How to disable Telnet and enable SSH

[Photogregor]

Hi,

on a 2960-S I found that SSH was not enabled, or at least not properly configured. I only could login via console and telnet. The one and only thing I changed then in running config was to add "transport input ssh2" to the section "line vty 0 4". But what happens now is that I cannot login via telnet neither. Only console login is left. I tried to figure it out, but this password / encryption stuff at Cisco is an impervious jungle to me and I don't want to lock myself out of this switch.

If anyone has an advice to me please see the running config below. The goal is to have encrypted (non readable) passwords, equal for SSH and Console, and no Telnet.

Thanks a lot,
Stefano

Switch#sh run
Building configuration...

Current configuration : 4181 bytes
!
! Last configuration change at 14:28:06 UTC Fri Jul 29 2016
! NVRAM config last updated at 09:32:16 UTC Fri Jul 1 2016
!
version 12.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Switch
!
boot-start-marker
boot-end-marker
!
no logging console
enable secret 5 $1$gfBh$F03uIBpoiUPOIu897$JKZ13IUh
enable password xyz
!
username admin privilege 15 password 0 xyz
!
!
no aaa new-model
clock timezone UTC 1
!
!
!
!
crypto pki trustpoint TP-self-signed-2957533696
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2957533696
revocation-check none
rsakeypair TP-self-signed-2957533696
!
!
crypto pki certificate chain TP-self-signed-2957533696
certificate self-signed 01
3082024C 308201B5 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
.
.
.
quit
spanning-tree mode pvst
spanning-tree extend system-id
!
!
!
!
vlan internal allocation policy ascending
!
!
interface FastEthernet0
no ip address
!
interface GigabitEthernet0/1
description Firewall eth8
switchport access vlan 2
!
interface GigabitEthernet0/2
description Accelerator 1/1
switchport access vlan 2
!
interface GigabitEthernet0/3
switchport access vlan 2
!
interface GigabitEthernet0/4
description BackupLink fa0/3
switchport access vlan 2
!
interface GigabitEthernet0/5
switchport access vlan 2
!
interface GigabitEthernet0/6
switchport access vlan 2
!
interface GigabitEthernet0/7
switchport access vlan 3
!
interface GigabitEthernet0/8
switchport access vlan 3
!
interface GigabitEthernet0/9
switchport access vlan 3
!
interface GigabitEthernet0/10
switchport access vlan 3
!
interface GigabitEthernet0/11
switchport access vlan 3
!
interface GigabitEthernet0/12
switchport access vlan 3
!
interface GigabitEthernet0/13
switchport access vlan 4
!
interface GigabitEthernet0/14
switchport access vlan 4
!
interface GigabitEthernet0/15
switchport access vlan 4
!
interface GigabitEthernet0/16
switchport access vlan 4
!
interface GigabitEthernet0/17
switchport access vlan 4
!
interface GigabitEthernet0/18
switchport access vlan 4
!
interface GigabitEthernet0/19
!
interface GigabitEthernet0/20
!
interface GigabitEthernet0/21
!
interface GigabitEthernet0/22
!
interface GigabitEthernet0/23
description Management
switchport mode access
!
interface GigabitEthernet0/24
!
interface GigabitEthernet0/25
!
interface GigabitEthernet0/26
!
interface Vlan1
ip address 192.168.1.4 255.255.255.0
!
interface Vlan4
no ip address
!
interface Vlan99
no ip address
!
ip default-gateway 192.168.1.1
ip http server
ip http secure-server
snmp-server community Rest RO
snmp-server community Full RW
!
line con 0
line vty 0 4
password xyz
login
transport input ssh
line vty 5 15
password xyz
login
transport input ssh
!
end

Switch#

[Karsten Iwen · Accepted solution]

Here is a guide for enabling SSH on your switch:

https://supportforums.cisco.com/document/12338141/guide-better-ssh-security

[Photogregor]

Hi,

thanks for input. Ok, when I do what is proposed in that link it would look like this (my IOS version is 12.2):

rtr(config)#crypto key generate rsa label SSH-KEY modulus 2048
rtr(config)#ip ssh rsa keypair-name SSH-KEY
rtr(config)#ip ssh version 2
rtr(config)#ip ssh dh min size 2048
rtr(config)#line vty 0 4
rtr(config)#transport input ssh
!
rtr(config)#username USER password PASS
rtr(config)#username USER algorithm-type sha256 secret VERYSECUREPASSWORD
rtr(config)#username USER secret VERYSECUREPASS
!

