Content

| 9.5 |  | Securing Remote Management |
| 9.5.9 |  | Configuring, verifying, and troubleshooting SSH server |

Prior to configuring SSH, perform the following tasks:

- Download the required image on the device. The SSH server requires the IPSec (DES or 3DES) encryption software image. The SSH client requires the IPSec (DES or 3DES) encryption software image.
- Configure a host name and host domain for the device using the commands shown in Figure .
- Generate an RSA key pair for the device. This will also automatically enable SSH.
- Configure a local user name and password on the device. The device may also be configured with TACACS+ or RADIUS protocols for user authentication.

SSH configuration can be verified using the following commands:

> show ip ssh
> show ssh

The show ip ssh command is used to check that the SSH server is enabled, and to view the version and configuration data.

The show ssh command is used to view details of users connected to the ssh server process running on the device.

SSH Configuration Errors
SSH configuration commands will be rejected if an RSA key-pair has not been successfully generated first. To resolve this problem, generate a new RSA key-pair. If necessary, zeroize any existing RSA key pair using the crypto key zeroize rsa command first.

The error messages no hostname specified and no domain specified during the generation of an RSA key-pair are caused by the lack of a hostname or host domain in the running configuration of the switch. These elements of the configuration of a device are used in generating an RSA key-pair. This problem can be resolved by ensuring both the hostname and the host domain have been configured prior to generating an RSA key-pair.

Because an SSH session uses a vty resource on an SSH server, the number of simultaneous SSH sessions is limited by the number of vty lines available on the device. Cisco IOS-based switches support up to sixteen simultaneous vty sessions.

SSH Connection Errors
There are two likely causes for an SSH server refusing a connection request.

First, there are no vty resources remaining to allocate to a new vty session. The maximum number of vty session hosted by the SSH server has been reached.

Second, the public portion of the RSA key-pair held on the client no longer matches the private portion of the RSA key-pair held on the server. This would only be the case where the RSA key-pair on the SSH server had been zeroized and regenerated. This problem is resolved by deleting the old public key on the client and downloading a copy of the new public key from the SSH server on the switch.