We have relaunched: What's new at ZDNet Asia?

ZDNet / Techguide / Network Admin / Story

Swap Telnet for SSH

By Michael Mullins CCNA, MCP, TechRepublic on February 22, 2005

Summary

If you're using Telnet to control network devices, you should consider switching to something more secure. We show you how to replace Telnet with Secure Shell (SSH).

Events

Microsoft MSDN/Developer Event
25 Mar 2010

One Marina Boulevard, Microsoft Singapore

IT Architect Regional Conference Singapore 2010
20 - 21 Apr 2010

Singapore Management University, Singapore

The Internet Show 2010
21-22 Apr 2010

Suntec Singapore

Using Telnet, a TCP/IP protocol for accessing remote computers, to control your network devices is comparable to shouting your username and password when exiting a building.

Pretty soon, someone will be listening, and they'll take advantage of your lack of security.

Secure Shell (SSH) is the industry standard replacement for Telnet and other remote console management applications. SSH commands are encrypted and secure in several ways.

When using SSH, a digital certificate authenticates the connection between the client (your workstation) and the server (your network device), and encryption protects passwords. SSH1 uses RSA encryption keys, and SSH2 uses Digital Signature Algorithm (DSA) keys to secure both the connection and authentication.

Encryption algorithms include Blowfish, Data Encryption Standard (DES), and 3DES. SSH protects against and helps prevent spoofing, "man-in-the-middle" attacks, and packet sniffing.

The steps
The first step to implementing SSH is to verify that your device supports SSH. Log on to your router or switch, and determine if you have an IPSec IOS image loaded that supports SSH.

For our example, we'll use Cisco IOS commands. Run the following command:

Router> Show flash

This command displays the name of the loaded IOS image. You can compare the result with your vendors' list of supported features.

After you've verified that your device supports SSH, ensure that the device has a hostname and a properly configured host domain, as shown below:

Router> config terminal
Router (config)# hostname hostname <the name of the router>
Router (config)# ip domain-name domainname <a domain that the router services>

At this point, you're ready to enable the SSH server on the router. To enable the SSH server, you must first generate an RSA key pair using the following command:

Router (config)# crypto key generate rsa

Generating an RSA key pair for the router automatically enables SSH. If you delete the RSA key pair, this automatically disables the SSH server.

The last step to implementing SSH is to enable Authentication, Authorization, and Accounting (AAA). When you configure AAA, specify usernames and passwords, the session timeout, and the number of retries allowed during a connection attempt. Use the global commands, as shown below:

Router (config)# aaa new-model
Router (config)# username <username> password <password>
Router (config)# ip ssh time-out <seconds>
Router (config)# ip ssh authentication-retries <integer>

To verify that you've configured SSH and it's running on the router, execute the following command:

Router# show ip ssh

After verifying the configuration, you're ready to force the users that you added during the AAA configuration to use SSH instead of Telnet. You can do so by requiring SSH for virtual terminal (vty) connections. Here's an example:

Router (config)# line vty 0 4
Router (config-line)# transport input SSH

Before you kill the current Telnet session, you need an SSH terminal client program to test your configuration. I highly recommend PuTTY; it's free, and it's an excellent terminal emulator.

Final thoughts
After you've enabled SSH on your routers and switches, make sure you modify any existing access control lists to allow the connections to these devices. You can now report to your superiors that you've plugged a huge security hole: All network management sessions are now encrypted and secure.

Talkback

Add your opinion

In order to post a comment, you need to be registered. (Sign In or register below)

Post your comment

ZDNet Asia Live

As Sony camera users, both MTS and M2TS are Sony high definition video file types, which are raw AVCHD videos recorded by AVCHD camcorder...

45 minutes ago by tracyjump on Mobile data centers becoming 'mainstream'

Found this great little deal calculator http://www.zdnetasia.com/downloa...

7 hours 23 minutes ago by winstoncranford on topsy

RT @mistertechblog: I wrote about Nexus One and Touchdown, desktop dock, Bluetooth/USB tethering, ebooks here: http://bit.ly/bRdzx0

13 hours 34 minutes ago by yklee13 on topsy

Read my blog post on getting the most from your Nexus One: http://www.zdnetasia.com/blogs/m...

Data Centre Operator (Fresh Graduates Welcome to Apply) in ... http://bit.ly/bagYuu

14 hours 5 minutes ago by intmasterfeed on topsy

#Cisco #Cloud Cloud on ZDNet Asia: Aussie university joins Cisco cloud ยท Early-adopter criminals embrace cloud... http://bit.ly/d93C8S #TCN

15 hours 7 minutes ago by thetechgang on topsy

RT @3wconsulting: Whitepaper from http://3W.com.au "Outsourcing Your IT Requirements to Philippines" now on @zdnetaustralia & @zdnetasia http://ow.ly/1oY9f

Whitepaper from http://3W.com.au "Outsourcing Your IT Requirements to Philippines" now on @zdnetaustralia & @zdnetasia http://ow.ly/1oYbA

Whitepaper from http://3W.com.au "Outsourcing Your IT Requirements to Philippines" now on @zdnetaustralia & @zdnetasia http://ow.ly/1oYbz

Zdnetasia.com Estimated Worth $178,365 USD. Daily Ad Revenue:$244 USD, Daily Views:81,445 Pages... - http://www.haplog.com/www.zdneta...

