Cisco SSH setup steps everyone forgets

telnet is the reason your password is everyone's password

if you've ever managed a cisco switch or router over telnet, i've got bad news. every keystroke, including your enable password, travels across the network in plaintext. anyone with a span port, a hub (yes those still exist in weird places), or access to a compromised device on the path can just read it off the wire. ssh fixes this by encrypting the whole session. but here's the thing, half the "how to enable ssh on cisco" tutorials skip steps that make ssh actually work, and people end up locked out or still running telnet as a fallback without realizing it. let's fix that properly.

step one: give the device an identity

rsa keys need something to be generated from, and cisco ties that to the hostname and domain name. skip this and the key generation command just fails silently or refuses to run.

hostname corerouter1
ip domain-name asarmiento85.local

this isn't cosmetic. the hostname and domain name get combined to create the key's identity. if you rename the device later, the ssh key doesn't automatically update, so keep that in mind during audits or rebuilds.

step two: generate the actual keys

crypto key generate rsa modulus 2048

this is the command that actually turns ssh on behind the scenes on most ios versions. modulus 2048 means a 2048-bit rsa key, which is the current reasonable minimum. going lower (512 or 1024) is still allowed on older ios images and it's a real finding auditors will flag, because those key sizes are crackable with modern hardware. if you're checking an existing device, run:

show crypto key mypubkey rsa

if you see a small modulus or no key at all, that's your sign someone set this up in a hurry.

step three: stop relying on a shared password

a lot of old configs still use a single "line password" for vty access, which means everyone who logs in shares one credential and you have zero accountability. local user accounts fix that.

username netadmin secret StrongUniquePassphrase!

use secret, not password. secret hashes the credential with md5 or better depending on ios version, password stores it reversibly. this is one of those defaults that quietly undermines everything else you just configured.

step four: turn off ssh version 1 and lock the vty lines

ip ssh version 2
line vty 0 4
 login local
 transport input ssh

ssh version 1 has known weaknesses and shouldn't be running anywhere in 2024, but plenty of devices still default to allowing both versions for compatibility. forcing version 2 closes that gap.

login local tells the vty lines to authenticate against the local username database instead of a shared line password. transport input ssh is the step people forget most, because without it, telnet is still silently accepted alongside ssh even after you did everything else right. if you only remember one line from this whole post, make it this one.

the takeaway

ssh on cisco gear isn't one command, it's a chain: identity, keys, real user accounts, protocol version, and transport restrictions. skip any link and you either lock yourself out or leave telnet quietly accepting connections in the background. go audit your own devices right now with show run | include transport input and show ip ssh. if you find telnet still allowed or ssh version 1 enabled, you found your own exposure before someone else did. that's the whole job.