Use the ip http port global configuration command to specify the TCP port to be used by the SSH server. To use the default port, use the no form of this command.
Syntax
ip ssh port port-number
no ip ssh port
port-number—Port number for use by the SSH server (Range: 0-65535).
Default Configuration
The default value is 22.
Command Mode
Global Configuration Mode
User Guidelines
There are no user guidelines for this command.
Examples
The following example specifies the port to be used by the SSH server.
Console (config)# ip ssh port 8080
ip ssh server
Use the ip ssh server global configuration command to enable the device to be configured from SSH. To disable this function use the no form of this command.
Syntax
ip ssh server
no ip ssh server
Default Configuration
This default is enabled to be configured from SSH.
Command Mode
Global Configuration Mode
User Guidelines
If encryption keys are not generated, the SSH server is in standby until the keys are generated. To generate SSH server keys, use the commands crypto key generate rsa, and crypto key generate dsa.
Examples
The following example enables the device to be configured from a SSH server.
Console (config)# ip ssh server
crypto key generate dsa
Use the ip ssh server global configuration command to generate DSA key pairs.
Syntax
crypto key generate dsa
Default Configuration
DSA key pairs do not exist.
Command Mode
Global Configuration Mode
User Guidelines
DSA keys are generated in pairs, one public DSA key and one private DSA key. If the device already has DSA keys, a warning and prompt to replace the existing keys with new keys is displayed.
This command is not saved in the startup configuration, however, the keys generated by this command are saved in the running configuration (which is never displayed to the user or backed up to another device).
Examples
The following example generates DSA key pairs.
Console (config)# crypto key generate dsa
This may take several minutes depending on the length.
Console (config)#
crypto key generate rsa
Use the crypto key generate rsa global configuration command to generate RSA key pairs.
Syntax
crypto key generate rsa
Default Configuration
RSA key pairs do not exist.
Command Mode
Global Configuration Mode
User Guidelines
DSA keys are generated in pairs, one public DSA key and one private DSA key. If the device already has DSA keys, a warning and prompt to replace the existing keys with new keys is displayed.
This command is not saved in the startup configuration, however, the keys generated by this command are saved in the running configuration (which is never displayed to the user or backed up to another device).
Examples
The following example generates RSA key pairs.
Console (config)# crypto key generate rsa
This may take several minutes depending on the length.
Console (config)#
ip ssh pubkey-auth
Use the ip ssh pubkey-auth global configuration command to enable public key authentication for incoming SSH sessions. To disable this function, use the no form of this command.
Syntax
ip ssh pubkey-auth
no ip ssh pubkey-auth
Default Configuration
The function is disabled.
Command Mode
Global Configuration Mode
User Guidelines
AAA authentication is independent.
Examples
The following example enables public key authentication for incoming SSH sessions.
Console (config)# ip ssh pubkey-auth
crypto key pubkey-chain ssh
Use the crypto key pubkey-chain ssh global configuration command to enter SSH Public Key-Chain Configuration Mode. The mode is used to manually specify other device public keys such as SSH client public keys.
Syntax
crypto key pubkey-chain ssh
Default Configuration
By default there are no keys.
Command Mode
Global Configuration Mode
User Guidelines
There are no user guidelines for this command.
Examples
The following example enters the SSH Public Key-Chain Configuration Mode.
Console(config)# crypto key pubkey-chain ssh
Console(config-pubkey-chain)#
user-key
Use the user-key SSH public key-chain configuration command to specify which SSH public key is manually configured and enters the SSH public key-string configuration command. To remove a SSH public key, use the no form of this command.
Syntax
user-keyusername
no user-keyusername
username—Specifies the remote SSH client username.
Default Configuration
By default there are no keys.
Command Mode
SSH Public Key-Chain Configuration Mode
User Guidelines
Follow this command with the key-string command to specify the key.
Examples
The following example enables a SSH public key to be manually configured for the SSH public-key chain.
Console(config)# crypto key pubkey-chain ssh
Console(config-pubkey-chain)# user-key bob
Console(config-pubkey-key)#
key-string
Use the key-string SSH public key-string configuration command to manually specify a SSH public key.
Syntax
key-string {rsa | dss}
rsa—RSA key
dss—DSS key
Default Configuration
By default the keys do not exist.
Command Mode
SSH Public Key-string configuration
User Guidelines
Use this command to specify which SSH public key to manually configure next.
UU-encoded DER format is the same format in authorized_keys file used by OpenSSH.
To complete the command, enter the row with no characters.
Examples
The following example enters public key strings for SSH public key clients.
