You can secure the virtual terminal lines on Cisco devices in the same way that the console line is secured, using a password, or a username and password. The EXEC timeout is also configured the same way. By default, Telnet sessions are allowed if a password is configured.
你可以用與保護主控台線路相同的方式，使用密碼或使用者名稱與密碼，來保護 Cisco 裝置上的虛擬終端機線路。EXEC 逾時的設定方式也相同。預設情況下，只要設定了密碼，即允許 Telnet 工作階段。
Virtual terminal password configuration:
虛擬終端機密碼設定：
EXEC timeout:
EXEC 逾時：
Switch(config-line)# exec-timeout 5The line vty 0 15 command, followed by the login and password subcommands, requires login and establishes a login password on incoming Telnet sessions.
line vty 0 15 命令搭配 login 與 password 子命令，會要求登入，並為傳入的 Telnet 工作階段建立登入密碼。
The exec-timeout command prevents users from remaining connected to a vty line when the line is idle. In the example, when no user input is detected on a vty line for 5 minutes, the vty session is automatically disconnected.
exec-timeout 命令可防止使用者在 vty 線路閒置時持續保持連線。在此範例中，若 vty 線路在 5 分鐘內未偵測到任何使用者輸入，該 vty 工作階段將被自動中斷連線。
You can use the login local command to require a username and password as vty line credentials, the same as you can for the console line. The username and password or secret password are specified with the username global configuration command.
你可以使用 login local 命令，要求使用者名稱與密碼作為 vty 線路的憑證，方式與主控台線路相同。使用者名稱與密碼，或 secret 密碼，是透過 username 全域設定命令指定的。
To configure the secret password in the username command and require it for access to the vty lines:
在 username 命令中設定 secret 密碼，並要求其用於 vty 線路的存取：
Switch(config)# username cisco secret C1sco123
Switch(config)# line vty 0 15
Switch(config-line)# login localHowever, devices such as switches and routers are usually accessed via SSH, which needs to be configured on the device first.
然而，交換器與路由器等裝置通常是透過 SSH 存取的，而 SSH 需要先在裝置上進行設定。
SSH configuration:
SSH 設定：
To configure SSH on a Cisco switch or router, you need to complete these steps:
若要在 Cisco 交換器或路由器上設定 SSH，你需要完成以下步驟：
- Use the
hostnamecommand to configure the hostname of the device so that it is not Switch (on a Cisco switch) or Router (on a Cisco router).使用hostname命令設定裝置的主機名稱，使其不再是預設的 Switch（Cisco 交換器）或 Router（Cisco 路由器）。 - Configure the Domain Name System (DNS) domain with the
ip domain-namecommand. The domain name is required to be able to generate certificate keys.使用ip domain-name命令設定網域名稱系統（DNS）網域。產生憑證金鑰需要此網域名稱。 - Generate RSA keys that will be used for authentication. Use the
crypto key generate rsacommand; you will also need to configure the modulus that defines the key length.產生將用於驗證的 RSA 金鑰。使用crypto key generate rsa命令；你也需要設定定義金鑰長度的模數。 - Configure the user credentials that the user will use for authentication, using the
usernameusernamesecretpassword command.使用usernameusernamesecretpassword 命令，設定使用者將用於驗證的憑證。 - Specify the
login localcommand for vty lines, so that it will use locally defined credentials for authentication.為 vty 線路指定login local命令，使其使用本地定義的憑證進行驗證。 - By default, Telnet is allowed. To limit access to a device to users that use SSH and block Telnet, use the
transport input sshmode command. If you want to support login banners and enhanced security encryption algorithms, force SSH version 2 (SSHv2) on your device with thessh version 2command in global configuration mode.預設情況下允許 Telnet。若要限制僅使用 SSH 的使用者存取裝置並封鎖 Telnet，請使用transport input ssh模式命令。若你想支援登入橫幅與增強的安全加密演算法，請在全域設定模式中使用ssh version 2命令，強制裝置使用 SSH 第 2 版（SSHv2）。
To display the version and configuration data for SSH on the device that you configured as an SSH server, use the show ip ssh command. In the example, SSHv2 is enabled.
若要顯示你所設定的 SSH 伺服器裝置上的 SSH 版本與設定資料，請使用 show ip ssh 命令。在此範例中，已啟用 SSHv2。
To check the SSH connection to the device, use the show ssh command.
若要檢查與裝置的 SSH 連線，請使用 show ssh 命令。
SSH and Telnet provide remote console access, but unlike Telnet, SSH is designed to provide privacy, data integrity, and origin authentication. SSH version 1 (SSHv1) introduced better cryptographic security features compared with Telnet. After its introduction, a vulnerability was found in the implementation of SSHv1. Therefore, a second version with additional security features, SSHv2, was introduced and adopted. SSHv1 is legacy and obsolete. The key exchange methodology that is used by SSHv2 is more complex, using Diffie-Hellman. You will be presented the connection process of SSHv1 for simplicity.
