2.8. SSH Commands

Command Purpose

To enable SSH service, use ip ssh server enable command in Global Configuration. To disable SSH service, use ip ssh server disable command.

Prerequisites

Command Syntax

ip ssh server ( enable | disable )

Command Mode

Global Config

Default

SSH service is enabled.

Usage

None

Examples

The following example enables the SSH service on your switch:

Switch# configure terminal
Switch(config)# ip ssh server enable

Related Commands

show ip ssh server status

Command Purpose

To configure Secure Shell (SSH) authentication retry times on your switch, use the ip ssh server authentication-retries command in Global Configuration. To restore the default value, use the no form of this command.

Prerequisites

Command Syntax

ip ssh server authentication-retries COUNT

no ip ssh server authentication-retries

Command Mode

Global Config

Default

The default is 6.

Usage

None

Examples

The following examples configure SSH authentication retry times on your switch:

Switch# configure terminal
Switch(config)# ip ssh server authentication-retries 3

Related Commands

show ip ssh server status

Command Purpose

To configure Secure Shell (SSH) authentication timeout on your switch, use the ip ssh server authentication-timeout command in Global Configuration. To restore the default value, use the no form of this command.

Prerequisites

Command Syntax

ip ssh server authentication-timeout SECONDS

no ip ssh server authentication-timeout

Command Mode

Global Config

Default

The default is 120 seconds.

Usage

None

Examples

The following examples configure SSH authentication timeout on your switch:

Switch# configure terminal
Switch(config)# ip ssh server authentication-timeout 100

Related Commands

show ip ssh server status

Command Purpose

To configure Secure Shell (SSH) authentication type on your switch, use the ip ssh server authentication-type command in Global Config. To restore the default value, use the no form of this command.

Prerequisites

Command Syntax

ip ssh server authentication-type ( all | { password | public-key | rsa } )

no ip ssh server authentication-type

Command Mode

Global Config

Default

The default authentication type is all.

Usage

None

Examples

The following examples configure SSH authentication type on the switch:

Switch# configure terminal
Switch(config)# ip ssh server authentication-type password

Related Commands

show ip ssh server status

Command Purpose

To configure Secure Shell (SSH) host-key on your switch, use the ip ssh server host-key rsa key command in Global Config. To restore the default value, use the no form of this command.

Prerequisites

Command Syntax

ip ssh server host-key rsa key KEYNAME

no ip ssh server host-key rsa

Command Mode

Global Config

Default

None

Usage

Host-key is used to combining public key to generate a session. When SSH login,modifing host-key can cause connection closed.

Examples

The following examples configure SSH host key on your switch:

Switch# configure terminal
Switch(config)# ip ssh server host-key rsa key KEY1

Related Commands

show ip ssh server status

Command Purpose

To configure Secure Shell (SSH) rekey interval on your switch, use the ip ssh server rekey-interval command in Global Config. To restore the default value, use the no form of this command.

Prerequisites

Command Syntax

ip ssh server rekey-interval MINUTE

no ip ssh server rekey-interval

Command Mode

Global Config

Default

The default interval is 60 minutes.

Usage

None

Examples

The following examples configure SSH rekey interval on your switch:

Switch# configure terminal
Switch(config)# ip ssh server rekey-interval 30

Related Commands

show ip ssh server status

Command Purpose

To configure Secure Shell (SSH) version on your switch, use the ip ssh server version command in Global Config. To restore the default value, use the no form of this command.

Prerequisites

Command Syntax

ip ssh server version ( 1 | 2 | all )

no ip ssh server version

Command Mode

Global Config

Default

The default SSH version is 2.

Usage

You can use this command with the 2 keyword to ensure that your switch will not inadvertently establish a weaker SSH Version 1 connection.

Examples

The following example shows that only SSH Version 1 support is configured:

Switch# configure terminal
Switch(config)# ip ssh server version 1

Related Commands

show ip ssh server status

Command Purpose

To configure the source address of Secure Shell (SSH) server on your switch, use the ip ssh server source command in Global Config. To restore the default value, use the no form of this command.

