9-46
Catalyst 3750 SwitchSoftware Configuration Guide
OL-8550-09
Chapter9 Configuring Switch-Based Authenticatio n
Configuring the Switch for Secure Shell
•Displaying the SSH Configuration and Status, page 9-50
For SSH configuration examples, see the “SSH Configuration Examples” section in the “Configuring
Secure Shell” chapter of the Cisco IOS Security Configuration Guide, Cisco IOS Release12.2:
http://www.cisco.com/en/US/docs/ios/12_2/security/configuration/guide/scfssh.html
Note For complete syntax and usage information for the commands used in this section, see the command
reference for this release and the command reference for Cisco IOS Release 12.2:
http://www.cisco.com/en/US/docs/ios/12_2/security/command/reference/fsecur_r.html
Understanding SSH
SSH is a protocol that provides a secure, remote connection to a device. SSH provides more security for
remote connections than Telnet does by providing strong encryption when a device is authenticated. This
software release supports SSH Version1 (SSHv1) and SSH Version 2 (SSHv2).
This section consists of these topics:
•SSH Servers, Integrated Clients, and Supported Versions, page9-46
•Limitations, page 9-47
Note The SSH connection to the switch stack can be lost if a stack master running the cryptographic version
of the IP base image (formerly known as the standard multilayer image [SMI]) or IP services image
(formerly known as the enhanced multilayer image [EMI]) software fails and is replaced by a switch that
is running a noncryptographic version of the software. We recommend that a switch running the
cryptographic version of the IP base or IP services image software be the stack master. Encryption
features are unavailable if the stack master is running the noncryptographic version of the IP base or IP
services image software.

SSH Servers, Integrated Clients, and Supported Versions

The SSH feature has an SSH server and an SSH integrated client, which are applications that run on the
switch. You can use an SSH client to connect to a switch running the SSH server. The SSH server works
with the SSH client supported in this release and with non-Cisco SSH clients. The SSH client also works
with the SSH server supported in this release and with non-Cisco SSH servers.
The switch supports an SSHv1 or an SSHv2 server.
The switch supports an SSHv1 client.
SSH supports the Data Encryption Standard (DES) encryption algorithm, the Triple DES (3DES)
encryption algorithm, and password-based user authentication.
SSH also supports these user authentication methods:
•TACACS+ (for more information, see the “Controlling Switch Access with TACACS+” section on
page 9-10)
•RADIUS (for more information, see the “Controlling Switch Access with RADIUS” section on
page 9-18)
•Local authentication and authorization (for more information, see the “Configuring the Switch for
Local Authentication and Authorization” section on page9-44)