Secure Copy Protocol Overview - Cisco Catalyst 2960 series Configuration Manual

Information about SSH

Secure Copy Protocol Overview

The Secure Copy Protocol (SCP) feature provides a secure and authenticated method for copying switch
configurations or switch image files. SCP relies on Secure Shell (SSH), an application and a protocol that
provides a secure replacement for the Berkeley r-tools.
For SSH to work, the switch needs an RSA public/private key pair. This is the same with SCP, which relies
on SSH for its secure transport.
Because SSH also relies on AAA authentication, and SCP relies further on AAA authorization, correct
configuration is necessary.
• Before enabling SCP, you must correctly configure SSH, authentication, and authorization on the switch.
• Because SCP relies on SSH for its secure transport, the router must have an Rivest, Shamir, and Adelman
(RSA) key pair.
When using SCP, you cannot enter the password into the copy command. You must enter the password
Note
when prompted.
Secure Copy Protocol
The Secure Copy Protocol (SCP) feature provides a secure and authenticated method for copying switch
configurations or switch image files. The behavior of SCP is similar to that of remote copy (rcp), which comes
from the Berkeley r-tools suite, except that SCP relies on SSH for security. SCP also requires that authentication,
authorization, and accounting (AAA) authorization be configured so the switch can determine whether the
user has the correct privilege level. To configure the Secure Copy feature, you should understand the SCP
concepts.
How Secure Copy Works
The behavior of Secure Copy (SCP) is similar to that of remote copy (RCP), which comes from the Berkeley
r-tools suite (Berkeley university's own set of networking applications), except that SCP relies on Secure
Shell (SSH) for security. In addition, SCP requires that authentication, authorization, and accounting (AAA)
authorization be configured so that the device can determine whether the user has the correct privilege level.
SCP allows a user only with a privilege level of 15 to copy any file that exists in the Cisco IOS File System
(IFS) to and from a device by using the copy command. An authorized administrator may also perform this
action from a workstation.
Note Enable the SCP option while using the pscp.exe file with the Cisco software.
Reverse Telnet
Reverse telnet allows you to telnet to a certain port range and connect to terminal or auxiliary lines. Reverse
telnet has often been used to connect a Cisco device that has many terminal lines to the consoles of other
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
1072