36
The reasoning behind your current setup is probably some combination of the following three reasons.
The VPN is a security solution for outside your company's network (See #1 below). SSH however, might be a second layer of security outside of your company's network... but its main purpose is to secure the traffic within your company's network (See #2 Below)....
22
SSH is an extremely popular target for brute-forcing attempts. If you have an SSH server directly on the Internet, within minutes, you will see login attempts with all kinds of user names (and passwords) - often thousands per day even on small insignificant servers.
Now it is possible to harden SSH servers (the main three mechanisms are requiring an SSH key,...
10
I got response from Cisco Tech support and there are a few things not correctly described in the manual.
First, ASR router supports key size 1024 bit or smaller contrary to its manual(supporting up to 2048 bit key).
Second, only the key part of SSH public key must be 'de'coded w/ base64 en/decoding program.
SSH Key Generation
ssh-keygen -b 1024 -t rsa -f ...
9
It looks like, "No". There's nothing specific in TACACS+ to transport a certificate exchange, however an ASCII data payload could suffice. (the RFC is a decade old) The real question is if ACS has any method to handle it? And that also appears to be "no". The only mention I can find to PKI or certificate based authentication is for EAP-TLS, which is not ...
9
This is definitely an issue with your DH key size.
Try this:
cisco886va(config)#ip ssh dh min size 4096
8
interface FastEthernet0
switchport
switchport mode access
switchport access vlan 1
!
interface GigabitEthernet0/1
switchport
switchport mode access
switchport access vlan 1
!
interface vlan 1
ip address 20.40.60.80 255.255.255.0
!
This should be the bare minimum configuration to get your scenario working, at least some IP connectivity.
The ...
8
The ability to SSH to the firewall and ping outbound are usually two unrelated events and configuration. Since you're unable to ping the firewall's own 192.168.0.10 from itself, the interface appears down.
After ensuring vlan 100 is up/up, you'll need both a crypto key for SSH and a statement like ssh 192.168.0.0 255.255.255.0 inside to permit all inside ...
8
Junos's /etc/ssh/primes file had an off by 8 bug. That is, moduli in that file advertized to be 2048bits, were in fact 2056 bits long.
Cisco SSH client is very strict in this regard, and hence refuses to proceed. As a work around, delete /etc/ssh/primes file from your Junos device. This will cause Junos to use Group14 moduli.
Thanks
7
The VPN allows you to connect to your employer's private network and acquire an IP address of that private network. Once you're connected to the VPN, it's like you are using one of the computers inside the company -- even if you are physically located on the other side of the world.
Most probably, your employer requires you to connect via VPN first because ...
6
For some reason the Juniper documentation (http://www.juniper.net/techpubs/en_US/junos13.2/topics/reference/command-summary/ssh.html) doesn't mention it, but it is possible. The command is:
ssh <username>@<hostname>
6
does anyone have experience with these things?
Centuries, actually. And that experience says to leave things you know very little (or nothing) about alone, especially when they're systems that (a) work, and (b) have worked for years. Live with it for a few years before declaring it crap.
I call this "new kid syndrome"; the guy comes in, and from day-one ...
6
Your SSH client is saying "we can't agree on the cipher: server wants X but I'm configured not to speak X". This is a completely general SSH problem, not specifically related to this model of switch, which is that the SSH clients are regularly changed, usually to disallow older, weaker, ciphers. This isn't about key length, it's about cipher algorithms.
...
5
General-purpose key pairs may be used for multiple purposes, including SSL (e.g., for the HTTPS management interface) and IPsec. The SSH key pair is reserved for SSH and no other tasks.
One practical difference in management between IPsec/SSL and SSH keys is that the former are typically signed (either by a public CA or by a company's in-house certificate ...
answered Aug 28 '13 at 14:19
chrylis -cautiouslyoptimistic-
1,0661 gold badge8 silver badges14 bronze badges
5
It isn't necessary to create a domain name to create SSH keys. The below syntax will allow you to generate RSA keys for SSH use without one.
router(config)#crypto key generate rsa general-keys label RSAKEY
5
The DNS is issued by default from your local host, not from the proxy, when using SOCKS (probably because SOCKS4 didn't support other way).
