Cisco ISR 4000 Family Routers Administrator Guidance
Page
17
of
66
Note:
this lockout only applies to privilege 14 users and below.
Note
: this applies to consecutive failures, and is not affected by the SSH or Telnet session
disconnections after their default number of failures. In other words, if this lockout command is
set to 5 failures, and SSH disconnects after 3 failed attempts, if the user attempts another SSH
session and enters the wrong credentials two additional times, the account will lock.
3.3
Network Protocols and Cryptographic Settings
Telnet for management purposes is enabled by default and must be disabled in the evaluated
configuration. To only allow ssh for remote administrator sessions, use the
transport input ssh
command. This command disables telnet by only allowing ssh connections for remote
administrator access.
3.3.1 Remote Administration Protocols
3.3.1.1
Steps to configure SSH on router
1.
Generate RSA key material – choose a longer modulus length for more secure keys (i.e.,
1024); ex.
TOE-common-criteria#
crypto key generate rsa
TOE-common-criteria# How many bits in the modulus [512]:
2048
RSA keys are generated in pairs—one public RSA key and one private RSA key. This
command is not saved in the router configuration; however, the RSA keys generated by
this command are saved in the private configuration in NVRAM (which is never displayed
to the user or backed up to another device) the next time the configuration is written to
NVRAM.
Note:
If the configuration is not saved to NVRAM, the generated keys are lost on the next
reload of the router.
Note:
to delete a key, an administrator may use the crypto key zeroize <label> command.
2.
Enable ssh
TOE-common-criteria#
ip ssh authentication-retries 2
3.
Configure –ssh timeout
TOE-common-criteria#
ip ssh time-out 60
4.
Set to use SSH v2
TOE-common-criteria#
ip ssh version 2
5.
Ensure that the product is configured not to support diffie-hellman-group1-sha1 key
exchange using the following command ‘ip ssh dh min size 2048’:
TOE-common-criteria#
ip ssh dh min size 2048
