topic Re: AAA not working for telnet or SSH, works for HTTP - Cat 3750G in Switching

AAA not working for telnet or SSH, works for HTTP - Cat 3750G

OldGreyBeast — Thu, 15 Jun 2023 19:04:34 GMT

I know it's old, but I've got 2 48p Catalyst 3750Gs running IOS 15. I've setup SSH on cat switches before without issue but for some reason this one is just being super resistant. I can log in with my user account to the HTTP interface without any issues, but it says login failed for both SSH and telnet. I've generated the rsa keys and whatnot, putty connects just fine, it just always says that authentication failed. It does this with both accounts i've added. Both accounts work fine on HTTP.

version 15.0
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname house-cat3750G
!
boot-start-marker
boot-end-marker
!
no logging console
enable secret 5 [redacted]
!
username [redacted] secret 5 [redacted]
username [redacted] secret 5 [redacted]
aaa new-model
!
!
aaa authorization exec default local
!
!
aaa session-id common
clock timezone UTC -6 0
clock summer-time UTC recurring
switch 1 provision ws-c3750g-48ps
system mtu routing 1500
ip domain-name DOMAIN.com
!
!
!
[interface/crypto key configs removed to save space]

!
interface Vlan99
ip address 10.10.10.1 255.255.255.0
no ip route-cache
!
ip default-gateway 10.10.10.254
ip http server
ip http secure-server
!
!
!
!
!
vstack
!
line con 0
line vty 0 4
session-timeout 28800
password 7 [redacted]
transport input telnet ssh
transport output telnet ssh
line vty 5 15
session-timeout 28800
password 7 [redacted]
transport input telnet ssh
transport output telnet ssh
!
end

Re: AAA not working for telnet or SSH, works for HTTP - Cat 3750G

MHM Cisco World — Thu, 15 Jun 2023 19:17:47 GMT

aaa authentication login default local <<- this for telnet
for SSH
you need ip domain-name and RSA before you can access via SSH
https://www.cisco.com/c/en/us/support/docs/security-vpn/secure-shell-ssh/4145-ssh.html

NOTE:- you need username xxx password xxx and enable password xxx before enable auth via aaa

Re: AAA not working for telnet or SSH, works for HTTP - Cat 3750G

OldGreyBeast — Thu, 15 Jun 2023 19:19:25 GMT

Hi, yes I've already done the ip domain-name and RSA.

Re: AAA not working for telnet or SSH, works for HTTP - Cat 3750G

MHM Cisco World — Thu, 15 Jun 2023 19:21:39 GMT

Aaa auth login is missing

Re: AAA not working for telnet or SSH, works for HTTP - Cat 3750G

OldGreyBeast — Thu, 15 Jun 2023 19:25:06 GMT

Ok, I added:
aaa authentication login default local

No change in behavior though.

Re: AAA not working for telnet or SSH, works for HTTP - Cat 3750G

MHM Cisco World — Thu, 15 Jun 2023 19:30:17 GMT

Same then try

Add under line vty

Re: AAA not working for telnet or SSH, works for HTTP - Cat 3750G

OldGreyBeast — Thu, 15 Jun 2023 19:32:25 GMT

Ok, added that. Still no change in behavior 😞

Re: AAA not working for telnet or SSH, works for HTTP - Cat 3750G

MHM Cisco World — Thu, 15 Jun 2023 19:37:14 GMT

Username xxx previllige 15 password xxx << - add this

Re: AAA not working for telnet or SSH, works for HTTP - Cat 3750G

OldGreyBeast — Thu, 15 Jun 2023 19:42:55 GMT

so after adding the aaa authentication login default local I lost the ability to login via the serial cable (which is why I didn't have that line in the config initially). Switch is rebooting to undo the aaa auth at the moment.

Re: AAA not working for telnet or SSH, works for HTTP - Cat 3750G

MHM Cisco World — Thu, 15 Jun 2023 19:51:19 GMT

Sorry can you elaborate more' how aaa auth effect access via console ?

Re: AAA not working for telnet or SSH, works for HTTP - Cat 3750G

OldGreyBeast — Thu, 15 Jun 2023 20:09:12 GMT

It will prompt for a username and password at the serial connection.

Neither of the usernames/passwords specified will work. I'm not able to leave the username blank and use the enable password.

Re: AAA not working for telnet or SSH, works for HTTP - Cat 3750G

OldGreyBeast — Thu, 15 Jun 2023 20:12:20 GMT

Ok, switch rebooted. I added the aaa authentication line /only/ under vty 0 15. This still doesn't allow login.

I deleted the second user and added a new user:
username admin password 0 admin priv 15

Still unable to login.

Re: AAA not working for telnet or SSH, works for HTTP - Cat 3750G

MHM Cisco World — Thu, 15 Jun 2023 20:13:07 GMT

username [redacted] secret 5 [redacted]
username [redacted] secret 5 [redacted] <<- these not work

Re: AAA not working for telnet or SSH, works for HTTP - Cat 3750G

OldGreyBeast — Thu, 15 Jun 2023 20:15:38 GMT

Correct, neither account works.

Re: AAA not working for telnet or SSH, works for HTTP - Cat 3750G

MHM Cisco World — Thu, 15 Jun 2023 20:21:01 GMT

Just one second'

You can access via console and do config ?

But still can not access via telnet and ssh ?

Re: AAA not working for telnet or SSH, works for HTTP - Cat 3750G

OldGreyBeast — Thu, 15 Jun 2023 20:24:22 GMT

Sorry I missed this reply. Yes, after rebooting the switch (which reverted the aaa auth) I am able to access the console port without credentials and make config changes.

If I add the aaa authentication line back, username/password is required via the serial console and I'm unable to log in due to it not accepting the credentials.

Re: AAA not working for telnet or SSH, works for HTTP - Cat 3750G

MHM Cisco World — Thu, 15 Jun 2023 20:34:31 GMT

aaa need
aaa authentication login default local
NO aaa authorization exec default local
username mhm privilege 15 password mhm
enable password mhm

under the line of vty
login authenation default

NOTE:- please dont copy run to start, in case this config not work you can access via console

Re: AAA not working for telnet or SSH, works for HTTP - Cat 3750G

OldGreyBeast — Thu, 15 Jun 2023 20:46:09 GMT

Ok, I followed the steps above (including creating the mhm account). I'm unable to login via SSH or telnet. I'm also now unable to access the console again. All 3 of these accounts are very simple (jason/jason, admin/admin, mhm/mhm) so I know I'm not mis-keying the passwords.

Re: AAA not working for telnet or SSH, works for HTTP - Cat 3750G

OldGreyBeast — Thu, 15 Jun 2023 20:49:47 GMT

Do you think I should drop this switch back to 12.2?

Re: AAA not working for telnet or SSH, works for HTTP - Cat 3750G

MHM Cisco World — Thu, 15 Jun 2023 20:54:33 GMT

Give me half hour I will try config in my lab.

Thanks

MHM