Content

| 9.5 |  | Securing Remote Management |
| 9.5.3 |  | Encrypting communications using Secure Shell |

Recall that Ethernet is a broadcast-based technology. This means that all nodes sharing an Ethernet segment, or nodes attached to a SPAN port in a switched environment will receive a copy of all frames on the network at Layer 2. This means the Ethernet network is inherently insecure. Also recall that computers can be configured to use promiscuous mode network drivers, which allow the computers to ignore the Layer 3 information in the packet header, and record the packets for later examination and analysis.

Telnet allows administrators and users to connect to Cisco IOS devices from remote locations through the production data network. Because Telnet packets are transmitted across the network in clear-text (that is, without encryption), these packets can be captured and their contents easily read, including the capture of user names and passwords.

SSH allows administrators and users to securely connect to Cisco IOS devices from remote locations through the production data network. Because the data payload in SSH packets are protected by encryption, the contents of any captured SSH packets cannot be easily read. It is recommended that SSH encryption be configured as a minimum for securing in-band management traffic where possible.

> Note: SSH is available on Cisco Catalyst 6500 IOS based switches and Cisco Catalyst 3550 IOS based switches. SSH is not available on Cisco Catalyst 2950 switches running IOS 12.2.

Secure Shell (SSH) is an application and a protocol that provides a secure replacement to the Berkeley r-tools. The protocol secures the sessions using standard cryptographic mechanisms.

There are currently two versions of SSH available:

- SSH Version 1 – implemented in the Cisco IOS software, and consists of an application and a protocol. The application includes both a server and a client.
- SSH Version 2 – not implemented in the Cisco IOS software.

The SSH Server feature enables a SSH client to make a secure, encrypted connection to a Cisco IOS device. This connection provides functionality that is similar to that of an inbound Telent connection. SSH allows a strong encryption to be used in conjunction with Cisco IOS authentication features. The SSH server in Cisco IOS software works with any commercially available SSH-compliant client software.

The SSH Integrated Client feature is an application running over the SSH protocol to provide device authentication and encryption. The SSH client enables a Cisco IOS device to make a secure, encrypted connection to another Cisco IOS device, or to any other device running the SSH server. This connection provides functionality that is similar to a Telent connection, except that this connection is encrypted. With authentication and encryption, the SSH client allows for secure communications over an insecure network.

The SSH client in the Cisco IOS software works with any commercially available SSH-compliant server software. The SSH integrated client supports the Data Encryption Standard (DES) and Triple-DES (3DES) ciphers, and also supports password-based authentication. User authentication is performed like that in a Telnet session to a router. The user authentication mechanisms supported by the SSH integrated client include RADIUS, TACACS+, and locally stored user names and passwords.

> Note: The SSH client functionality is available only when the SSH server is enabled.

The following are some basic SSH restrictions:

- RSA authentication available in SSH clients is not supported in the SSH server for Cisco IOS 12.2 software.
- SSH server and SSH client are available on DES (56-bit) and 3DES (168-bit) data encryption IOS images only. In DES IOS images, DES is the only encryption algorithm available to be used by SSH. In 3DES IOS images, both the DES and 3DES encryption algorithms are available.

The command execution shell is the only application supported on Cisco IOS devices running the SSH server process.

| Interactive Media Activity Crossword Puzzle: Device Access Control Policy: Definitions After completing this activity, the students will be able to understand definitions of device access control policy.