Enabling Secure access with SSH
In order to be able to enable SSH access to a switch, you first need to make sure you have an IOS crypto image installed on the switch. I usually do not configure SSH or telnet on my switches. Being a paranoid Sys Admin, I prefer y switches to only be accessible from a console switch, on a secure management network. That being said, it's sometimes handy to have SSH enabled on a switch. Here's how you do it.
1. Set a hostname and default domain
conf t hostname somehostname ip domain-name somedomain.com
2. Generate the crypto keys
cry key generate rsa
Choose 1024 minimum!
3. Set SSH parameters
ip ssh time-out 60 ip ssh authentication-retries 2
4. Create a username and password to log on with
aaa new-model aaa authentication login local_auth local username someuser secret somepassword
5. Enable SSH and disable telnet
line vty 0 4 login authentication local_auth transport input ssh line vty 5 15 transport input ssh login authentication local_auth end
6. Write your changes to flash