SSH – Secure Remote Access

What is SSH?

Definition: SSH (Secure Shell) is a cryptographic network protocol enabling secure remote login and other network services over unsecured networks.
Purpose: SSH replaces insecure protocols (like Telnet), providing confidentiality, integrity, and authenticity for management, file transfer, and tunneling.

How SSH Provides Secure Remote Access

• Encryption: All data (including passwords) is encrypted, preventing eavesdropping.
• Authentication: Users/devices are verified via passwords, keys, or certificates.
• Integrity: Message authentication codes protect against tampering.

SSH Versions

• SSH-1: Obsolete, insecure—never use in production.
• SSH-2: Modern, secure standard—always use SSH-2.

SSH Components

SSH Authentication Methods

SSH Key Management

1. Key Generation: ssh-keygen -t rsa -b 4096 (creates private & public keys)
2. Deploy Public Key: ssh-copy-id user@server (adds key to ~/.ssh/authorized_keys)
3. Key Passphrases: Protect private keys with a passphrase.

Configuring SSH on Network Devices

Cisco Example:

conf t
hostname Router1
ip domain-name example.com
crypto key generate rsa
ip ssh version 2
username admin secret password123
line vty 0 4
 login local
 transport input ssh
  

SSH Client Usage

SSH Tunneling and Port Forwarding

Security Features and Best Practices

• Always use SSH-2.
• Restrict access (users, groups, ACLs).
• Use strong encryption algorithms (AES, Ed25519).
• Optionally change the default port (from 22) to reduce scanning attacks.
• Set idle timeout/session limits.

Troubleshooting SSH Connections

Advanced SSH Features

• Multiplexing: Share a single SSH connection for multiple sessions.
• Agent forwarding: Use local keys on remote servers.
• SSHFS: Mount remote filesystem securely via SSH.

Alternatives to SSH

Example Scenario

Situation: John needs to configure a remote switch securely from home.
Step 1: Connect using SSH:

ssh admin@203.0.113.2

Exam Tips and Key Points

• Always use SSH-2 over SSH-1.
• Know how to generate and deploy key pairs.
• Understand password vs. public key authentication.
• Know Cisco IOS SSH configuration syntax.
• Be able to use SSH tunnels and explain best practices.
• Troubleshoot using ssh -v and explain SSH’s advantages over Telnet.

Visual SSH Workflow (Step-by-Step)

User (John's Laptop)
       │
       │ 1. User runs: ssh john@192.168.1.10
       │
───────┼─────────────────────────────────────────
       │
       ▼
Remote Server/Switch (192.168.1.10)

Step-by-Step Process:
- John runs the SSH command.
- TCP connection established (default port 22).
- SSH handshake: protocol version, cipher/MAC agreement.
- Authentication: Server sends public key, John authenticates (password/private key).
- Secure channel established (all data encrypted).
- John can run commands, transfer files, tunnel ports.
- Session ends securely.
    

Sample Exam Questions

1. Which of the following statements about SSH is TRUE?
   A) SSH-1 is preferred over SSH-2 for security.
   B) SSH encrypts all session data by default.
   C) SSH transmits passwords in plain text.
   D) Telnet is more secure than SSH.
   
2. To generate an SSH key pair on Linux, the command is: ssh-keygen
3. Name two authentication methods supported by SSH.
   Answer: Password authentication, Public key authentication
4. Enable SSH v2 and configure user "admin" with password "cisco123" on a Cisco router.
   

   conf t
   hostname Router1
   ip domain-name example.com
   username admin secret cisco123
   crypto key generate rsa
   ip ssh version 2
   line vty 0 4
    login local
    transport input ssh
   end
         

5. John tries ssh admin@10.0.0.5 but gets "Permission denied (publickey,password)." List two possible causes.
   Answer:
   • Incorrect username or password
   • Public key not in ~/.ssh/authorized_keys on the server

Common SSH Troubleshooting Q&A

Summary Table: SSH vs. Telnet

SSH – Secure Remote Access Quiz

← Back to Home