Now, as demonstrated in a separate video, Telnet sends traffic in clear text and passwords and data
can easily be captured on the wire
so it's better to use SSH.
So as an example, I'll capture the traffic between router 1 and router 2
and for comparison, I'll do a telnet to router 2 from router 1 and log in with my username and
password. In Wireshark
I can simply filter for telnet
and in the output, I'll be able to capture the password, which is C I S C O
in other words, Cisco
but more than that, if the user typed a command such as show run and looked at the running-config
of the router or did any kind of configuration, all of that is sent in clear text so a hacker could
simply search for the data.
So there is an example is the prompt of the router after log in
and searching through the data we can see show run
and here's the current config of the router, so we are able to view the full configuration of the routers.
As an example, there's an IP address on an interface,
scrolling down,
more configuration.
If there were passwords on the console or other ports, we'd be able to see those passwords.
So as an example, is the password on the VTI line. I could also simply look at the TCP session
and the full configuration of the router is simply displayed
through Wireshark, so not a great way to manage devices when someone sniffing the network can capture
the traffic.
This is more of a problem when you're using a public network such as the Internet, then your local
network
but it's important to be aware that Telnet sends traffic in clear text.
So we want to enable secure shell or SSH and to do that we firstly have to specify a hostname.
It cannot be the default off switch or router the name was or two, but I've reset it just for completeness
to show you the command.
So you have to set a hostname and then you have to specify a domain name.
Which is required for the generation of keys, so specify some kind of domain name.
I'll use Cisco.com, you have to have a username.
Now I have already configured a username of David
and a password, but I'll just do that again for completeness and then we have to generate keys.
So crypto key,
generate
RSA,
specify modulus and then specify size.
That should have been 1024, so let me do that again, the larger the size of the key, the more secure
the transmission of data.
So the modular sizes from 360 to 2048 and once again, I specified 1024.
The router will then generate what are called private and public keys.
So as you can see here, the keys are going to be replaced because I'm regenerating them.
A private key means a key that you don't share.
It's private to yourself, a public key is derived from a private key
and that's what you share with everyone else in secure communications.
So if you want to send something to me that no one else can read, you would encrypt it with my public
key, which means that only my private key can decrypt it.
If I want to send something to you that only you can read, I would encrypt it with your public key and
only your private key can decrypt it.
A public key is derive from a private key.
Something encrypted with a public key can only be decrypted by the relevant private key.
So if you encrypt something with my public key, only my private key can decrypt it now on the VTY lines.
We can specify transport input and specify protocol, and I'll specify telnet and SSH.
For security reasons, you may only want to allow SSH rather than Telnet and SSH, specify log in local
so that the local username and password database is used and then specify a version of SSH. Version
2 is more secure than version 1 show IP SSH, which we can see that SSH is now enabled.
Show SSH there are no connections at the moment.
Now I can still telnet to the router because we allowed telnet sessions
but if we did the following on VTY 04 transport input SSH
Telnet sessions would no longer be allowed, so show run, pipe, begin, vty,
we're using log in local, so this is not required.
We are only allowing SSH sessions and inactive sessions will time out after five minutes.
So SSH, we have a few options
I'm gonna specify 10.1.1.2 notice no user is specified.
We have to specify a user, so I'm going to say, David, and then the IP address of the router.
Now I can log in, in Wireshark, we're still capturing so if we search for SSH now
we can see SSH traffic.
We can see the encryption used in this case, it's aes hmac sha1.
Don't worry too much about that at the moment, that's discussed in more detail in the VPN section.
There's some key exchanges taking place.
Deffie hellman keys are used here, so we can see all the negotiation between the two devices
but once that's taken place, we won't be able to see the data.
Notice the data is encrypted.
So as an example, I'll type show run.
There is the full
running-config,
in Wireshark
we can't see the data, we just see encrypted output here.
So a hacker would not be able to view the data.
The hacker would only know that there's an SSA session from one device to the other.
So in other words, in this example, 10.1.1.2 is SSH to 10.
One, one, two.
The source port number is this the destination port number is 22.
In other words, SSH, notice how that is different to a telnet session.
In a telnet session, we can see all the data in clear text, so it's much better to use SSH and it's
better to restrict access to your devices to the use of SSH.
PuTTy is free software that you can download from the Internet and it supports both Telnet and SSH
but uses SSH by default.
So if you're on a Windows machine, download PuTTy, if you're using a Mac or a Linux machine, SSH
is built into the operating system.
If you're on a router or switch, you can simply use the SSH client on the Cisco device.
So let's SSH back from router 1 to router 2 put in the password I've logged in show IP SSH,
we can see that the version of SSH is version 2.1, once again show SSH, which we can see that a session
has been started by username David in connection, out connection.
aes 128 bit encryption and authentication is Sha1,
Sha is a hashing algorithm similar to MD5,
eas is an encryption algorithm similar to DES or triple DES, but it's a lot better than those protocols.
No SSH version 1 server is running only version 2 is running and we have these connections to the
the router when I log out.
Show SSH, we can see that no SSH connections are running.
Once again in Wireshark,
everything is encrypted.
So we can see the encrypted packet, but we can't see any data that makes up that encrypted packet.