Feedback
Contents
ip source-track through ivrf
- ip ssh
- ip ssh dh min size
- ip ssh dscp
- ip ssh pubkey-chain
- ip ssh stricthostkeycheck
- ip ssh version
- ipv6 tacacs source-interface
ip ssh
To configure Secure Shell (SSH) control parameters on your router, use the ip ssh command in global configuration mode. To restore the default value, use the no form of this command.
ip ssh [ timeout seconds | authentication-retries integer ]
no ip ssh [ timeout seconds | authentication-retries integer ]
Syntax Description
timeout
(Optional) The time interval that the router waits for the SSH client to respond.
This setting applies to the SSH negotiation phase. Once the EXEC session starts, the standard timeouts configured for the vty apply. By default, there are 5 vtys defined (0-4), therefore 5 terminal sessions are possible. After the SSH executes a shell, the vty timeout starts. The vty timeout defaults to 10 minutes.
seconds
(Optional) The number of seconds until timeout disconnects, with a maximum of 120 seconds. The default is 120 seconds.
authentication- retries
(Optional) The number of attempts after which the interface is reset.
integer
(Optional) The number of retries, with a maximum of 5 authentication retries. The default is 3.
Command History
Release
Modification
12.0(5)S
This command was introduced.
12.1(1)T
This command was integrated into Cisco IOS Release 12.1(1) T.
12.2(17a)SX
This command was integrated into Cisco IOS Release 12.2(17a)SX.
12.2(33)SRA
This command was integrated into Cisco IOS release 12.(33)SRA.
Cisco IOS XE Release 2.4
This command was implemented on the Cisco ASR 1000 series routers.
ip ssh dh min size
To configure the modulus size on the Secure Shell (SSH) server, use the ip ssh dh min size command in privileged EXEC mode. To disable the configuration, use the no form of this command.
Usage Guidelines
Use the ip ssh dh min sizecommand to ensure that the CLI is successfully parsed from either the client side or the server side.
ip ssh dscp
To specify the IP differentiated services code point (DSCP) value that can be set for a Secure Shell (SSH) configuration, use the ip ssh dscpcommand in global configuration mode. To restore the default value, use the no form of this command.
Command History
Release
Modification
12.4(20)S
This command was introduced.
12.2SR
This command is supported in the Cisco IOS Release 12.2SR train. Support in a specific 12.2SR train depends on your feature set, platform, and platform hardware.
12.2SX
This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX train depends on your feature set, platform, and platform hardware.
12.4(22)T
This command was integrated into Cisco IOS Release 12.4(22)T.
Usage Guidelines
IP DSCP values can be configured on both the SSH client and the SSH server for SSH traffic that is generated on either end.
ip ssh pubkey-chain
To configure Secure Shell RSA (SSH-RSA) keys for user and server authentication on the SSH server, use the ip ssh pubkey-chain command in global configuration mode. To remove SSH-RSA keys for user and server authentication on the SSH server, use the no form of this command.
Usage Guidelines
Use the ip ssh pubkey-chaincommand to ensure SSH server and user public key authentication.
ip ssh stricthostkeycheck
To enable strict host key checking on the Secure Shell (SSH) server, use the ip ssh stricthostcheck command in global configuration mode. To disable strict host key checking, use the no form of this command.
Usage Guidelines
Use the ip ssh stricthostkeycheckcommand to ensure SSH server side strict checking. Configuring the ip ssh stricthostkeycheck command authenticates all servers.
NoteThis command is not available on SSH Version 1.
- If the ip ssh pubkey-chain command is not configured, the ip ssh stricthostkeycheck command will lead to connection failure in SSH Version 2.
ip ssh version
To specify the version of Secure Shell (SSH) to be run on a router, use the ip ssh versioncommand in global configuration mode. To disable the version of SSH that was configured and to return to compatibility mode, use the no form of this command.
Command Default
If this command is not configured, SSH operates in compatibility mode, that is, Version 1 and Version 2 are both supported.
Command History
Release
Modification
12.3(4)T
This command was introduced.
12.3(2)XE
This command was integrated into Cisco IOS Release 12.3(2)XE.
12.2(25)S
This command was integrated into Cisco IOS Release 12.2(25)S.
12.3(7)JA
This command was integrated into Cisco IOS Release 12.3(7)JA.
12.0(32)SY
This command was integrated into Cisco IOS Release 12.0(32)SY.
12.4(20)T
This command was integrated into Cisco IOS Release 12.4(20)T.
Usage Guidelines
You can use this command with the 2 keyword to ensure that your router will not inadvertently establish a weaker SSH Version 1 connection.
Examples
The following example shows that only SSH Version 1 support is configured:
Router (config)# ip ssh version 1The following example shows that only SSH Version 2 is configured:
Router (config)# ip ssh version 2The following example shows that SSH Versions 1 and 2 are configured:
Router (config)# no ip ssh versionRelated Commands
Command
Description
debug ip ssh
Displays debug messages for SSH.
disconnect ssh
Terminates a SSH connection on your router.
ip ssh
Configures SSH control parameters on your router.
ip ssh rsa keypair-name
Specifies which RSA key pair to use for a SSH connection.
show ip ssh
Displays the SSH connections of your router.
ipv6 tacacs source-interface
To specify an interface to use for the source address in TACACS packets, use the ipv6 tacacs source-interfacecommand in global configuration mode. To remove the specified interface from the configuration, use the no form of this command.
Usage Guidelines
The ipv6 tacacs source-interfacecommand specifies an interface to use for the source address in TACACS packets.
