Ssh Server - Cisco CRS-1 - Carrier Routing System Router Configuration Manual

Implementing Secure Shell on Cisco IOS XR Software
•
•
•
•
•
•
•
•
•
Information About Implementing Secure Shell
To implement SSH, you should understand the following concepts:
•
•
•
•
•

SSH Server

The SSH server feature enables an SSH client to make a secure, encrypted connection to a Cisco router.
This connection provides functionality that is similar to that of an inbound Telnet connection. Before
SSH, security was limited to Telnet security. SSH allows a strong encryption to be used with the
Cisco IOS XR software authentication. The SSH server in Cisco IOS XR software works with publicly
and commercially available SSH clients.
OL-20382-01
The SFTP server is usually included as part of SSH packages from public domain and is turned on
by default configuration.
SFTP is compatible with sftp server version OpenSSH_2.9.9p2 or higher.
RSA-based user authentication is supported in the SSH and SFTP servers. The support however, is
not extended to the SSH client.
Execution shell and SFTP are the only applications supported.
The AES encryption algorithm is supported on the SSHv2 server and client, but not on the SSHv1
server and client. Any requests for an AES cipher sent by an SSHv2 client to an SSHv1 server are
ignored, with the server using 3DES instead.
The SFTP client does not support remote filenames containing wildcards (*,?, []). The user must
issue the sftp command multiple times or list all of the source files from the remote host to download
them on to the router. For uploading, the router SFTP client can support multiple files specified
using a wildcard provided that the issues mentioned in the first through third bullets in this section
are resolved.
The cipher preference for the SSH server follows the order AES128, AES192, AES256, and, finally,
3DES. The server rejects any requests by the client for an unsupported cipher, and the SSH session
does not proceed.
Use of a terminal type other than vt100 is unsupported, and the software generates a warning
message in this case.
Password messages of "none" are unsupported on the SSH client.
Because the router infrastructure does not provide support for UNIX-like file permissions, files
created on the local device lose the original permission information. For files created on the remote
file system, the file permission adheres to the umask on the destination host and the modification
and last access times are the time of the copy.
SSH Server, page SC-201
SSH Client, page SC-202
SFTP Feature Overview, page SC-202
RSA Based Host Authentication, page SC-203
RSA Based User Authentication, page SC-203
Cisco IOS XR System Security Configuration Guide for the Cisco CRS-1 Router
Information About Implementing Secure Shell
SC-201