SSH Configuration and Verification

0s13★ 15 XP

Lesson 110Interactive lesson

SSH Configuration and Verification

A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.

Lesson format15 sections3 code blocks1 practice itemUpdated Oct 2, 2026

bash

R1# show ip ssh
SSH Enabled - version 2.0
Authentication timeout: 60 secs; Authentication retries: 3
Minimum expected Diffie Hellman key size : 1024 bits
IOS Keys in SECSH format(ssh-rsa, base64 encoded):
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC5...

That output confirms SSH v2 is running and shows the RSA public key the router presents to clients. Modern IOS uses 2048-bit RSA or ECDSA keys; older devices default to 1024-bit which is below current recommendations. Check the key size and regenerate if it's too small.

#The Required SSH Config#link

bash

! Prerequisites
R1(config)# hostname R1-HQ
R1(config)# ip domain-name corp.example.com

! Generate the RSA key pair — required before SSH works
R1(config)# crypto key generate rsa modulus 2048
The name for the keys will be: R1-HQ.corp.example.com
% You already have RSA keys defined for R1-HQ.corp.example.com
% Do you really want to replace them? [yes/no]: yes

! Force SSH version 2
R1(config)# ip ssh version 2
R1(config)# ip ssh time-out 60
R1(config)# ip ssh authentication-retries 3

! Optional but recommended
R1(config)# crypto key generate rsa general-keys modulus 4096
R1(config)# ip ssh dh min size 2048

! Verify
R1# show ip ssh

The SSH process requires a hostname, domain name, and RSA key pair. Miss any of them and `ip ssh` silently fails — the config accepts it, but SSH won't work. If you're troubleshooting SSH, check these three first.

callout

SSH version 1 is deprecated and vulnerable. Always force version 2 with `ip ssh version 2`. If the router's crypto image doesn't support v2 (older hardware), the config will reject the command — which tells you it's time to upgrade the IOS or hardware. Version 1 should never be used in production.

#Troubleshooting SSH#link

▪SSH not connecting at all — check `show ip ssh` for version, key presence
▪% Invalid input detected at 'crypto' — IOS image lacks crypto features (need k9 image)
▪Connection times out — check `access-class` on VTY, verify SSH ACL allows the source
▪Authentication fails — check `login local` on VTY and `username` config
▪Host key verification fails on client — the router's key changed (regenerate or clear known_hosts on client)
▪Slow key exchange — small key size or old ciphers; increase DH min size and regenerate with 2048+ key

#The Complete Verified Config#link

Verify SSH is ready

root@vulnarex:~#show ip ssh

Version 2.0 confirmed. DH key size 2048 (current best practice). The RSA key is present in SECSH format. From this state, an SSH client can connect using the credentials configured under `line vty` — typically `login local` with a `username` command.

#Check Your Understanding#link

★ 15 XPeasy

quiz BLOCK (★ 15 XP)

Which command generates the RSA keys needed for SSH?

Select your proof vectors above

#Common Mistakes#link

▪Forgetting to set a hostname and domain name before generating keys
▪Using 1024-bit keys — generate 2048 or 4096
▪Leaving SSH version 1 enabled — force version 2
▪Forgetting `login local` on VTY — SSH connects but no way to authenticate
▪No `username` configured for local auth — connection attempts fail

Lesson completion

Ready to resolve this lesson?

Finish the lesson once you have worked through the material. This awards ★ 15 XP.

Previous lesson

Lesson tools

Workspace

0% read

Lab notes

Notes persist per lesson.

The Required SSH Config Troubleshooting SSH The Complete Verified Config Check Your Understanding Common Mistakes

Content

Last updated

October 2, 2026

Agent Setup

Access lesson content programmatically for AI agents, LLMs, and automated pipelines.

Fetch as Markdown (Accept header)

curl -H "Accept: text/markdown" "https://vulnarex.com/api/content/lessons?courseSlug=complete-ccna-200-301&lessonSlug=5-ssh-configuration-verification&lang=en&format=markdown"

MCP Server Config (mcp.json)

{
  "mcpServers": {
    "vulnarex": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-fetch"],
      "env": { "MCP_FETCH_URL": "https://vulnarex.com" }
    }
  }
}

MCP Server Card/.well-known/mcp.json A2A Agent Card/.well-known/agent-card.json API Catalog/.well-known/api-catalog robots.txt/robots.txt

Laboratory sanity code

Isolate active probes on matched virtual networks and keep execution streams sandboxed.

R1# show ip ssh

SSH Enabled - version 2.0

Authentication timeout: 60 secs; Authentication retries: 3

Minimum expected Diffie Hellman key size : 1024 bits

IOS Keys in SECSH format(ssh-rsa, base64 encoded):

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC5...

! Prerequisites

R1(config)# hostname R1-HQ

R1(config)# ip domain-name corp.example.com

! Generate the RSA key pair — required before SSH works

R1(config)# crypto key generate rsa modulus 2048

The name for the keys will be: R1-HQ.corp.example.com

% You already have RSA keys defined for R1-HQ.corp.example.com

% Do you really want to replace them? [yes/no]: yes

! Force SSH version 2

R1(config)# ip ssh version 2

R1(config)# ip ssh time-out 60

R1(config)# ip ssh authentication-retries 3

! Optional but recommended

R1(config)# crypto key generate rsa general-keys modulus 4096

R1(config)# ip ssh dh min size 2048

! Verify

R1# show ip ssh