SSH 與 Telnet 都提供遠端主控台存取，但與 Telnet 不同的是，SSH 的設計目的是提供隱私性、資料完整性與來源驗證。SSH 第 1 版（SSHv1）引入了比 Telnet 更好的加密安全功能。在推出後，SSHv1 的實作中被發現存在一項弱點。因此，具備額外安全功能的第二版 SSHv2 隨後推出並被廣泛採用。SSHv1 已屬過時且遭淘汰。SSHv2 所使用的金鑰交換方法更為複雜，採用了 Diffie-Hellman 演算法。為求簡化，這裡將呈現 SSHv1 的連線過程。
SSHv1 uses asymmetric encryption to facilitate symmetric key exchange. Computationally expensive asymmetric encryption is only required for a small step in the negotiation process. After key exchange, a much more computationally efficient symmetric encryption is used for bulk data encryption between the client and server.
SSHv1 使用非對稱加密來促成對稱金鑰交換。運算成本較高的非對稱加密僅用於協商過程中的一小步驟。金鑰交換完成後，用戶端與伺服器之間的大量資料加密會改用運算效率高得多的對稱加密。
The connection process used by SSHv1 is as follows:
SSHv1 所使用的連線過程如下：
- The client connects to the server and the server presents the client with its public key.用戶端連線至伺服器，伺服器向用戶端提供其公開金鑰。
- The client and server negotiate the security transforms. The two sides agree to a mutually supported symmetric encryption algorithm. This negotiation occurs in the clear. A party that intercepts the communication will be aware of the encryption algorithm that is agreed upon.用戶端與伺服器協商安全轉換方式。雙方就一種彼此都支援的對稱加密演算法達成共識。此協商過程是以明文進行的，攔截通訊的一方將能得知雙方所同意使用的加密演算法。
- The client constructs a session key of the appropriate length to support the agreed-upon encryption algorithm. The client encrypts the session key with the server public key. Only the server has the appropriate private key that can decrypt the session key.用戶端建立一把長度適當的工作階段金鑰，以支援雙方協議的加密演算法。用戶端使用伺服器的公開金鑰加密此工作階段金鑰。只有伺服器擁有能夠解密該工作階段金鑰的對應私密金鑰。
- The client sends the encrypted session key to the server. The server decrypts the session key using its private key. At this point, both the client and the server have the shared session key. That key is not available to any other system. From this point on, the session between the client and server is encrypted using a symmetric encryption algorithm.用戶端將加密後的工作階段金鑰傳送給伺服器。伺服器使用其私密金鑰解密該工作階段金鑰。此時，用戶端與伺服器都擁有此共享的工作階段金鑰，且此金鑰不會提供給任何其他系統。從此刻起，用戶端與伺服器之間的工作階段將使用對稱加密演算法進行加密。
- With privacy in place, user authentication ensues. The user’s credentials and all other data are protected.在隱私性到位之後，接著進行使用者驗證。使用者的憑證及所有其他資料都受到保護。
Not only does the use of asymmetric encryption facilitate symmetric key exchange, it also facilitates peer authentication. If the client is aware of the server’s public key, it would recognize if it connected to a nonauthentic system when the nonauthentic system provided a different public key. The nonauthentic system cannot provide the real server’s public key because it does not have the corresponding private key. While the ability to provide peer authentication is certainly a step in the right direction, the responsibility is generally put on the user to have prior knowledge of the server’s public key. When the SSH client software connects to a new server for the first time, it will generally display the server’s public key (or a hash of the server’s public key) to the user. The client software will only continue if the user authorizes the server’s public key.
使用非對稱加密不僅促成了對稱金鑰交換，也促成了對等驗證。若用戶端已知伺服器的公開金鑰，當連線到的是一個非合法系統、並提供了不同的公開金鑰時，用戶端便能察覺此情況。非合法系統無法提供真正伺服器的公開金鑰，因為它沒有對應的私密金鑰。雖然提供對等驗證的能力確實是朝正確方向邁出的一步，但通常需要由使用者自行事先了解伺服器的公開金鑰。當 SSH 用戶端軟體首次連線到新的伺服器時，通常會向使用者顯示伺服器的公開金鑰（或其雜湊值）。用戶端軟體只有在使用者授權該伺服器的公開金鑰後，才會繼續進行連線。
| Configure the hostname, the DNS domain, and create a user with a secret on the device.在裝置上設定主機名稱、DNS 網域，並建立具有 secret 的使用者。 | Step 1步驟 1 |
Generate new RSA keys with the crypto key generate rsa modulus 2048 command.使用 crypto key generate rsa modulus 2048 命令產生新的 RSA 金鑰。 | Step 4步驟 4 |
| Configure the vty line to allow access to the device via SSH.設定 vty 線路以允許透過 SSH 存取裝置。 | Step 2步驟 2 |
| Configure support for SSH version 2.設定支援 SSH 第 2 版。 | Step 3步驟 3 |