The receivers don't transmit back to the satellite. Unless there is a phone line attached to the receiver, they don't have any wa...

1 day 21 minutes ago by bessellbrowne on Apple to join the geolocation craze?

"Lead Cognos BI Developer Insurance - Jobs - ZDNet Asia" http://bit.ly/bRcxOG

1 day 15 minutes ago by rhrcognos on topsy

whatever little understanding I have we 'll only progress toward end of the world if we use HPCs to lenthen life of human being. Huma...

2 days 27 minutes ago by abhi32002@gmail.com on High computing promises elixir of life

Thanks for the knowledgeable article on SDDs. Allas...when all this reasearch will happen in Indian Universities. Hope the new bill on Fo...

2 days 40 minutes ago by abhi32002@gmail.com on APAC HPC users eye solid-state drives

It was a good article. This brings a good opportunity for Indian IT firms to come up with new solutions in this field. HPC can become a b...

2 days 59 minutes ago by abhi32002@gmail.com on High computing most-wanted job in Asia

COL KR DHARMADHIKARY(RETD) its very late to reply the link, but if it is still alive and looking for opportunity, i would like to know th...

2 days 56 minutes ago by deb021280 on Education takes off in rural India, helped by PCs

High performance computing (HPC) most-wanted job in Asia http://bit.ly/9vFC3i (via @zdnetasia) #singapore

RT @zdnetasia: EMC COO, Pat Gelsinger, on bridging gaps in the organization and its cloud ambitions in Asia. (cont) http://tl.gd/i5jjd

EMC COO, Pat Gelsinger, on bridging gaps in the organization and its cloud ambitions in Asia. http://bit.ly/9etOZW

Asian SMBs need to pay more attention to disaster recovery planning http://bit.ly/bDet08 via @zdnetasia

Asian SMBs need to pay more attention to disaster recovery planning http://bit.ly/bDet08

[TECH] URL Shorteners slow Web redirection. - http://bit.ly/bySnWK @zdnetasia

URL shorteners are great but they can slow web redirection & you pray it would never go down http://bit.ly/bySnWK via @zdnetasia

URL shorteners slow Web redirection. http://bit.ly/bySnWK

Chinese agencies cry foul over Google. http://bit.ly/by6rwV

all of sg's isps have been practising compulsory invisible proxy for all home subscribers at their backend since many years back alre...

3 days 40 minutes ago by melvinchia on Web filters mean bad news for business

it is not to good for china.
Proactol

3 days 25 minutes ago by nathonastle on Chinese ad partners beg Google for information

Very good explanation of JMX

4 days 30 minutes ago by Babith B on Managing applications with JMX

The reaction to a report issued Tuesday by Flurry Analytics managed to completely overlook some interesting news--the Android-based Motorola Droid outsold the original iPhone over the same period of time following their respective launches--to focus instead on the sales numbers for the Nexus One.

4 days 33 minutes ago by lonemavericks on diggs

Another ZTE story....

5 days 35 minutes ago by Moderate Your Greed on Philippines opens bid for final 3G license

We at www.fifosys.com have also seen a growth in IT outsourcing and anticipate it as a growing field.

5 days 9 minutes ago by sarah Jane on Companies' outsourcing spend to increase

I agree with you. The iSiVaL is super portable and TVs can't expand their image size. I recorded a video that might bring some ideas to...

5 days 39 minutes ago by Jesse B Andersen on Buying a projector? Try an LED TV instead

hermm... he deserved it.. he shud not talk abt sensitive things like tat, well, he shud think twice before saying all those things, event...

5 days 17 minutes ago by ... on Facebook user charged in Malaysia

Password manager tools are potential security threat. Criminals who hack into the computer can use the password manager to log onto any s...

5 days 17 minutes ago by ohanae on What defaults should random password generators use?

I've found the cross platform utility unetbootin to be rather handy for this kind of thing as well.

5 days 51 minutes ago by Jim on Use Live USB Creator to install Fedora 12 from a USB stick

Keep up with ZDNet Asia

Linkedin Join our network

RSS Feeds Subscribe now

Newsletters Subscribe today

Twitter Follow us

Inside ZDNet Asia

Special Report: Tech Focus in 2010

Latest Videos on Tech Industry

Insight: Interviews with Newsmakers

Search for over 15,000 Tech Jobs in Asia

Find your Tech answers in TechGuides

IT Library: Over 60,000 IT papers at your fingertips

Download IT Priorities 2010 Report