These settings would not interfere or collide with the current settings? My fear is to get locked out or of being forced to do a password reset which would cause some trouble here.

What I do not understand is the necessity to give users two passwords. In our case there is only one password for network devices, so I need to "invent" a second one, but for what purpose? I understand the difference between enable and config password - is it that what is meant above?

Last question: Are both passwords ("PASS" and "VERYSECUREPASS") encrypted if someone does a "show run"?

Thanks for your patience,
Stefano

[Karsten Iwen · Accepted solution]

rtr(config)#username USER password PASS
rtr(config)#username USER algorithm-type sha256 secret VERYSECUREPASSWORD
rtr(config)#username USER secret VERYSECUREPASS

you only configure one or the other. The first command would configure a cleartext password (which could be hidden with "service password-encryption"). The second command configures the user with the strongest to crack password. But your IOS won't support that command. The third command configures the password as a MD5 hash. That is what you want to use.

(Seems I have to rewrite that section on passwords a little bit more clearly)

[Photogregor]

Thanks to all of you, did not expect so much engagement for beginner questions. That was excellent for my understanding and with that I finally was able to setup what is needed (with fewer commands as expected):

no ip domain-lookup
interface Vlan1
ip address 192.168.1.2 255.255.255.0
no shutdown
!
ip default-gateway 192.168.1.1
!
ip domain-name test.com
crypto key generate rsa general-keys modulus 2048
! the old system does not allow more than 2048
!
username admin secret xyz
enable secret xyz
!
line vty 0 4
login local
transport input ssh
!
line con 0
login local

After that I indeed could login only via console or SSH, a user password and enable password was set and both where "view protected".

Regards,
Stefano

[mvknl]

What Karsten just said is correct. You would only need the last command (as you wouldn't want to have plain-text passwords in your config). Service password-encryption can be used to hide the plain-text password, but that is still insecure. You should always use the secret commands.

The rest of your configuration should work. You don't actually need the "ip ssh dh min size 2048" command. It will work without it.

What you do need to do before you configure SSH is configuring a hostname and a domain name on the switch. So the following should be done:

hostname SOMEHOSTNAME

ip domain name SOMEDOMAINNAME.COM

If you're afraid that your config will lock you out you can schedule a reboot with the "reload in" or "reload at" command. If the configuration you applied works you can cancel the reboot with the "reload cancel" command. 

[Karsten Iwen]

You don't actually need the "ip ssh dh min size 2048" command. It will work without it.

Well, there is very much not needed. But it'll make the SSH-setup more secure.

What you do need to do before you configure SSH is configuring a hostname and a domain name on the switch

That is actually also not needed in this setup.

[mvknl]

I haven't seen a switch that didn't require a hostname and a domain name before generating a RSA key yet, but I believe you :-)

the ip ssh dh min size command will make it more secure, but also more difficult to manage (since like you say some tools won't be able to cope with it). Depending on the environment in which it is used that can be a reason not to use the command. Although I agree with you on the 'bigger is better' sentiment and the fact that DH 768 isn't state of the art anymore, breaking DH 768 is still a big challenge. Research has shown that a properly prepared attack is able to break DH 512 in a minute, DH 768 is still another cup of tea (but perfectly capable for anybody willing to invest in it). If Gregor is able to use stronger crypto in his environment he should definitely do it, but he should not do it without taking notice of the increased administrational challenges.

The paper itself is an interesting read: https://weakdh.org/imperfect-forward-secrecy-ccs15.pdf 

[Karsten Iwen]

The host/domain-name is not needed because the key has a label. Without a label you are correct, then it's needed to specify the host/domain-name.

I've never had any issues with a 2048 bit DH in SSH regardless of the client. Only 4096 Bit caused some trouble with older Putty-versions. I'm pretty sure 2048 ist safe for production without any administrative burden.

[ahmedshoaib]

Hi,

Karsten is absolutely right about password:

The first command would configure a cleartext password (which could be hidden with "service password-encryption").

The second command configures the user with the strongest to crack password. But your IOS won't support that command. The third command configures the password as a MD5 hash. Which is recommended to use.

With reference to your query, you can define only one password (either with plain text one or md5 one). No need to configure multiply password.

In any case if you loss the password you need to do password recovery procedure.

Thanks & Best regards.

[mvknl]

The command "transport input ssh2" effectively disabled Telnet because you only allow SSH on the VTY's. (Actually this should be what you want as Telnet is insecure). The guide Karsten posted is a very good one to solve your problems.