Same for:
- 11.3.6 Packet Tracer - Configure SSH
- 28.3.6 Packet Tracer - Configure SSH
1.3.6 Packet Tracer – Configure SSH (Instructor Version)
Addressing Table
| Device | Interface | IP Address | Subnet Mask |
|---|---|---|---|
| S1 | VLAN 1 | 10.10.10.2 | 255.255.255.0 |
| PC1 | NIC | 10.10.10.10 | 255.255.255.0 |
Objectives
- Part 1: Secure Passwords
- Part 2: Encrypt Communications
- Part 3: Verify SSH Implementation
Background
SSH should replace Telnet for management connections. Telnet uses insecure plain text communications. SSH provides security for remote connections by providing strong encryption of all transmitted data between devices. In this activity, you will secure a remote switch with password encryption and SSH.
Instructions
Part 1: Secure Passwords
a. Using the command prompt on PC1, Telnet to S1. The user EXEC and privileged EXEC password is cisco.
b. Save the current configuration so that any mistakes you might make can be reversed by toggling the power for S1.
S1#copy running-config startup-config Destination filename [startup-config]? Building configuration... [OK] S1#
c. Show the current configuration and note that the passwords are in plain text. Enter the command that encrypts plain text passwords:
S1#show running-config Building configuration... Current configuration : 1144 bytes ! version 12.2 no service timestamps log datetime msec no service timestamps debug datetime msec no service password-encryption ! hostname S1 ! enable password cisco ! <output omitted> ! interface Vlan1 ip address 10.10.10.2 255.255.255.0 ! ! ! ! line con 0 ! line vty 0 4 password cisco login line vty 5 15 password cisco login ! ! ! ! end
S1(config)# service password-encryption
d. Verify that the passwords are encrypted.
S1#show running-config Building configuration... Current configuration : 1168 bytes ! version 12.2 no service timestamps log datetime msec no service timestamps debug datetime msec service password-encryption ! hostname S1 ! enable password 7 0822455D0A16 ! <output omitted> ! interface Vlan1 ip address 10.10.10.2 255.255.255.0 ! ! ! ! line con 0 ! line vty 0 4 password 7 0822455D0A16 login line vty 5 15 password 7 0822455D0A16 login ! ! ! ! end S1#
Part 2: Encrypt Communications
Step 1: Set the IP domain name and generate secure keys.
It is generally not safe to use Telnet, because data is transferred in plain text. Therefore, use SSH whenever it is available.
a. Configure the domain name to be netacad.pka.
S1(config)#ip domain-name netacad.pka
b. Secure keys are needed to encrypt the data. Generate the RSA keys using a 1024 key length.
S1(config)# crypto key generate rsa The name for the keys will be: S1.netacad.pka Choose the size of the key modulus in the range of 360 to 2048 for your General Purpose Keys. Choosing a key modulus greater than 512 may take a few minutes. How many bits in the modulus [512]: 1024 % Generating 1024 bit RSA keys, keys will be non-exportable...[OK]
Step 2: Create an SSH user and reconfigure the VTY lines for SSH-only access.
a. Create an administrator user with cisco as the secret password.
S1(config)# username administrator secret cisco
b. Configure the VTY lines to check the local username database for login credentials and to only allow SSH for remote access. Remove the existing vty line password.
S1(config)# line vty 0 15 S1(config-line)# transport input ssh S1(config-line)# login local S1(config-line)# no password cisco
Step 3: Verify SSH Implementation
a. Exit the Telnet session and attempt to log back in using Telnet. The attempt should fail.
C:\>telnet 10.10.10.2 Trying 10.10.10.2 ...Open [Connection to 10.10.10.2 closed by foreign host] C:\>
b. Attempt to log in using SSH. Type ssh and press Enter without any parameters to reveal the command usage instructions. Hint: The -l option is the letter “L”, not the number 1.
C:\>ssh -l administrator 10.10.10.2 Password: S1>enable Password: S1#
c. Upon successful login, enter privileged EXEC mode and save the configuration. If you were unable to successfully access S1, toggle the power and begin again at Part 1.
S1#copy running-config startup-config Destination filename [startup-config]? Building configuration... [OK] S1#
Device Configs - Final
SWITCH S1
! ============================================================== !--- 1.3.6 Packet Tracer - Configure SSH !--- ANSWER SCRIPT FOR SWITCH S1 !--- Usage: from the PC1 Command Prompt, Telnet to S1 (telnet 10.10.10.2). The user EXEC and privileged EXEC password is "cisco". Then paste this whole file. Every line beginning with "!" is a comment; IOS ignores it, so pasting a comment by accident is harmless. !--- S1 is already configured with a hostname, a VLAN 1 management address and Telnet access. This script hardens it: it encrypts the passwords and replaces Telnet with SSH. ! ============================================================== ! -------------------------------------------------------------- !--- Part 1, Step 2: Save the current configuration FIRST, so any mistake can be undone by power-cycling S1. ! -------------------------------------------------------------- enable copy running-config startup-config configure terminal ! -------------------------------------------------------------- !--- Part 1, Step 3: Secure the passwords ! -------------------------------------------------------------- !--- Encrypt all plaintext passwords. Before this command, 'show running-config' displays the passwords in clear text; afterwards they appear as type 7 hashes. service password-encryption ! -------------------------------------------------------------- !--- Part 2, Step 1: Set the IP domain name and generate the RSA keys ! -------------------------------------------------------------- !--- Set the domain name. Together with the hostname it forms the RSA key name (S1.netacad.pka), so the domain name MUST be set before the crypto command below. ip domain-name netacad.pka !--- Generate the 1024-bit RSA key pair that SSH uses to encrypt the session. crypto key generate rsa modulus 1024 ! -------------------------------------------------------------- !--- Part 2, Step 2: Create an SSH user and lock the VTY lines down to SSH only ! -------------------------------------------------------------- !--- Create the local user that SSH will authenticate against. username administrator secret cisco !--- On the VTY lines: authenticate against the local user database, accept ONLY SSH (this is what makes the later Telnet attempt fail), and remove the old shared line password, which is no longer used once 'login local' is active. line vty 0 15 login local transport input ssh no password cisco exit end ! -------------------------------------------------------------- !--- Part 3, Step 3: Save the configuration to NVRAM. (Press Enter when prompted for the destination filename.) ! -------------------------------------------------------------- copy running-config startup-config ! ============================================================== !--- Verification (Part 3, from the PC1 Command Prompt): !--- telnet 10.10.10.2 -> the connection is REFUSED (transport input ssh) !--- ssh -> shows the command usage; -l is the letter L, not the digit 1 !--- ssh -l administrator 10.10.10.2 -> login succeeds with password cisco !--- On S1: !--- show ip ssh -> SSH enabled, RSA key present !--- show running-config -> passwords now stored as type 7, VTY set to SSH only ! ==============================================================
