Configuring SSH

You configure SSH on individual virtual routers, rather than on the global system. You must obtain and install a commercial SSH client on the host from which you want to administer the system. Versions earlier than 2.0.12 of the SSH client are not supported.

Determine your Telnet policy before you configure SSH on your system. Effective use of SSH implies that you should severely limit Telnet access to the system. To limit Telnet access, create access control lists that prevent almost all Telnet usage, permitting only trusted administrators to access the system through Telnet. For example, you might limit access to administrators who need to Telnet to the system from a remote host that does not have the SSH client installed.

You must install and configure a RADIUS server on a host machine before you configure SSH on your router. Refer to your RADIUS server documentation for information about choosing a host machine and installing the server software. You must also configure the RADIUS client on your router. See JunosE Broadband Access Configuration Guide for more information. To configure SSH:

  1. Access the context of the virtual router.
  2. Configure encryption. (Optional)
  3. Configure user authentication, including connection parameters.
  4. Configure message authentication. (Optional)
  5. Enable SSH.
  6. Display SSH to verify configuration.

This topic includes the following tasks:

Configuring Encryption

The embedded SSH server and external SSH client maintain separate lists of the encryption algorithms that each supports. Lists are kept for inbound and outbound algorithms. For the server:

You must configure each list separately. By default, all of the supported encryption algorithms are available. You need to configure encryption only if you need to specifically remove or add any supported algorithm from the list. Refer to your SSH client documentation for details on configuring encryption on your client. The system supports the following SSH algorithms for encryption:

The following tasks show how to add, remove, and restore SSH algorithms for encryption:

Although it is not recommended, you can also specify none. In this case, the system does not perform encryption.

Configuring User Authentication

The router supports RADIUS and TACACS+ for user authentication. RADIUS authentication is enabled by default. You must have previously configured a RADIUS or a TACACS+ server on a host system and its respective client (RADIUS or TACACS+) on your system.

Note: SSH user authentication through RADIUS or TACACS+ is supported only on the default router.

You can specify timeout and retry limits to control the SSH connection process. The limits apply only from the time the user first tries to connect until the user has been successfully authenticated. The timeout limits are independent of any limits configured for virtual terminals (vtys). The following limits are supported:

Configuring Message Authentication

The SSH server and SSH client maintain separate lists of the message authentication algorithms that each supports. Lists are kept for inbound and outbound algorithms. For the server, inbound means the algorithms that the server supports for information coming in from a client. For the server, outbound means the algorithms that the server supports for information it sends out to a client. You must configure each list separately. By default, all of the supported encryption algorithms are available. You need to configure encryption only if you need to specifically remove or add any supported algorithm from the list. The system supports the following SSH algorithms for hash function-based message authentication:

The default version restores the specified list to the factory default, which includes all supported algorithms (hmac-md5, hmac-sha1, and hmac-sha1-96). The default list does not include the none option.

host1(config)#ip ssh mac client-to-server default hmac-sha1 host1(config)#ip ssh mac server-to-client hmac-md5

Although it is not recommended, you can also specify none. In this case, the system does not verify the integrity of the data.

Enabling and Disabling SSH

Note: SSH can be enabled or disabled regardless of the state of the Telnet daemon. If SSH is enabled, use access control lists to limit access through Telnet. See Setting Virtual Terminal Access Lists for information about using access control lists.

The SSH server daemon starts only if the server host key exists when the router boots. The host key resides in NVS and is persistent across system reboots. After it has started, the daemon listens for traffic on TCP port 22. The server daemon is disabled by default.

The command is not displayed by the show configuration command. There is no no version

Terminating an SSH Session

You can use the session identifier to terminate an SSH session. Use the show ip ssh command to determine the session identifier for the session to terminate.

There is no no version.

Related Documentation