Make sure you have checked the checkbox "Remote DNS" in the Proxy configuration of the Firefox:
5
You'll need to have a hostname and a domain and generate the keys for ssh to work. My notebook says:
hostname gw99
ip domain name example.com
crypto key generate rsa modulus 2048
ip access-list standard LEGIT
permit 192.168.2.0 0.0.0.255
line vty 0 4
access-class LEGIT in
privilege level 15
transport input ssh
As no one else has mentioned it ... ...
4
From configuration mode, type
logging monitor info
end
then from enable mode type
term[inal] mon[itor]
this will send console messages to your vty session.
4
You need the VPN to get into the local network.
You don't then need to secure your connection to individual servers, as it'll already be encrypted by the VPN link.
However, how else would you connect to them? SSH is the de facto console access protocol for remote servers; installing and configuring an unsecure one would be an additional management overhead,...
4
SSH is an encryption protocol used for several things. Encrypting traffic in a VPN tunnel is one of them. Your traffic is encrypted using SSH, but it then needs to be wrapped in valid IP packets (tunnel) to traverse a network like the Internet. This tunnel is the VPN.
Basically, your employer blocks outside network traffic, for security, unless that traffic ...
4
You can drive additional layers of security through the VPN as well. Such as device criteria checks, 2 factor authentication, etc.
4
If we ignore all the cryptography involved in the Confidentiality and Integrity services that both of these services provide, the only main remaining difference between SSH and SSL are how they engage the concept of Authenticity. Authenticity is the process of confirming the other party of the communication is indeed who they say they are. Both protocols ...
4
The ACK packets are not recognised as SSH packets, so the "not ssh" part of your filter doesn't match on them.
How about simply using
ip.addr == 10.0.0.31 && tcp.port != 22
4
You can use these commands to set up telnet access
! Set username/password
username Lea password Shhh!
! Create standard ACL to control access
ip access-list standard ONLY-THESE-GUYS
permit 192.168.2.0 0.0.0.255
! Enable authentication
aaa new-model
aaa authentication login default local
! enable virtual terminal sessions
line vty 0 15
access-class ONLY-...
4
You need some sort of credentials for SSH to work. You can either set it up using passwords like normally, or you can use a certificate to authenticate.
Here's a discussion that might be helpful: https://supportforums.cisco.com/t5/security-management/ssh-access-without-password/td-p/1517835
In Cisco parlance, they call it "RSA-based public key ...
4
Try ssh user@84.x.x.x from a computer on a different network.
It's likely that your router doesn't have "loopback NAT" (or it has it but it's not enabled), which would explain why you can't ssh to your own computer with the router's external address. Ignore it.
See for example Wikipedia article on NAT
4
Cisco maintains the Cisco Feature Navigator page where you can look up which features are available for which hardware or OS versions.
It doesn't appear that what you are looking for is available for that switch, which is past "The last date that Cisco Engineering may release any final software maintenance releases or bug fixes. After this date, Cisco ...
3
Can I use the same port numbers for both but binding one of them to
127.0.0.1:N and the other to 127.0.0.2:N ?
Yes, you can use the same port number on two different 127.X.X.X addresses.
Are these ports same or can I use them separately ?
You can use them separately.
See illustration below.
lab@ubu10:~$ nc -l 127.0.0.1 2000 &
[1] 1035
lab@ubu10:~...
3
You can use the below to just send a list of commands to the router the file has the actual commands
config t
crypto key generate rsa
exit
Then ssh to the router and complete the config
or just enable telnet if you can get away with it
config t
vty 0 4
transport input ssh telnet
exit
I have a perl script that does this to reset enable passwords
The ...
3
You should be able to set this with:
ip ssh cipher aes-256-ctr
ip ssh mac hmac-sha1
You may also have to disable the other algorithms first using the no forms of the commands.
3
As stated by @Teun Vink in comment, no way to do so but the given workaround using
ssh -oHostKeyAlgorithms=+ssh-dss -oKexAlgorithms=+diffie-hellman-group1-sha1 $HOST
do the trick.
Only top voted, non community-wiki answers of a minimum length are eligible