SSH access to hosts

Similar Questions

• Simple Question SSH Access-List

  I am allowing SSH access for all of our Cisco devices and you want to restrict access to all the following ip addresses: 192.168.200.1 - 192.168.200.50.  I forgot the exact configuration of access list to achieve this.  The subnet is 24 and I don't want the whole subnet - seulement.1-. 50.

  Thank you

  Thomas Reiling

  Hello

  If you use ssh, make sure that you have a domain name, host name and a rsa key is generated.  Assuing you have done this, the command vty ACL and following line will do the trick.  Note that the host 1-50 list is not on a subnet barrier.

  To get it exactly

  access-list 1 remark MANAGEMENT ALLOW
  access-list 1 permit 192.168.200.0 0.0.0.31

  access-list 1 permit 192.168.200.32 0.0.0.15

  access-list 1 permit 192.168.200.48 0.0.0.1

  host access-list 1 192.168.200.50

  access-list 1 refuse any newspaper

  It would be a good idea to put it on a limit, however, so the following would be much simpler and easier to read.

  access-list 1 remark MANAGEMENT ALLOW
  access-list 1 permit 192.168.200.0 0.0.0.63

  access-list 1 refuse any newspaper

  Apply the class of access on the vty lines and authentication, I would put something there too.

  line vty 0 4
  access-class 1
  entry ssh transport

  password Bonneau

  That should do it.

  Good luck!

  Brad

• SSH access to PIX

  Hello

  I have a PIX 515. I set up SSH access to the external interface. But if I access denied with connection error.

  Invalid message type

  I set up a user name with privileg password all. Siftware is Version 6.2.

  Access with PDM works very well.

  someone an idea?

  Thank you

  First of all you have todo the foillowing

  hostname XXXXXXXX

  Domain XXXXXXXX

  passwd XXXXXXX (this is the password used to authenticate Telnet / SSH)

  Then, you create a pair of RSA keys

  CA generates the key rsa 512 (check this command you can have fun with levels of encryption, that is to say 512 or 1204)

  Allow ssh hosts/networks to your PIX

  SSH #ip address or network # #subnet mask # #interface #.

  FOR EXAMPLE

  If my external IP address my 1.1.1.1 and I needed to access your pix, you will need to enter the following command

  SSH 1.1.1.1 255.255.255.255 outside

  If you get the prompt for a user name try pix, I use software very good LSVCCs of terminal.

  Thank you

  RG

• PIX behind Cisco 1841 - need SSH access

  Hello, trying to enable SSH access to PIX for some external host clinets.

  What are the correct Acl I need?

  Exactly correct...

  1 - on the router, you must allow incoming TCP 22 (ssh) to your PIX on the external interface of the router and also allow the flow back of the PIX inside interface of the router.

  2. - to the PIX you must generate rsa keys and save them.

  CA generates the key rsa 1024

  CA save all

  3 - on the pix you will need to allow ssh acccess to you outside of the interface

  SSH outdoors

  Write it down if you find it useful

• Esxi SSH access and locking mode

  If SSH Busybox shell access has been disabled, is there a point to activate the lock mode?

  Thank you in advance.

  While you can have SSH access disabled, vCLI remote access and access PowerCLI is still possible, unless the lock mode is activated.

  If you enable the lock mode, all remote management of the ESXi hosts (whether you use vSphere Client, vCLI/vMA or PowerCLI) must firstly be connected via vSphere server.

  I hope this helps.

• 2 remote computers can access a host at the same time using using XP Remote Desktop?

  We have the situation where we have an industrial computer on a remote XP operating site.  Can we use the remote desktop of XP for both client computers to access this host at the same time?  There are only two client computers to look at the screen.

  Thank you

  Hello

  Your question (Windows XP) is more complex than what is generally answered in the Microsoft Answers forums. It is better suited for the IT Pro TechNet public. Please ask your question in the XP of Windows IT Pro. You can follow the link to your question:

  http://social.technet.Microsoft.com/forums/en/itproxpsp/threads

• Change of SG 200-18 - management - VLAN / telnet/ssh-access?

  Hello

  We have a switch SG200-18 that should be used as a switch of working group in our environment (SW

  Version 1.1.1.8). In collaboration with CLI on big and mid range Cisco gear during the past two decades, I have a hard time to understand what follows on the SG200:

  (o) I want to change the management VLAN by default '1' to the management - VLAN used in our environment. Of course, I created this vlan in SG200-config, however when it comes to assign the management IP and VLAN management interface in the advancement of the corresponding film under "Interface IPv4-> management VLAN" selectable is the default "1". see screenshots (closed)

  So, how to define a management VLAN 1 different?

