As demonstrated in a separate video Telenet sends traffic in clear text and passwords and data can easily
be captured on the wire.
So it's better to use S-sh
as an example or capture the traffic between Ronald one and wrote it to
and for comparison.
I'll do a telnet to read it to from router 1 and log in with my username and password in y shock.
I can simply filter for telnet and in the output I'll be able to capture the password which is c i s
CEO and other with Cisco.
But more than that if they use a top to come on such a show run and looked at the running config of
the Rodda or did any kind of configuration.
All of that is sent in clear text.
So a hacker could simply search for the data.
So there is an example as the prompt of the Rodda off the log in and searching through the data we can
see show run and here's the current config of the Rodda.
So we are able to view the full configuration of the rattus as an example there's an IP address on an
interface
scrolling down more configuration if there were passwords on the console or other ports we'd be able
to see those passwords.
So as an example is the password on the Viti wireline.
I could also simply look at the TCAP session and the full configuration of the Rodda is simply displayed
through Y shock.
So not a great way to manage devices when someone sniffing the network can capture the traffic.
This is more of a problem when you are using a public network such as the Internet than your local network.
But it's important to be aware that telnet sends traffic clear text.
So we want to enable secure shell or S-sh and to do that we firstly have to specify a hostname.
It cannot be the default of switch or router.
The name was ATI but I've reset it just for completeness to show you the command.
So you have to set a hostname and then you have to specify a domain name.
Which is required for the generation of kids so specify some kind of domain name I'll use Cisco dot
com.
You have to have a user name.
Now I've already configured a user name of David
and a password but I'll just do that again for completeness.
And then we have to generate keys.
So crypto key to generate RSA specify modulus and then specify size that should be in 1024 So let me
do that again.
The larger the size of the key the more secure the transmission of data.
So the modular sizes from 360 to 2048 and once again I specified 1024 the ratable then generate what
are called private and public keys.
So as you can see here the keys are going to be replaced because I'm regenerating them a private key
means a key that you don't share it's private to yourself a public key is derived from a private key.
And that's what you share with everyone else in secure communications.
So if you want to send something to me that no one else can read you would encrypt it with my public
key which means that only my private key can decrypt it if I want to send something to you that only
you can read I would encrypt it with your public key and only your private key can decrypt it.
A public key is derived from my private key something encrypted with a public key can only be decrypted
by the relevant private key.
So if you encrypt something with my public key only my private key can decrypt it.
Now on the V-twin Why lines we can specify transport input and specify protocol and I'll specify telnet
and S-sh for security reasons you may only want to allow S-sh rather than telnet and S-sh specified
log in local.
So the local username and password databases used and then specify a version of S-sh version 2 is more
secure than Version 1 show.
IP S-sh we can see that S-sh is now enabled show S-sh they are no connections at the moment.
Now I can still telnet to the Rodda because we allowed telnet sessions
but if we did the following line Vittie y 0 for transport input S-sh telnet sessions would no longer
be allowed.
So show run pipe begin Viti why we're using log in local.
So this is not required.
We are only allowing S-sh sessions and interactive sessions will timeout after five minutes.
So S-sh we have a few options to specify 10 1 one to notice.
No user is specified.
We have to specify a user.
So I'm going to say David.
And then the IP address of the Rodda.
Now I can log in NY shock we still capturing if we search for S-sh now we can see S-sh traffic we can
see the encryption used in this case it's a mess a Schumacher Shaw one don't worry too much about that
at the moment that's discussed in more detail in the VPN section.
There are some key exchanges taking place Diffie Hellman keys are used here.
So we can see all the negotiation between the two devices.
But once that's taken place we won't be able to see the data.
Notice the data is encrypted so as an example I'll type show run
is the fool running config
in shock we can't see the data.
We just see encrypted output here.
So a hacker would not be able to view the data.
The hacker would only know that there's an S-sh session from one device to the other.
So in other words in this example 10 1 1 1 is 10 1 1 2 the source port number is this the destination
port number is 22.
In other words S-sh.
Notice how that is different to a telnet session
in a telnet session.
We can see all the data in clear text.
So it's much better to use S-sh and it's better to restrict access to your devices to the use of S-sh
putty is free software that you can download from the internet and it supports both telnet and S-sh
but uses S-sh by default.
So if you're on a Windows machine download puttee if you using a Mac or Linux machine is SH's built
into the operating system.
If you are on a road or a switch you can simply use the S-sh client on the Cisco device.
So let's S-sh back from Rotto one to router to put in the password plugged in show IP S-sh we can see
that the version of S-sh is version 2.
Once again show S-sh we can see that a session has been started by user named David inconnection our
connection.
We can see the encryption.
Yes 128 bit encryption and authentication is Schaal one.
Shaw is a hashing algorithm similar to M.D five is ending corruption algorithm similar to days or triple
days but it's a lot better than those protocols.
No S-sh version 1 server is running only version 2 is running and we have these connections to the Rodda
when I log out show S-sh we can see that no such connections are running once again in why Shawk
everything is encrypted so we can see the encrypted packet but we can't see any data that makes up that
encrypted packet.