Solved: disabling ssh Version 1

Kevin Melton · ‎03-17-2009

We have a Security Vendor that performs scans of our Internet facing equipment.

I have a 3825 Cisco ISR facing the Internet.

I have an SSH compliant IOS version running on the router. I also have enabled Version 2 of SSH by implementing the command "ip ssh ver 2" and the router likes the command.

For whatever reason, when the router is scanned, it shows SSH v.1 still open.

How can i turn off V.1? The documentation i have read indicates that v.1 is supposed to be turned off when v.2 is enabled, but that does not seem to be the Case here.

Thanks in advance.

Kevin

Edison Ortiz · ‎03-17-2009

When running just version 1:

R1(config)#ip ssh ver 1

R1#sh ip ssh

SSH Enabled - version 1.5

Authentication timeout: 120 secs; Authentication retries: 3

When running version 1 and 2 (default)

R1(config)#no ip ssh ver

SSH Enabled - version 1.99

Authentication timeout: 120 secs; Authentication retries: 3

When running version 2:

R1(config)#ip ssh ver 2

R1#sh ip ssh

SSH Enabled - version 2.0

Authentication timeout: 120 secs; Authentication retries: 3

If you get 2.0 in the output, you should be fine and the scanner is giving you false positive.

__

Edison.

View solution in original post

glen.grant · ‎03-17-2009

What does " show ip ssh " show ???

Edison Ortiz · ‎03-17-2009

When running just version 1:

R1(config)#ip ssh ver 1

R1#sh ip ssh

SSH Enabled - version 1.5

Authentication timeout: 120 secs; Authentication retries: 3

When running version 1 and 2 (default)

R1(config)#no ip ssh ver

SSH Enabled - version 1.99

Authentication timeout: 120 secs; Authentication retries: 3

When running version 2:

R1(config)#ip ssh ver 2

R1#sh ip ssh

SSH Enabled - version 2.0

Authentication timeout: 120 secs; Authentication retries: 3

If you get 2.0 in the output, you should be fine and the scanner is giving you false positive.

__

Edison.

lewdavie1 · ‎09-29-2014

What type of connection can this be done from? If I am using ssh to configure the device is there a chance I will loose connectivity when I enter the "no ip ssh ver" command?

a.shwehdi · ‎11-08-2021

Thanks you its help me alot