  (o) how to enable telnet/ssh-access the SG200-18 - I'd be much more comfortable with a CLI environment ;-)

  Thank you very much in advance for your help,.

  -ewald

  Hello Ewald,

  Sx200 series switch does not currently offer a CLI option. Have this feature if the Sx300 and 500 series.

  What about chaning the vlan management, you have two options.

  (1) changes the vlan by default under management VLAN > Default vlan settings. This will change all the ports and the management vlan.

  (2) adds a port as a port untagged in the new VLAN. Once this is done, make sure that something is connected to this port, like a computer. Now you should be able to change the vlan management. (This is done to prevent locking)

• Disappear the hostname when SSH on ESXi host

  Hello experts,

  I just installed costs the ESXi host but 5.5u3 when ssh to that host is strange, its disappear before host name ~ order as an attachment.

  

  One has had this problem?

  Thanks in advance.

  Sorry it was Linux settings.

  Below is entered in my esxi host /etc/profile.local

  Export PS1 = "[$(echo ${VI_USERNAME//'\'/'\\'}) @\h:\w].

  It should work, if not paste your profile.local output file.

  Thank you

  Hentzien

• Can't ssh ESXi 5 host

  I had to do a strengthening of security on a host computer and now I can't ssh in.  I can go back to what I did, but I want to clarify what line in the sshd_config file is the cause.  I'll list out what I have:

  The SSH server is enabled and running under Firewall and ssh and ESXi shell is running on the host computer in the security profile

  I can connect to the host via the HP Onboard Administrator, both the shell and the DCUI

  I use putty and I put the 3DES encryption cipher selection policy and I tried to tell the version of the SSH 2 Protocol only, I went back with only 2 and just selection 2

  I can connect to the host directly with root and with an admin account, that set up the shell and DCUI

  I know that root cannot ssh in the host since PermitRootLogin is set to no, I'm getting my secondary account

  I immediately receive an error "The network connection closed unexpectedly Server", so it's going to stop until I can grasp anything.

  Finally, the ESXishelltimeout is 900 seconds

  I don't know what the sshd_config fie since I edited it's just before I had this problem.

  Thanks for any input.

  file of sshd:

  # linking inetd

  # Port 2200

  Protocol 2

  HostKey/etc/ssh/ssh_host_rsa_key

  HostKey/etc/ssh/ssh_host_dsa_key

  UsePrivilegeSeparation Yes

  SyslogFacility auth

  LogLevel info

  PermitRootLogin not

  PrintMotd Yes

  PrintLastLog no

  TCPKeepAlive Yes

  X11Forwarding no

  The cipher 3des-ctr, aes128-ctr, aes192-ctr, aes256-ctr

  Mac hmac-sha1

  AllowTCPForwarding no

  GatewayPorts no

  Allowgroupscase

  GSSAPIAuthentication no

  KerberosAuthentication no

  LOCAL AcceptEnv

  PermitUserEnvironment no

  PermitTunnel not

  MaxSessions 1

  StrictModes yes

  RhostsRSAAuthentication no

  Compression without

  UsePAM Yes

  # use only challenge-response MAP (interactive keyboard)

  PasswordAuthentication no

  Banner/etc/issue

  Subsystem sftp/usr/lib/vmware/openssh/bin/sftp-server

  AuthorizedKeysFile /etc/ssh/keys-%u/authorized_keys

  #ListenAddress

  # 10-minute delay. The default value of ClientAliveCountMax is 3.

  # This is why, we get a 3 * 200 = 600 seconds timeout if the customer has been

  # does not.

  ClientAliveInterval 200

  I think I have figured it out, I think that the 'UsePrivilegeSeparation yes' line is causing the problem, I tried on another host and that seems to be.  I check just in case anyone has the problem in the future.

• SSH access ESXi 4.1.0 fails

  Hi all

  I have a problem with SSH access on my server ESXi 4.1.0. The problem is that it keeps it all the time.

  Precesely more, I go to the tab "Configuration", "Safety profile", "Properties", "Remote Tech Support (SSH)" and configure the server running (I tried all three options). Then and for a few minutes, I can connect to the server using ssh, both with the root and non-root users. But after a few minutes the ssh server stops.

  I have no idea what's going on. Could you give me a hint to solve this problem?

  Thanls a lot for your help.

  Kind regards

  Agustin

  Hello

  Welcome to the community

  But after a few minutes the ssh server stops.

