SSH disabled on WS-C2960C-8PC-L

[Dmitriy Ivanov]

Hi,

Bought switch via Amazon. 

c2k9-ff-05-1#sh ver
Cisco IOS Software, C2960C Software (C2960c405-UNIVERSALK9-M), Version 15.2(3)E2, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2015 by Cisco Systems, Inc.
Compiled Tue 21-Jul-15 13:37 by prod_rel_team

ROM: Bootstrap program is C2960C boot loader
BOOTLDR: C2960C Boot Loader (C2960c405-HBOOT-M) Version 12.2(55r)EX9, RELEASE SOFTWARE (fc1)

c2k9-ff-05-1 uptime is 17 minutes
System returned to ROM by power-on
System image file is "flash:/c2960c405-universalk9-mz.152-3.E2.bin"
Last reload reason: Unknown reason

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

License Level: lanbase
License Type: Permanent
Next reload license Level: lanbase

cisco WS-C2960C-8PC-L (PowerPC405) processor (revision F0) with 131072K bytes of memory.
Processor board ID FOC1911Z3JQ
Last reset from power-on
2 Virtual Ethernet interfaces
8 FastEthernet interfaces
2 Gigabit Ethernet interfaces
The password-recovery mechanism is enabled.

64K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address       : 88:90:8D:12:B8:80
Motherboard assembly number     : 73-13529-03
Power supply part number        : 341-0407-01
Motherboard serial number       : FOC19111SH0
Power supply serial number      : DCB190520H9
Model revision number           : F0
Motherboard revision number     : A0
Model number                    : WS-C2960C-8PC-L
System serial number            : FOC1911Z3JQ
Top Assembly Part Number        : 800-35234-01
Top Assembly Revision Number    : K0
Version ID                      : V01
CLEI Code Number                : CMMGC00ARA
Hardware Board Revision Number  : 0x01

Switch Ports Model                     SW Version            SW Image
------ ----- -----                     ----------            ----------
*    1 10    WS-C2960C-8PC-L           15.2(3)E2             C2960c405-UNIVERSALK9-M

Configuration register is 0xF

We see it is K9- ssh should be included.

This is in config:

line con 0
 password ***
 login local
 stopbits 1
line vty 0 4
 access-class 10 in
 password ***
 login local
 transport input all
line vty 5 15
 login
 transport input all
!
end

as per manual I done this:

1. enable

2. configure terminal

3. hostname hostname

4. ip domain-name domain_name

5. crypto key generate rsa

6. end

7. show running-config

and after all these troubles  we have this:

c2k9-ff-05-1#sh ip ssh
SSH Disabled - version 1.5
%Please create RSA keys to enable SSH (and of atleast 768 bits for SSH v2).
Authentication methods:publickey,keyboard-interactive,password
Encryption Algorithms:aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
MAC Algorithms:hmac-sha1,hmac-sha1-96
Authentication timeout: 120 secs; Authentication retries: 3
Minimum expected Diffie Hellman key size : 1024 bits
IOS Keys in SECSH format(ssh-rsa, base64 encoded): NONE
c2k9-ff-05-1#

Any advise?

Thanks a lot !

[Karsten Iwen]

For a long time, the "crypto key generate" command by default generated 512 bit keys which is too small for SSH. I thought, the default was increase to 1024 Bit some time ago, but as you are running a quite recent IOS, probably the default was not changed for your platform.

For enabling SSH also see the following document:

https://supportforums.cisco.com/document/12338141/guide-better-ssh-security

[Dmitriy Ivanov]

generated key with 1024 modulus- same thing- it says: 

c2k9-ff-05-1#sh ip ssh
SSH Disabled - version 1.5

I tried both ssh v1 and v2- with different size of key- same result - ssh disabled.

see this:

c2k9-ff-05-1(config)#crypto key generate rsa modulus 1024
% You already have RSA keys defined named c2k9-ff-05-1.undp.org.
% They will be replaced.

% The key modulus size is 1024 bits
% Generating 1024 bit RSA keys, keys will be non-exportable...
[OK] (elapsed time was 3 seconds)

c2k9-ff-05-1(config)#do sh ip ssh
SSH Disabled - version 1.5
%Please create RSA keys to enable SSH (and of atleast 768 bits for SSH v2).
Authentication methods:publickey,keyboard-interactive,password
Encryption Algorithms:aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
MAC Algorithms:hmac-sha1,hmac-sha1-96
Authentication timeout: 120 secs; Authentication retries: 3
Minimum expected Diffie Hellman key size : 1024 bits
IOS Keys in SECSH format(ssh-rsa, base64 encoded): NONE
c2k9-ff-05-1(config)#

Thank you!

[Karsten Iwen · Accepted solution]

Have you tried using the labeled keys?

[Dmitriy Ivanov]

How I do that? I followed the manual (starting from page 290)

http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/15-2_3_e/consolidated_guide/b_1523e_2960p_2960c_cg/b_1522e_2960_2960c_2960s_2960sf_2960p_cg_chapter_0101100.html

did not work so far. It says "ssh disabled" (above)

[Karsten Iwen · Accepted solution]

https://supportforums.cisco.com/document/12338141/guide-better-ssh-security

[Dmitriy Ivanov]

YES YES AND YES!

You article is really works! Thanks a lot!!!!

c2k9-ff-05-1(config)#crypto key generate rsa label SSH-KEY modulus 1024
% You already have RSA keys defined named SSH-KEY.
% They will be replaced.

% The key modulus size is 1024 bits
% Generating 1024 bit RSA keys, keys will be non-exportable...
[OK] (elapsed time was 2 seconds)

c2k9-ff-05-1(config)#ip ssh rsa keypair-name SSH-KEY
c2k9-ff-05-1(config)#do sh ip ssh
SSH Enabled - version 1.99

[creza]

Thanks !!!!!

---

@Dmitriy Ivanov wrote:

YES YES AND YES!

You article is really works! Thanks a lot!!!!

c2k9-ff-05-1(config)#crypto key generate rsa label SSH-KEY modulus 1024
% You already have RSA keys defined named SSH-KEY.
% They will be replaced.

% The key modulus size is 1024 bits
% Generating 1024 bit RSA keys, keys will be non-exportable...
[OK] (elapsed time was 2 seconds)

c2k9-ff-05-1(config)#ip ssh rsa keypair-name SSH-KEY
c2k9-ff-05-1(config)#do sh ip ssh
SSH Enabled - version 1.99

---

[Dmitriy Ivanov]

Karsten- thank you- following your article- will let you know how it goes. 

[Dmitriy Ivanov]

Interesting observation:

On 4500 switch it says

c4k5#sh ip ssh
SSH Enabled - version 1.99
Authentication timeout: 120 secs; Authentication retries: 3
Minimum expected Diffie Hellman key size : 1024 bits
IOS Keys in SECSH format(ssh-rsa, base64 encoded):
ssh-rsa AAAA..ke....

as you see on another switch we have IOS KEYS in SECSH format and it is working there...

my assumption is that 

"crypto key generate rsa" _must_ create the key in SECSH but it does not happen...

[Karsten Iwen]

> my assumption is that 
> "crypto key generate rsa" _must_ create the key in SECSH but it does not happen...

It just says that the router doesn't have a key to use. The format is always the same.