37
votes
Accepted
Why use SSH and VPN in combination?
The reasoning behind your current setup is probably some combination of the following three reasons.
The VPN is a security solution for outside your company's network (See #1 below). SSH however, ...
- 551
23
votes
Why use SSH and VPN in combination?
SSH is an extremely popular target for brute-forcing attempts. If you have an SSH server directly on the Internet, within minutes, you will see login attempts with all kinds of user names (and ...
- 499
7
votes
Why use SSH and VPN in combination?
The VPN allows you to connect to your employer's private network and acquire an IP address of that private network. Once you're connected to the VPN, it's like you are using one of the computers ...
- 1,299
6
votes
Accepted
How to specify username for SSH in Juniper router?
For some reason the Juniper documentation (http://www.juniper.net/techpubs/en_US/junos13.2/topics/reference/command-summary/ssh.html) doesn't mention it, but it is possible. The command is:
ssh <...
- 1,939
6
votes
Bypassing a Cisco Terminal Server Menu
does anyone have experience with these things?
Centuries, actually. And that experience says to leave things you know very little (or nothing) about alone, especially when they're systems that (a) ...
- 30.9k
6
votes
Accepted
Cisco 3750G - SSH Diffie Hellman Group 1 SHA1 Error
Your SSH client is saying "we can't agree on the cipher: server wants X but I'm configured not to speak X". This is a completely general SSH problem, not specifically related to this model of switch, ...
- 16k
5
votes
Accepted
Could accessed sites over an SSH tunnel be tracked by ISP?
The DNS is issued by default from your local host, not from the proxy, when using SOCKS (probably because SOCKS4 didn't support other way).
Make sure you have checked the checkbox "Remote DNS" in the ...
- 168
5
votes
Telnet or SSH into a Cisco router
You'll need to have a hostname and a domain and generate the keys for ssh to work. My notebook says:
hostname gw99
ip domain name example.com
crypto key generate rsa modulus 2048
ip access-list ...
- 16k
5
votes
Accepted
Can you SSH to a Cisco switch without a Username
You need some sort of credentials for SSH to work. You can either set it up using passwords like normally, or you can use a certificate to authenticate.
Here's a discussion that might be helpful: ...
- 2,249
4
votes
Why use SSH and VPN in combination?
You can drive additional layers of security through the VPN as well. Such as device criteria checks, 2 factor authentication, etc.
- 161
4
votes
Accepted
Why http + ssh is not popular?
If we ignore all the cryptography involved in the Confidentiality and Integrity services that both of these services provide, the only main remaining difference between SSH and SSL are how they engage ...
- 14.4k
4
votes
Why use SSH and VPN in combination?
You need the VPN to get into the local network.
You don't then need to secure your connection to individual servers, as it'll already be encrypted by the VPN link.
However, how else would you ...
4
votes
Why use SSH and VPN in combination?
SSH is an encryption protocol used for several things. Encrypting traffic in a VPN tunnel is one of them. Your traffic is encrypted using SSH, but it then needs to be wrapped in valid IP packets (...
- 97.3k
4
votes
Accepted
How to detect port changes in real time on Cisco 4506
From configuration mode, type
logging monitor info
end
then from enable mode type
term[inal] mon[itor]
this will send console messages to your vty session.
- 65.4k
4
votes
Is the Nth ports on 127.0.0.1 and 127.0.0.2 same ?
Can I use the same port numbers for both but binding one of them to
127.0.0.1:N and the other to 127.0.0.2:N ?
Yes, you can use the same port number on two different 127.X.X.X addresses.
Are ...
- 1,636
4
votes
Accepted
How to fiter non SSH traffic in Wireshark
The ACK packets are not recognised as SSH packets, so the "not ssh" part of your filter doesn't match on them.
How about simply using
ip.addr == 10.0.0.31 && tcp.port != 22
- 2,628
4
votes
Accepted
Telnet or SSH into a Cisco router
You can use these commands to set up telnet access
! Set username/password
username Lea password Shhh!
! Create standard ACL to control access
ip access-list standard ONLY-THESE-GUYS
permit 192.168....
- 65.4k
4
votes
Accepted
Remote access ssh on Ubuntu
Try ssh user@84.x.x.x from a computer on a different network.
It's likely that your router doesn't have "loopback NAT" (or it has it but it's not enabled), which would explain why you can't ssh to ...
- 16k
4
votes
Accepted
CISCO IOS's feature Secure Shell Version 2 Enhancements for RSA Keys
Cisco maintains the Cisco Feature Navigator page where you can look up which features are available for which hardware or OS versions.
It doesn't appear that what you are looking for is available for ...
- 97.3k
3
votes
Accepted
Configure SSH cipher on Cisco IOS 12.2(55)SE7
As stated by @Teun Vink in comment, no way to do so but the given workaround using
ssh -oHostKeyAlgorithms=+ssh-dss -oKexAlgorithms=+diffie-hellman-group1-sha1 $HOST
do the trick.
- 19k
3
votes
Cisco IOS public-key auth with privilege 15 and no password
This works on 2960x software 152-7.E4:
ip ssh version 2
no ip ssh server algorithm authentication password
no ip ssh server algorithm authentication keyboard
line vty 0 15
transport input ssh
This ...
3
votes
Accepted
Cisco SSH disconnect
[EDIT: updates at bottom]
It turns out to be to do with the encryption algorithm, and thus indirectly related to the version of Cisco IOS.
The router on the bench is just to help me debug the ...
- 16k
3
votes
Switches 'HPE OfficeConnect 1920S' - Enable SSH / TFTP Services
Well, actually you CAN enable telnet and ssh. It's completely unsupported, but anyway:
Update firmware to latest version, I used PD.02.06.stk.
Go to Maintenance -> Backup and Update Manage, click ...
- 131
3
votes
Accepted
"ssh: connect to host myserver port 22: Invalid argument" (intermittent, ipv6, link-local address, dhcp hostname)
Whatever is doing hostname resolution is returning link-local IPv6 address(es) that aren't valid for the interface selected -- i.e. "any". Link-local addresses must specify the interface -- eg. fe80:.....
- 30.9k
3
votes
Accepted
Login local , login synchronous
login local tells the router to use the local database for authentication. You add account to the local database using the username command.
logging synchronous (not login synchronous) formats the ...
- 65.4k
3
votes
Accepted
cisco catalyst creating user fails
The configuration has to include:
A hostname (hostname sw99)
A domain name (ip domain-name example.com)
You have to have generated the keys (crypto key generate rsa)
Enable the SSH server (ip ssh)
...
- 16k
3
votes
In port forwarding, is the ultimate destination decided solely by the intermediary entity?
Basically, port forwarding is creating a manual, static entry in the NAPT table. The table will build dynamic entries as traffic is sent from inside to outside (these entries will eventually close or ...
- 97.3k
3
votes
What is the point of Junos outbound SSH service?
In Junos, outbound-ssh is used to allow the device to connect back to an external management platform via NETCONF over SSH, allowing remote management of devices that were behind NATs or jump-hosts.
...
- 9,146
3
votes
Accepted
ssh from cisco with fake source-ip
Make sure router 1 is advertising connected routes to router 2.
Create a loopback interface on router 1 with an IP in that range. For example
interface loopback 0
ip address 10.64.95.66 255.255.255....
- 65.4k
Only top scored, non community-wiki answers of a minimum length are eligible