Examkin

Soru

Zorluk: OrtaSSH Secure Remote Access Configuration and Verification

A network administrator is deploying SSH version 2 for secure management on a Layer 3 switch named HQ-AggSwitch01. The switch already has a non-default hostname configured and local user accounts created. Which TWO configuration steps must be completed to successfully enable SSH version 2 and restrict remote management access strictly to SSH on the virtual terminal lines? (Select TWO.)

  1. Define an IP domain name and generate an RSA key pair with a modulus length of at least 768 bits.Cevap
  2. Configure transport input ssh and login local within line vty configuration mode.Cevap
  3. C
    Generate an RSA key pair using a 512-bit modulus to enable SSH version 2 with reduced CPU load.
  4. D
    Configure ip ssh version 2 under line vty configuration mode to activate the SSH daemon on virtual terminal lines.

Cevap

To enable SSH version 2 and secure VTY access, the administrator must configure an IP domain name with an RSA key pair of at least 768 bits, and configure 'transport input ssh' with 'login local' under line vty configuration mode.
Enabling SSH version 2 requires defining an IP domain name and generating an RSA key pair with at least 768 bits (768–2048 bits). Furthermore, securing the virtual terminal lines requires configuring 'login local' to authenticate users against local credentials and 'transport input ssh' to disable unencrypted protocols.

Adım Adım Çözüm

1
Verify prerequisite global SSH settings
Ensure a non-default hostname is set, configure an IP domain name using 'ip domain-name <domain>', and generate RSA keys using 'crypto key generate rsa'.
Cisco IOS automatically uses the hostname and domain name to form the Fully Qualified Domain Name (FQDN) needed for RSA key pair generation.
2
Ensure SSH version 2 operational compliance
Specify an RSA key modulus of 768 bits or greater (such as 1024 or 2048 bits).
Key sizes under 768 bits fail to support SSH version 2 and cause the device to fall back to SSH version 1.5.
3
Configure VTY line security and protocol binding
Under 'line vty 0 15', enter 'login local' to use local user database authentication and 'transport input ssh' to block unencrypted management protocols like Telnet.
Without 'login local', local user authentication will not be enforced, and without 'transport input ssh', plain-text Telnet access might remain permitted.

Anahtar Kavram

SSH Version 2 Configuration Prerequisites and VTY Line Securing
Bu soruyu puanla

Konular

SSH Secure Remote Access Configuration and Verification

Bu konudan daha fazla soru