enable the SSH server (ip ssh)
...
- 15.9k
Only top scored, non community-wiki answers of a minimum length are eligible