May I disable "ip http secure-server" if I have SSH configured?

[ccnaluna93]

Hello,

In order to activate SSH I have configured "ip http secure-server" command to generate some kind of a crypto key or certification, then I disable that command and SSH still works, but I don´t know if SSH will work after a reload, I cannot test because it is a production router.

Do you know about this?

Thanks in advance!

[Reza Sharifi]

Hi,

"ip http secure-server" is for HTTPs authentication to the device. It uses port 443.

SSH is a different protocol and uses port 22. There is no need to enable "ip http secure-server" if you are using SSH only.

HTH

[Joseph W. Doherty]

It's as Reza notes.

(We have many Cisco devices that support SSH but have disabled http and https. They continue to do so across reloads.)

[ccnaluna93]

But SSH doesn't work If I don't enable the "ip http secure-server"command on router.

This is the result of the command:

AUTLAN_R01(config)#ip http secure-server
% Generating 1024 bit RSA keys, keys will be non-exportable...
[OK] (elapsed time was 2 seconds)

AUTLAN_R01(config)#

After using this command I can get into the router by ssh, and I can enable SSH version 2.

[paul driver]

Hello

---

@ccnaluna93 wrote:

But SSH doesn't work If I don't enable the "ip http secure-server"command on router.

After using this command I can get into the router by ssh, and I can enable SSH version 2.

---

You mean it doesn't work for https access? - as others have stated you shouldnt need to have ip http secure-server enabled.

What is required :|

ip domain-name xxxx
crypto key generate rsa general-keys modulus 1024/2048

line vty 0 x
transport input ssh

res
Paul

[Reza Sharifi]

Ok, if you are trying to access it for the first time, you can use https to gain access to the switch and then enable ssh and turn off https. You can also use telnet and then once the SSH is enabled, you can disable telnet.

HTH

[Karsten Iwen]

Some time ago I wrote a little guide on how to setup SSH in a more secure fashion. All you need is included and there are no needs to also enable HTTPS:

https://supportforums.cisco.com/t5/security-documents/guide-to-better-ssh-security/ta-p/3133344

[Georg Pauwen · Accepted solution]

Hello,

on a side note and in addition to the other posts, I think your 'confusion' comes from the fact that enabling 'ip http secure-server' automatically generates the RSA key that is also required by SSH:

R4(config)#ip http secure-server
% Generating 1024 bit RSA keys, keys will be non-exportable...

R4(config)#
*Nov 29 19:01:22.986: %SSH-5-ENABLED: SSH 1.99 has been enabled

The RSA key can also be generated by issuing the command:

crypto key generate rsa general-keys modulus 1024 (or 2048)

without enabling 'ip http secure-server'.

So, you don't need to enable 'ip http secure-server' at all to use SSH, just generate the RSA key with the 'crypto key generate' command as mentioned above.

Does that make sense ?

[ccnaluna93]

Thanks all! 

So I can disable HTTPs once the command has created the RSA key, right?

[Joseph W. Doherty]

Yes.