SSH on a different port.........

[DAVID RICHWALSKI]

HI...

I run SSH on a DIFFERENT PORT so I can access the router from (INTERNAL NETWORK)  and (REMOTELY INTERNET)......from PC or my ANDROID

PROBLEM: when I do a PORT SCAN.......the SSH PORT shows as "OPEN"

QUESTION:  How can I SECURE the SSH PORT and still have access BOTH .......INSIDE and OUTSIDE ???

I run SSH 2.0 only......

Here are the relevant parts of the config file.........

ip ssh authentication-retries 5
ip ssh port xxxx rotary 1
ip ssh logging events
ip ssh version 2

access-list 101 remark ---SSH---
access-list 101 permit tcp any any eq xxxx log

The above ACL is applied to the EXTERNAL (INTERNET) interface

line vty 0 4
exec-timeout 20 0
privilege level 15
password 7 xxxxxxxxxxxxx
login authentication local_auth
rotary 1
transport preferred ssh
transport input ssh
transport output ssh

[Karsten Iwen]

Although you still could strengthen your SSH, the config is what has to be done to make SSH work on a different port. And that is all it does, it does not secure SSH, it will just clean up the logs a little bit.

If there is still access on TCP/22, then I would suspect that there are other lines in your external ACL that allow that.