  Right, this is due to default security setting that stop ssh after a certain time (don't remember what are the exact numbers). If you want to enable SSH permanently you need to go to the screen of the ESX console and enable SSH from there

  http://vmwaremine.com/2010/10/25/how-to-enable-SSH-on-ESXi-4-1/

  See you soon
  Artur
  

  Please, do not forget the points of call of the "useful" or "correct" answers

• Unable to access esx host after installation via ssh

  Hi all

  Can someone tell me, why can't I access the esx host via ssh after fresh installation of esx? HTTPS access works.

  see you soon,

  City

  You can not connect or your connection impossible?

  http://KB.VMware.com/kb/1003807

  http://KB.VMware.com/kb/8375637

• Cann't open web access, ssh connection between host and bridged the VM in network mode

  I have a VMware workstartion 7.0 is installed on a machine XP 64 (192.168.2.44). I have the following virtual machines.

  1 ESX 4.0 (192.168.2.42)

  2 ESX 3.5 (192.168.2.38)

  3. windows server 2003 with vCenter installed. (192.168.2.100)

  4. Windows server 2003 with the roles of DNS and DC. (192.168.2.101)

  I am trying to connect to vCenter or ESX VM of the XP hosting web interface. However I can't get through. but I can ping and I can also telnet to ports 443, 80. Even I can't ssh connection. When I use putty, it is actually connected but no response from the ssh server. Looks like the network connection is there, somehow the server process responds simply not properly once the connection is established.

  BTW, all of them use bridged network, they all 192.168.2.x IPs. I can connect to vCenter, ESX web interface from another computer without problem.

  Just wonder if anyone else has experienced this before. I have tried to search the forum, did not find a similar question.

  Thank you!

  Tong

  Your host, try to disable (temporarily) a "discharge" for the NIC settings.

  http://KB.VMware.com/kb/1015940

  If this solves the problem, other threads on this issue have mentioned that a fix for this will be included in the next version of the 'point' of Workstation 7 (as 7.1, etc).

• SSH access to ASA

  I can not access our ASA 5505 over SSH from outside. I set this through the ASDM to allow SSH (device management > access management > ASDM, HTTPS, Telnet, SSH). I have added a rule that allows the SSH on the external interface 0.0.0.0 0.0.0.0. When I try to ssh with putty, he says 'network connection closed unexpectedly server' when I look at the logs on the ASA, it shows a Built inbound TCP connection on port 22, but then immediately a disassembly TCP connection. It does not show that it is blocked by any rule. Is there something that I am missing about the SSH activation?

  Thank you

  Scott

  Hello

  In addition to the hosts permitted to SSH for the SAA, you must set the RSA keys for the secure connection.

  In the CLI:

  generate encryption rsa key

  For these keys to work, you should have a name of host/domain configured on the SAA so name (unless you configure a dedicated RSA keys).

  So basically, configure a host name, domain name and generate the RSA key pair:

  hostname NAME_OF_ASA

  NAME_OF_DOMAIN domain name

  generate encryption rsa key

  Accept the default of 1024 and it should work.

  Federico.

• Split tunneling cannot access remote host

  Hi guys,.

  Having this problem by which I am able to connect the Anyconnect client but unable to ping / access of remote servers. See below for the config of the SAA;

  Any ideas would be a great help, thank you!

  ASA Version 9.1 (1)

  !

  ASA host name

  enable the encrypted password xxxxxxx

  xxxxxxxxxxxxx encrypted passwd

  names of

  mask of local pool AnyPool 10.0.0.1 - 10.0.0.10 IP 255.255.255.0

  !

  interface GigabitEthernet0/0

  nameif outside

  security-level 0

  IP address 203.106.x.x 255.255.255.224

  !

  interface GigabitEthernet0/1

  nameif inside

  security-level 99

  IP 172.19.88.254 255.255.255.0

  !

  interface Management0/0

  management only

  nameif management

  security-level 100

  IP 192.168.1.1 255.255.255.0

  !

  passive FTP mode

  clock timezone 8 MYT

  the SVR object network

  Home 172.19.88.11

  e-mail server in description

  network of the NETWORK_OBJ_172.19.88.0_24 object

  172.19.88.0 subnet 255.255.255.0

  network of the VPN-POOL object

  10.0.0.0 subnet 255.255.255.0

  object-group Protocol TCPUDP

  object-protocol udp

  object-tcp protocol

  object-group service DM_INLINE_SERVICE_0

  ICMP service object

  area of service-purpose tcp - udp destination eq

  the destination hostname eq tcp service object

  the purpose of the tcp destination eq https service

  the purpose of the tcp destination eq imap4 service

  the purpose of the tcp destination eq nntp service

  the purpose of the tcp destination eq pop3 service

  the purpose of the tcp destination eq smtp service

  the purpose of the tcp destination eq telnet service

  Outside_access_in list extended access allowed object-group DM_INLINE_SERVICE_0 any object SVR

