top of page

SSH | Recommendations

SSH, also known as Secure Shell or Secure Socket Shell, is a network protocol that gives users, particularly system administrators, a secure way to access a computer over an unsecured network. In addition to providing secure network services, SSH refers to the suite of utilities that implement the SSH protocol. Secure Shell provides strong password authentication and public key authentication, as well as encrypted data communications between two computers connecting over an open network, such as the internet. In addition to providing strong encryption, SSH is widely used by network administrators for managing systems and applications remotely, enabling them to log in to another computer over a network, execute commands and move files from one computer to another.


For many years the recommendation is to work with SSH instead of Telnet, but besides enabling SSH we can add some parameters to improve security.


Even using SSH we are subject to vulnerabilities in the protocols and algorithms it uses, so if your equipment / software allows it, add the parameters below to increase security in remote access.


#1) Create the key with at least 2048 bits. You can also use the 4096, which makes the connection a little slower, but it's more secure:

#2) Use SSHv2 whenever possible:

#3) Accept SSH on "line vty":

#4) Set the timeout and number of authentication attempts:

#5) Choose strong algorithms:

#6) When adding the user, use the secret word instead of the password:

#7) Limit the origin of accesses using ACL:


Checking the settings can be done with the "show ip ssh" command:


52 views0 comments

Recent Posts

See All

Securing IOS-XE Routing Protocols

Securing the routing information prevents an attacker from introducing false routing information into the network, which could be used as part of a Denial of Service (DoS) or Man-in-the-Middle (MiTM)

Cisco Duo Log Sync (DLS)

Duologsync (DLS) is a utility written by Duo Security that supports fetching logs from Duo endpoints and ingesting them to different SIEMs. Logging: A logging filepath can be specified in config.yml.

Umbrella VA logging to Remote Syslog Server

Syslog is a protocol that computer systems use to send event data logs to a central location for storage. Logs can then be accessed by analysis and reporting software to perform audits, monitoring, tr

Comments


bottom of page