topic Re: SSH Authentication in Wireless

SSH Authentication

amh4y0001 — Mon, 05 Jul 2021 16:30:29 GMT

Hi,

I am unable to SSH Cisco 890 ISR. user /password I am sure is correct. Any thoughts?

Here is the output for the sh ip ssh

sh ip ssh
SSH Enabled - version 2.0
Authentication methods:publickey,keyboard-interactive,password
Encryption Algorithms:aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
MAC Algorithms:hmac-sha1,hmac-sha1-96
Authentication timeout: 120 secs; Authentication retries: 3
Minimum expected Diffie Hellman key size : 1024 bits
IOS Keys in SECSH format(ssh-rsa, base64 encoded):
ssh-rsa AAAAB-------v2qQ==

And here is partial output of the sh running:

line con 0
no modem enable
line aux 0
line vty 0 4
login local
transport input ssh
line vty 5 189
login local
transport input ssh
!
scheduler allocate 20000 1000

Re: SSH Authentication

Mark Elsen — Tue, 27 Nov 2018 10:21:17 GMT

- The first iteration is what does unable to SSH mean ? Is there an error, if so which one, if anything else happens, then describe it.

Re: SSH Authentication

amh4y0001 — Tue, 27 Nov 2018 10:58:48 GMT

Unable to connect / authenticate.

Authentication Failed. Please retry.

Re: SSH Authentication

Ric Beeching — Tue, 27 Nov 2018 12:48:19 GMT

have you configured a domain-name for the router and then generated an SSH crypto key?
e.g.
conf t
ip domain-name test.com
exit
crytpo key generate rsa
1024
end

Alternatively, check telnet works first before troubleshooting ssh:
conf t
line vty 0 4
transport input telnet ssh
end

Re: SSH Authentication

amh4y0001 — Wed, 28 Nov 2018 08:57:05 GMT

Hi,

Thanks for reply.

I have confirmed that ip domain name exists and the key were generated with 1024 as well.

Checked with telnet and its failed as Login Failed.

I have created SSH user with following command:

username admin secret MySSHPassword

crypto key generate rsa : 1024

Re: SSH Authentication

Ric Beeching — Wed, 28 Nov 2018 10:13:24 GMT

Can you attach the full config with sensitive info removed?

Cheers,
Ric

Re: SSH Authentication

amh4y0001 — Thu, 29 Nov 2018 11:29:29 GMT

Thanks, I have attached the config.

Re: SSH Authentication

Ric Beeching — Wed, 28 Nov 2018 12:39:10 GMT

Looks good as far as I know.. is it possible for a firewall to be blocking or is it connected without one? Can you ping that interface from a workstation and ping workstation from router? Basic steps I know.. other thing to check is whether port is open from PC so try a simple telnet from command prompt (need to enable service in windows) and see if that establishes a session. That helps you determine if the workstation can even reach the router on that port to begin with.

Ric

Re: SSH Authentication

amh4y0001 — Wed, 28 Nov 2018 15:47:54 GMT

Hi,

I can ping the host from client and router can ping the client as well.

Its very strange that it saying invalid login. I have verified several time that I am typing user / password correctly.

Re: SSH Authentication

Mark Elsen — Wed, 28 Nov 2018 18:10:22 GMT

- As a sanity check -> configure a different username and password on the device and try again,

Re: SSH Authentication

amh4y0001 — Thu, 29 Nov 2018 11:28:55 GMT

Ok, problem solved. user name was "admin" changing user name to something else did the trick. Thanks all for suggestions.

Re: SSH Authentication

amh4y0001 — Thu, 29 Nov 2018 11:49:21 GMT

Perhaps should be a separate thread, but I have a 2nd router where the ISP address is via DHCP (I have not configured WAN static address). In this case, how I can SSH? Which IP Address?

Re: SSH Authentication

amh4y0001 — Thu, 29 Nov 2018 14:05:16 GMT

Hi,

When we use WAN link with DHCP (no static IP), how we can SSH to it? I tried with host name but it didn't worked. An thoughts?

Re: SSH Authentication

patoberli — Thu, 29 Nov 2018 14:57:15 GMT

You need to do something like this (dynamic hostname):
https://www.howtogeek.com/66438/how-to-easily-access-your-home-network-from-anywhere-with-ddns/