  Outside_access_in list extended access allow TCPUDP of object-group a

  Outside_access_in access-list extended ip any any idle state to allow

  Internal_access_in list extended access allow TCPUDP of object-group a

  Internal_access_in access-list extended ip any any idle state to allow

  SPLIT_TUNNEL list standard access allowed 10.0.0.0 255.255.255.0

  pager lines 24

  Enable logging

  timestamp of the record

  exploitation forest-size of the buffer 16384

  buffered logging critical

  asdm of logging of information

  Debugging trace record

  exploitation forest flash-bufferwrap

  record level of the rate-limit 1000 1 2

  management of MTU 1500

  MTU 1500 internal

  Outside 1500 MTU

  no failover

  ICMP unreachable rate-limit 1 burst-size 1

  ASDM image disk0: / asdm - 711.bin

  don't allow no asdm history

  ARP timeout 14400

  no permit-nonconnected arp

  !

  the SVR object network

  203.106.x.x static NAT (indoor, outdoor)

  !

  source of auto after the cessation of NAT (inside, outside) dynamic interface

  Internal_access_in in interface internal access-group

  Access-group Outside_access_in in interface outside

  Route outside 0.0.0.0 0.0.0.0 203.106.23.97 1

  Timeout xlate 03:00

  Pat-xlate timeout 0:00:30

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  timeout tcp-proxy-reassembly 0:01:00

  Floating conn timeout 0:00:00

  dynamic-access-policy-registration DfltAccessPolicy

  identity of the user by default-domain LOCAL

  the ssh LOCAL console AAA authentication

  LOCAL AAA authorization command

  Enable http server

  http 192.168.1.0 255.255.255.0 management

  http authentication certificate management

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start

  No vpn sysopt connection permit

  Crypto ipsec ikev2 ipsec-proposal OF

  encryption protocol esp

  Esp integrity sha - 1, md5 Protocol

  Crypto ipsec ikev2 proposal ipsec 3DES

  Esp 3des encryption protocol

  Esp integrity sha - 1, md5 Protocol

  Crypto ipsec ikev2 ipsec-proposal AES

  Esp aes encryption protocol

  Esp integrity sha - 1, md5 Protocol

  Crypto ipsec ikev2 ipsec-proposal AES192

  Protocol esp encryption aes-192

  Esp integrity sha - 1, md5 Protocol

  Crypto ipsec ikev2 AES256 ipsec-proposal

  Protocol esp encryption aes-256

  Esp integrity sha - 1, md5 Protocol

  Crypto ipsec pmtu aging infinite - the security association

  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define ikev2 AES256 AES192 AES 3DES ipsec-proposal OF

  card crypto Outside_map 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

  Outside_map interface card crypto outside

  Crypto ca trustpoint ASDM_TrustPoint0

  Terminal registration

  name of the object CN = ASA

  Configure CRL

  Crypto ca trustpoint Anyconnect_TrustPoint

  registration auto

  name of the object CN = ASA

  anyconnect_rsa key pair

  Configure CRL

  Crypto ca trustpoint _SmartCallHome_ServerCA

  Configure CRL

  trustpool crypto ca policy

  string encryption ca Anyconnect_TrustPoint certificates

  IKEv2 crypto policy 1

  aes-256 encryption

  integrity sha

  Group 2 of 5

  FRP sha

  second life 86400

  IKEv2 crypto policy 10

  aes-192 encryption

  integrity sha

  Group 2 of 5

  FRP sha

  second life 86400

  IKEv2 crypto policy 20

  aes encryption

  integrity sha

  Group 2 of 5

  FRP sha

  second life 86400

  IKEv2 crypto policy 30

  3des encryption

  integrity sha

  Group 2 of 5

  FRP sha

  second life 86400

  IKEv2 crypto policy 40

  the Encryption

  integrity sha

  Group 2 of 5

  FRP sha

  second life 86400

  Crypto ikev2 activate out of service the customer port 443

  Crypto ikev2 access remote trustpoint Anyconnect_TrustPoint

  Telnet timeout 3

  SSH 172.19.88.0 255.255.255.0 internal

  SSH 0.0.0.0 0.0.0.0 outdoors

  SSH timeout 15

  Console timeout 0

  management of 192.168.1.100 - 192.168.1.200 addresses dhcpd

  enable dhcpd management

  !