Prerequisites

Command Syntax

ip ssh server source address { vrf NAME | } IP_ADDR

no ip ssh server source address

Command Mode

Global Config

Default

None

Usage

You can use this command to modify the address which SSH server works on, and specify a vrf to provide SSH server. The source address can only be 0.0.0.0 or loopback interface’s address, 0.0.0.0 indicates that the SSH server address is not specified.

Examples

The following example shows how to set SSH server inbind address :

Switch# configure terminal
Switch(config)# ip ssh server source address 10.10.10.1

Related Commands

ip ssh server

Command Purpose

To configure the TCP port for SSH server working inband on your switch, use the ip ssh server source command in Global Config. To restore the default value, use the no form of this command.

Prerequisites

Command Syntax

ip ssh server source port NUMBER

no ip ssh server source port

Command Mode

Global Config

Default

None

Usage

The CLI of no ip ssh server source port will configure TCP port for SSH server working inband with default value of 22.

Examples

The following example shows the special port is configured:

Switch# configure terminal
Switch(config)# ip ssh server source port 2222

Related Commands

ip ssh server

Command Purpose

To configure the TCP port for SSH server working outband on your switch, use the ip ssh server source command in Global Config. To restore the default value, use the no form of this command.

Prerequisites

Command Syntax

ip ssh server source mgmt-if port NUMBER

no ip ssh server source mgmt-if port

Command Mode

Global Config

Default

None

Usage

The CLI of “no ip ssh server source mgmt-if port” will configure TCP port for SSH server working outband with default value of 22.

Examples

The following example shows the special port is configured:

Switch# configure terminal
Switch(config)# ip ssh server source mgmt-if port 2222

Related Commands

ip ssh server

Command Purpose

To display the version and configuration data for Secure Shell (SSH), use the show ip ssh server status command in Privileged EXEC mode.

Prerequisites

Command Syntax

show ip ssh server status

Command Mode

Privileged EXEC

Default

None

Usage

None

Examples

The following example shows the current SSH configurations:

Switch# show ip ssh server status

SSH server enabled
Version: 1.99
Authentication timeout: 33 second(s)
Authentication retries: 6 time(s)
Server key lifetime: 60 minute(s)
Authentication type: password, public-key

Related Commands

show ip ssh server session

Command Purpose

To create a key by system, use the rsa key generate command in Global Configuration.

Prerequisites

Command Syntax

rsa key KEYNAME generate

Command Mode

Global Config

Default

None

Usage

Use the rsa key command to create a key by system.

Examples

The following example creates a key named KEY1:

Switch# configure terminal
Switch(config)# rsa key KEY1 generate

Generating RSA private key, 1024 bit long modulus
Please waiting for a moment: done!
Public exponent is 65537 (0x10001)
Generate RSA key successfully
Switch(config)#

Related Commands

show rsa keys

Command Purpose

To create a key, use the rsa key command in Global Config.

Prerequisites

Command Syntax

rsa key KEYNAME

Command Mode

Global Config

Default

None

Usage

Use the rsa key command to create a key.

Examples

The following example creates a key named KEY1:

Switch# configure terminal
Switch(config)# rsa key KEY1
Switch(config-rsa-key)#

Related Commands

show rsa keys

Command Purpose

To specify the key format, use the key format command in RSA key configuration mode.

Prerequisites

Command Syntax

key format ( der | pem )

Command Mode

Rsa Key Configuration

Default

The default key format is DER.

Usage

None

Examples

The following example specify the key format of KEY1 as der :

Switch# configure terminal
Switch(config)# rsa key KEY1
Switch(config-rsa-key)# key format der

Related Commands

rsa key

Command Purpose

To exit the rsa key configuration mode to Global Config and apply all rsa key configurations, use the key string end command in RSA key configuration mode.

Prerequisites

Command Syntax

key string end

Command Mode

Rsa Key Configuration

Default

None

Usage

None

Examples

The following example shows exit the rsa key configuration mode :

Switch# configure terminal
Switch(config)# rsa key KEY1
Switch(config-rsa-key)# key string end
Switch(config)#

Related Commands

rsa key

Command Purpose

To specify the key type, use the key type command in RSA key configuration mode.

