disabling ssh Version 1

Answered Question
Mar 17th, 2009

We have a Security Vendor that performs scans of our Internet facing equipment.

I have a 3825 Cisco ISR facing the Internet.

I have an SSH compliant IOS version running on the router. I also have enabled Version 2 of SSH by implementing the command "ip ssh ver 2" and the router likes the command.

For whatever reason, when the router is scanned, it shows SSH v.1 still open.

How can i turn off V.1? The documentation i have read indicates that v.1 is supposed to be turned off when v.2 is enabled, but that does not seem to be the Case here.

Thanks in advance.

Kevin

I have this problem too.
0 votes
Correct Answer by Edison Ortiz about 7 years 8 months ago

When running just version 1:

R1(config)#ip ssh ver 1

R1#sh ip ssh

SSH Enabled - version 1.5

Authentication timeout: 120 secs; Authentication retries: 3

When running version 1 and 2 (default)

R1(config)#no ip ssh ver

SSH Enabled - version 1.99

Authentication timeout: 120 secs; Authentication retries: 3

When running version 2:

R1(config)#ip ssh ver 2

R1#sh ip ssh

SSH Enabled - version 2.0

Authentication timeout: 120 secs; Authentication retries: 3

If you get 2.0 in the output, you should be fine and the scanner is giving you false positive.

__

Edison.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
Edison Ortiz Tue, 03/17/2009 - 14:50

When running just version 1:

R1(config)#ip ssh ver 1

R1#sh ip ssh

SSH Enabled - version 1.5

Authentication timeout: 120 secs; Authentication retries: 3

When running version 1 and 2 (default)

R1(config)#no ip ssh ver

SSH Enabled - version 1.99

Authentication timeout: 120 secs; Authentication retries: 3

When running version 2:

R1(config)#ip ssh ver 2

R1#sh ip ssh

SSH Enabled - version 2.0

Authentication timeout: 120 secs; Authentication retries: 3

If you get 2.0 in the output, you should be fine and the scanner is giving you false positive.

__

Edison.

lewdavie1 Mon, 09/29/2014 - 02:08

What type of connection can this be done from?  If I am using ssh to configure the device is there a chance I will loose connectivity when I enter the "no ip ssh ver" command? 

Actions

This Discussion