Lessons · Network switches · SSH instead of telnet
Telnet sends your password across the network in the clear
SSH encrypts the session; telnet does not. Setting SSH up needs a hostname, a domain name, a key, a local user and the vty lines told to accept ssh only.
Hone is a place to practise programming. This is one of its lessons, written out in full and free to read without an account.
What it is for
Anybody who can see the traffic between you and the switch can read a telnet password. On a network you do not fully control, that is the whole security model gone.
How to think about it
Follow the chain and let the errors teach you: the key needs a name, the name needs a hostname and a domain. Then create a user, then tell the lines to use ssh and nothing else.
Worked example
enableThe # prompt.
configure terminalInto configuration mode.
hostname IDF5The key is named after the host and the domain, so this has to come first.
ip domain-name works.localThe other half of the key's name.
crypto key generate rsa modulus 2048The key itself. 2048 bits, because the default of 512 is too small for SSH version 2.
ip ssh version 2Version 1 has known weaknesses. Ask for 2 explicitly.
username netadmin secret Sw-2026-RackA named account, so the log says who did it rather than that somebody did.
line vty 0 15The sixteen virtual lines an incoming session lands on.
login localAsk for a username and password from this switch's own user list.
transport input sshAnd accept ssh only. This is the line that turns telnet off.
endOut.
show running-configRead the vty block back. transport input ssh is the setting an auditor will look for.
Your turn
Accept encrypted sessions only on the vty lines.
transport input
Console into a switch
The trap
Generating the key before setting a hostname and a domain. The switch refuses, and the error names what is missing, so read it rather than retyping the command.