{"id":17,"date":"2024-11-27T09:27:21","date_gmt":"2024-11-27T09:27:21","guid":{"rendered":"https:\/\/blog.sakib.biz\/?p=17"},"modified":"2025-12-02T11:59:37","modified_gmt":"2025-12-02T11:59:37","slug":"harden-ssh-service-in-cisco-ios-devices","status":"publish","type":"post","link":"https:\/\/blog.sakib.biz\/index.php\/2024\/11\/27\/harden-ssh-service-in-cisco-ios-devices\/","title":{"rendered":"Harden SSH service in Cisco IOS devices"},"content":{"rendered":"\n<p class=\"has-large-font-size wp-block-paragraph\"><strong>Change the Default SSH Port<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ip ssh port <em><span style=\"text-decoration: underline;\">2222<\/span><\/em><\/p>\n\n\n\n<p class=\"has-large-font-size wp-block-paragraph\"><strong>Disable Unused Service<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">no service pad<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">no service finger<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">no snmp-server enable traps<\/p>\n\n\n\n<p class=\"has-large-font-size wp-block-paragraph\"><strong>Enable SSH<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">crypto key generate rsa modulus&nbsp;<em>2048<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ip ssh version 2<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ip ssh dh min size&nbsp;<em><span style=\"text-decoration: underline;\">2048<\/span><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ip ssh server algorithm mac&nbsp;<em><span style=\"text-decoration: underline;\">hmac-sha2-256<\/span><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ip ssh server algorithm encryption&nbsp;<em><span style=\"text-decoration: underline;\">aes256-cbc<\/span><\/em><\/p>\n\n\n\n<p class=\"has-large-font-size wp-block-paragraph\"><strong>Restrict Access<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ip access-list extended 10<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&nbsp; permit tcp <em><span style=\"text-decoration: underline;\">192.168.99.0 0.0.0.255<\/span><\/em> any eq <em><span style=\"text-decoration: underline;\">2222<\/span><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&nbsp; permit tcp any any established<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&nbsp; exit<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">line vty 0 4<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"> &nbsp; access-class 10 in<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"> &nbsp; transport input ssh<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"> &nbsp; exit<\/p>\n\n\n\n<p class=\"has-large-font-size wp-block-paragraph\"><strong>Enable Access Logging<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">login on-failure log<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">login on-success log<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Change the Default SSH Port ip ssh port 2222 Disable Unused Service no service pad no service finger no snmp-server enable traps Enable SSH crypto key generate rsa modulus&nbsp;2048 ip ssh version 2 ip ssh dh min size&nbsp;2048 ip ssh server algorithm mac&nbsp;hmac-sha2-256 ip ssh server algorithm encryption&nbsp;aes256-cbc Restrict Access ip access-list extended 10 &nbsp; [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-17","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/blog.sakib.biz\/index.php\/wp-json\/wp\/v2\/posts\/17","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.sakib.biz\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.sakib.biz\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.sakib.biz\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.sakib.biz\/index.php\/wp-json\/wp\/v2\/comments?post=17"}],"version-history":[{"count":9,"href":"https:\/\/blog.sakib.biz\/index.php\/wp-json\/wp\/v2\/posts\/17\/revisions"}],"predecessor-version":[{"id":73,"href":"https:\/\/blog.sakib.biz\/index.php\/wp-json\/wp\/v2\/posts\/17\/revisions\/73"}],"wp:attachment":[{"href":"https:\/\/blog.sakib.biz\/index.php\/wp-json\/wp\/v2\/media?parent=17"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.sakib.biz\/index.php\/wp-json\/wp\/v2\/categories?post=17"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.sakib.biz\/index.php\/wp-json\/wp\/v2\/tags?post=17"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}