19-3
Ethernet Card Software Feature and Configuration Guide, R7.2
January 2009
Chapter 19 Configuring Security for the ML-Series Card
Configuring SSH
SSH has two applications, an SSH server and SSH client. The ML-Series ca rd only supports the SSH
server and does not support the SSH client. The SSH server in Cisco IOS software works with publicly
and commercially available SSH clients.
The SSH server enables a connection into the ML-Series card, similar to an inbound Telnet connection,
but with stronger security. Before SSH, security was limited to the native security in Telnet. SSH
improves on this by allowing the use of Cisco IOS software authentication.
The ONS node also supports SSH. When SSH is enabled on the ONS node, you use SSH to connect to
the ML-Series card for Cisco IOS CLI sessions.
Note Telnet access to the ML-Series card is not automatically disabled when SSH is enabled. The user can
disable Telnet access with the vty line configuration command transport input ssh.
Configuring SSH
This section has this configuration information:
• Configuration Guidelines, page 19-3
• Setting Up the ML-Series Card to Run SSH, page 19-3 (required)
• Configuring the SSH Server, page 19-4 (required)

Configuration Guidelines

Follow these guidelines when configuring the ML-Series card as an SSH server:
• The new model of AAA and a AAA login method must be enabled. If not previously enabled,
complete the “Configuring AAA Login Authentication” section on page 19-11.
• A Rivest, Shamir, and Adelman (RSA) key pair generated by a SSHv1 server can be used by an
SSHv2 server, and the reverse.
• If you get CLI error messages after entering the crypto key generate rsa global configuration
command, an RSA key pair has not been generated. Reconfigure the hostname and domain, and then
enter the crypto key generate rsa command. For more information, see the “Setting Up the
ML-Series Card to Run SSH” section on page 19-3.
• When generating the RSA key pair, the message No host name specified might appear. If it does,
you must configure a hostname by using the hostname global configuration command.
• When generating the RSA key pair, the message No domain specified might appear. If it does, you
must configure an IP domain name by using the ip domain- name global configuration command.

Setting Up the ML-Series Card to Run SSH

Follow these steps to set up your ML-Series card to run as an SSH server:
1. Configure a hostname and IP domain name for the ML-Series card.
2. Generate an RSA key pair for the ML-Series card, which automatically enables SSH.
3. Configure user authentication for local or remote access. This step is required.
Beginning in privileged EXEC mode, follow these steps to configure a hostname and an IP domain name
and to generate an RSA key pair.