Prerequisites

Command Syntax

key type ( public | private )

Command Mode

Rsa Key Configuration

Default

None

Usage

None

Examples

The following example specifies the key type of KEY1 as public key:

Switch# configure terminal
Switch(config)# rsa key KEY1
Switch(config-rsa-key)# key type public

Related Commands

rsa key

Command Purpose

To clear all key configurations, use the reset command in RSA key configuration mode.

Prerequisites

Command Syntax

reset

Command Mode

Rsa Key Configuration

Default

None

Usage

None

Examples

The following example shows to clear all configurations for the key KEY1:

Switch# configure terminal
Switch(config)# rsa key KEY1
Switch(config-rsa-key)# reset

Related Commands

rsa key

Command Purpose

To check the validation of the key strings, use the validate command in RSA key configuration mode.

Prerequisites

Command Syntax

validate

Command Mode

Rsa Key Configuration

Default

None

Usage

None

Examples

The following example shows to validate key strings of the key KEY1:

Switch# configure terminal
Switch(config)# rsa key KEY1
Switch(config-rsa-key)# validate

Related Commands

rsa key

Command Purpose

To add key strings from the screen directly, type any strings in RSA key configuration mode except the keywords in this mode.

Prerequisites

Command Syntax

KEYLINE

Command Mode

Rsa Key Configuration

Default

None

Usage

Type any key string.

Examples

The following example shows to type a key string of the key KEY1:

Switch# configure terminal
Switch(config)# rsa key KEY1
Switch(config-rsa-key)# 00302017 4A7D385B 1234EF29 335FC973
Switch(config-rsa-key)# 2DD50A37 C4F4B0FD 9DADE748 429618D5

Related Commands

validate

Command Purpose

To export the key file to a specified destination, use the rsa key export command in Global Config.

Prerequisites

Command Syntax

rsa key KEYNAME export url DEST_FILE ( public | private ) ( der | der-hex | pem | ssh1 | ssh2 )

Command Mode

Global Config

Default

None

Usage

Use the rsa key generate command to generate a key.

Examples

The following example shows to export the key KEY1 to flash as a public key:

Switch# configure terminal
Switch(config)# rsa key KEY1 export url flash:/key1.pub public ssh2

The following example shows to export the key KEY2 to flash as a private key:

Switch# configure terminal
Switch(config)# rsa key KEY2 export url flash:/key1 private ssh1

Related Commands

rsa key generate

rsa key import

Command Purpose

To import the key file from a specified source, use the rsa key import command in Global Config.

Prerequisites

Command Syntax

rsa key KEYNAME import url SRC_FILE ( public | private ) ( der | der-hex | pem | ssh1 | ssh2 )

Command Mode

Global Config

Default

None

Usage

Use the rsa key to generate command to generate a key.

Examples

The following example shows to import the key KEY1 to flash as a public key:

Switch# configure terminal
Switch(config)# rsa key KEY1 import url flash:/key1.pub public ssh2

The following example shows to import the key KEY2 to flash as a private key:

Switch# configure terminal
Switch(config)# rsa key KEY2 import url flash:/key1 private ssh1

Related Commands

rsa key generate

rsa key export

Command Purpose

To display the details of the keys, use the show rsa key command in Privileged EXEC mode.

Prerequisites

Command Syntax

show rsa key KEYNAME

Command Mode

Privileged EXEC

Default

None

Usage

None

Examples

The following example displays the detailed information of the key named “KEY1”:

Switch# show rsa key KEY1

RSA key information:
============================================================
Name: KEY1
Type: private
Modulus: 1024 bit
Usage count: 0
Private key DER code:
30820258
    0201
      00
  028180
   9B3E9726 6405BD54 692F172A901F3879 C947366E 5703D282 AA31707F 214D38C9

Related Commands

show rsa keys

Command Purpose

To display the brief information of all the keys, use the show rsa keys command in Privileged EXEC mode.

Prerequisites

Command Syntax

show rsa keys

Command Mode

Privileged EXEC

Default

None

Usage

Use the rsa key generate command to generate a key.

Examples

The following example displays the brief information of the keys:

Switch# show rsa keys

Name                              Type     Usage   Modulus
============================================================
key1                              private  0       1024
key2                              public   0       1024

Related Commands

show rsa key