  a basic threat threat detection

  Statistics-list of access threat detection

  no statistical threat detection tcp-interception

  NTP server 119.110.97.148 prefer external source

  SSL-trust outside Anyconnect_TrustPoint point

  WebVPN

  allow outside

  AnyConnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1

  AnyConnect image disk0:/anyconnect-macosx-i386-2.5.2014-k9.pkg 2

  AnyConnect image disk0:/anyconnect-linux-2.5.2014-k9.pkg 3

  AnyConnect profiles AnyConnect_client_profile disk0: / AnyConnect_client_profile.xml

  AnyConnect enable

  attributes of Group Policy DfltGrpPolicy

  VPN-tunnel-Protocol ikev1, ikev2 ssl clientless ssl ipsec l2tp client

  Split-tunnel-policy tunnelspecified

  value of Split-tunnel-network-list SPLIT_TUNNEL

  Group Policy 'GroupPolicy AnyConnect' internal

  Group Policy attributes "GroupPolicy AnyConnect"

  value of server WINS 172.19.88.11

  value of server DNS 172.19.88.11

  SSL VPN-tunnel-Protocol ikev2 client ssl clientless

  WebVPN

  AnyConnect value AnyConnect_client_profile type user profiles

  attributes global-tunnel-group DefaultWEBVPNGroup

  address pool AnyPool

  tunnel-group "AnyConnect" type remote access

  attributes global-tunnel-group "AnyConnect".

  address pool AnyPool

  strategy-group-by default "GroupPolicy AnyConnect"

  tunnel-group "AnyConnect" webvpn-attributes

  Group-alias "AnyConnect" activate

  !

  class-map inspection_default

  match default-inspection-traffic

  !

  !

  type of policy-card inspect dns preset_dns_map

  parameters

  maximum message length automatic of customer

  message-length maximum 512

  Policy-map global_policy

  class inspection_default

  inspect the preset_dns_map dns

  inspect the ftp

  inspect h323 h225

  inspect the h323 ras

  inspect the rsh

  inspect the rtsp

  inspect esmtp

  inspect sqlnet

  inspect the skinny

  inspect sunrpc

  inspect xdmcp

  inspect the sip

  inspect the netbios

  inspect the tftp

  Review the ip options

  Hi Max,.

  Please send me the output of 'see the anyconnect vpn-sessiondb' once connected with VPN.

  And try to add the following configuration and see if that helps:

  NAT (inside, outside) 1 static source NETWORK_OBJ_172.19.88.0_24 NETWORK_OBJ_172.19.88.0_24 static destination VPN-VPN-POOL no-proxy-arp-route search

  And one more qusetion do you use split tunnel? If yes then you must make the following changes, because your split tunnel is incorrect, in the split tunnel, you have configured the address pool of vpn. Please make the following change:

  no access list SPLIT_TUNNEL standards not allowed 10.0.0.0 255.255.255.0

  Standard access list SPLIT_TUNNEL allow 172.19.88.0 255.255.255.0

  Group Policy attributes "GroupPolicy AnyConnect"

  Split-tunnel-policy tunnelspecified

  value of Split-tunnel-network-list SPLIT_TUNNEL

  Let me know if this can help, or if you have any questions, more about it.

  Thank you

  Jeet Kumar

• No SSH access after upgrade to vSphere 4.1

  Hi all

  Just updated my test environment to vSphere 4.1. Everything seems to work, but when I tried to log in using putty (ssh), I got "access denied" on the user account created specially for this purpose. After connecting the host directly using the VI client, I see users "vmware" sitting there. "Grant shell access to this user" is marked. I tried to reset the password, use a more complex password, created another (vmware2) user with shell access enabled. Nothing helps. I have connection using PuTTY and receive "access denied", as if the account does not have access via SSH.

  I have no easy option for now to log on to the console directly, so I can't enable root access for now as well.

  Has anyone seen this?

  
  
  Visit my blog at http://www.vmdamentals.com

  Hi all

  It comes to the design change in ESX 4.1. According to the design of new power users only for the Service Console and VMkernel directors can connect to the console using ssh. Users without these privileges cannot connect you to the Service Console.

  The same is captured in the documentation. Please check the "Note" in section "Considerations on the upgrade of the post" Upgrade Guide (http://www.vmware.com/pdf/vsphere4/r41/vsp_41_upgrade_guide.pdf).

  Snip of the Document: -.

  < snip >

  NOTE after the upgrade to ESX 4.1, only the user administrator has access to the service console. To grant

  Access service console to other users after upgrade to envisage to grant administrator permissions for

  other users.

  < / snip >