disabling ssh Version 1

Answered Question
Mar 17th, 2009
User Badges:

We have a Security Vendor that performs scans of our Internet facing equipment.

I have a 3825 Cisco ISR facing the Internet.

I have an SSH compliant IOS version running on the router. I also have enabled Version 2 of SSH by implementing the command "ip ssh ver 2" and the router likes the command.

For whatever reason, when the router is scanned, it shows SSH v.1 still open.

How can i turn off V.1? The documentation i have read indicates that v.1 is supposed to be turned off when v.2 is enabled, but that does not seem to be the Case here.

Thanks in advance.

Kevin

Correct Answer by Edison Ortiz about 8 years 2 months ago

When running just version 1:


R1(config)#ip ssh ver 1


R1#sh ip ssh

SSH Enabled - version 1.5

Authentication timeout: 120 secs; Authentication retries: 3


When running version 1 and 2 (default)


R1(config)#no ip ssh ver


SSH Enabled - version 1.99

Authentication timeout: 120 secs; Authentication retries: 3


When running version 2:


R1(config)#ip ssh ver 2


R1#sh ip ssh

SSH Enabled - version 2.0

Authentication timeout: 120 secs; Authentication retries: 3


If you get 2.0 in the output, you should be fine and the scanner is giving you false positive.


__


Edison.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
glen.grant Tue, 03/17/2009 - 14:48
User Badges:
  • Purple, 4500 points or more

What does " show ip ssh " show ???

Correct Answer
Edison Ortiz Tue, 03/17/2009 - 14:50
User Badges:
  • Super Bronze, 10000 points or more
  • Hall of Fame,

    Founding Member

When running just version 1:


R1(config)#ip ssh ver 1


R1#sh ip ssh

SSH Enabled - version 1.5

Authentication timeout: 120 secs; Authentication retries: 3


When running version 1 and 2 (default)


R1(config)#no ip ssh ver


SSH Enabled - version 1.99

Authentication timeout: 120 secs; Authentication retries: 3


When running version 2:


R1(config)#ip ssh ver 2


R1#sh ip ssh

SSH Enabled - version 2.0

Authentication timeout: 120 secs; Authentication retries: 3


If you get 2.0 in the output, you should be fine and the scanner is giving you false positive.


__


Edison.

lewdavie1 Mon, 09/29/2014 - 02:08
User Badges:

What type of connection can this be done from?  If I am using ssh to configure the device is there a chance I will loose connectivity when I enter the "no ip ssh ver" command? 

Actions

This Discussion