How to disable SSH on Cisco Aironet 28xx

[bvj197222]

All of my AP's have SSH enabled:

xxx#sh running-config
AP Name : xxx-AP1
Admin State : Enabled
AP Mode : FlexConnect
AP Submode : Not Configured
Location : xxx
Primary controller name : XXXWLCXXXX
Primary controller IP : x.x.x.x
Secondary controller name :
Tertiary controller name :
Controller from DHCP offer : x.x.x.x
AP join priority : 1
IP Prefer-mode : IPv4
CAPWAP UDP-Lite : Unconfigured
Last Joined Controller name: XXXXXXXX
DTLS Encryption State : Disabled
Discovery Timer : 10
Heartbeat Timer : 30
CDP State : Enabled
Watchdog monitoring : Enabled
IOX : Disabled
RRM State : Enabled
LSC State : Disabled
SSH State : Enabled
AP Username : admin
Session Timeout : 300
Extlog Host : 255.255.255.255
Extlog Flags : 0
Extlog Status Interval : 0
Syslog Host : 255.255.255.255
Syslog Facility : 0
Syslog Level : informational
Core Dump File Compression : Disabled
Core Dump Filename :
Client Trace Status : Enabled(All)
Client Trace All Clients : Enabled
Client Trace Filter : 0x0000000E
Client Trace Out ConsoleLog: Disabled
AP WSA Mode : Disabled
Auxiliary-client Interface : Disabled

For security reasons I want to disable SSH on AP's, but I don't know how? Been reading various articles but all of them requires me logging into the AP and do it manually. We have more than 200 AP's so that's not an option. It must be possible to turn it off on the WLC? We're running Cisco Catalyst 9800-CL Wireless Controller, ver 17.9.4a

[marce1000 · Accepted solution]

  - Somewhere in the AP Join profile , this access can be specified and or disabled too (together with telnet)
     don't know the exact menu for the moment , guess you can find it quickly , 

 M.

[bvj197222 · Accepted solution]

You're absolutely right: 

[marce1000]

   - From CLI that would be :
                 config #  ap profile  <your-ap-profle-here>
                                    no ssh
                                    exit

                (don't forget to save the configuration)

 M.