Documentation
VyOS Documentation
VyOS Services
SSH Server

SSH Server

SSH (Secure Shell) is a cryptographic network protocol for securely managing a VyOS system remotely.

Overview

SSH provides:

  • Secure remote connection to the CLI
  • Encryption of all traffic
  • Password- or key-based authentication
  • A replacement for insecure protocols (Telnet, rlogin)

By default, SSH runs on port 22/TCP.

Basic Configuration

Enabling SSH

Minimal configuration:

set service ssh
commit

SSH will listen on all interfaces on port 22.

Setting the Port

Changing the default port:

set service ssh port 2222
commit

Binding to an Address

Restricting to a specific IP address:

set service ssh listen-address 192.168.1.1
commit

Multiple addresses:

set service ssh listen-address 192.168.1.1
set service ssh listen-address 10.0.0.1
set service ssh listen-address 2001:db8::1
commit

Authentication

Password Authentication

Enabled by default. Users can log in with passwords.

Disabling password authentication:

set service ssh disable-password-authentication
commit

Important: Before disabling it, make sure key-based authentication is configured!

SSH Key Authentication

Adding a Public Key for a User

set system login user admin authentication public-keys user@host key 'AAAAB3NzaC1yc2EAAAADAQABAAABAQC...'
set system login user admin authentication public-keys user@host type 'ssh-rsa'
commit

Key types:

  • ssh-rsa - RSA key
  • ssh-dss - DSA key (deprecated, not recommended)
  • ecdsa-sha2-nistp256 - ECDSA 256-bit
  • ecdsa-sha2-nistp384 - ECDSA 384-bit
  • ecdsa-sha2-nistp521 - ECDSA 521-bit
  • ssh-ed25519 - Ed25519 (recommended)

Generating Keys on the Client

On Linux/macOS:

ssh-keygen -t ed25519 -C "user@vyos"

On Windows (PowerShell):

ssh-keygen -t ed25519 -C "user@vyos"

The public key will be stored in the file ~/.ssh/id_ed25519.pub.

Copying the Key to VyOS

From a Linux/macOS client:

ssh-copy-id -i ~/.ssh/id_ed25519.pub vyos@192.168.1.1

Alternatively, copy the contents of id_ed25519.pub manually and add it through the CLI.

Disabling root Login

Root login is disabled by default starting with VyOS 1.2+.

To verify:

show service ssh

Access Control

By User

Allowing only specific users:

set service ssh access-control allow user admin
set service ssh access-control allow user operator
commit

Denying specific users:

set service ssh access-control deny user guest
commit

By Group

Allowing by group:

set service ssh access-control allow group operators
commit

Denying by group:

set service ssh access-control deny group guests
commit

Security Settings

Encryption Algorithms (Ciphers)

Specifying the allowed encryption algorithms:

set service ssh ciphers 'chacha20-poly1305@openssh.com'
set service ssh ciphers 'aes256-gcm@openssh.com'
set service ssh ciphers 'aes128-gcm@openssh.com'
set service ssh ciphers 'aes256-ctr'
set service ssh ciphers 'aes192-ctr'
set service ssh ciphers 'aes128-ctr'
commit

Recommended modern algorithms:

  • chacha20-poly1305@openssh.com - ChaCha20-Poly1305
  • aes256-gcm@openssh.com - AES256-GCM
  • aes128-gcm@openssh.com - AES128-GCM

Not recommended (deprecated):

  • 3des-cbc - Triple DES
  • aes128-cbc, aes192-cbc, aes256-cbc - CBC mode
  • arcfour, arcfour128, arcfour256 - RC4

MAC Algorithms

Message Authentication Code algorithms:

set service ssh mac 'hmac-sha2-512-etm@openssh.com'
set service ssh mac 'hmac-sha2-256-etm@openssh.com'
set service ssh mac 'hmac-sha2-512'
set service ssh mac 'hmac-sha2-256'
commit

Recommended:

  • hmac-sha2-512-etm@openssh.com
  • hmac-sha2-256-etm@openssh.com
  • hmac-sha2-512
  • hmac-sha2-256

Not recommended:

  • hmac-md5 - deprecated
  • hmac-sha1 - considered weak

Key Exchange Algorithms

Key exchange algorithms:

set service ssh key-exchange 'curve25519-sha256@libssh.org'
set service ssh key-exchange 'diffie-hellman-group-exchange-sha256'
set service ssh key-exchange 'ecdh-sha2-nistp521'
set service ssh key-exchange 'ecdh-sha2-nistp384'
set service ssh key-exchange 'ecdh-sha2-nistp256'
commit

Recommended:

  • curve25519-sha256@libssh.org
  • curve25519-sha256
  • diffie-hellman-group-exchange-sha256
  • ecdh-sha2-nistp521

Not recommended:

  • diffie-hellman-group1-sha1 - deprecated
  • diffie-hellman-group14-sha1 - deprecated

Host Key Validation

Disabling host key validation (not recommended for production):

set service ssh disable-host-validation
commit

Brute-Force Attack Protection

Dynamic Protection

Automatic blocking when the failed-attempt limit is exceeded:

set service ssh dynamic-protection
commit

Tuning Protection Parameters

Number of attempts before blocking:

set service ssh dynamic-protection threshold 3
commit

Block duration (seconds):

set service ssh dynamic-protection block-time 600
commit

Address Whitelist

Excluding trusted addresses from protection:

set service ssh dynamic-protection allow-from 192.168.1.0/24
set service ssh dynamic-protection allow-from 10.0.0.100
commit

Configuration Examples

Basic Secure Configuration

# Core settings
set service ssh port 22
set service ssh listen-address 192.168.1.1

# Key-based authentication only
set service ssh disable-password-authentication

# Access control
set service ssh access-control allow user admin
set service ssh access-control allow user operator

# Brute-force protection
set service ssh dynamic-protection
set service ssh dynamic-protection threshold 3
set service ssh dynamic-protection block-time 600

commit

Hardened Security

# Non-standard port
set service ssh port 2222
set service ssh listen-address 192.168.1.1

# Key-based authentication only
set service ssh disable-password-authentication

# Modern encryption algorithms
set service ssh ciphers 'chacha20-poly1305@openssh.com'
set service ssh ciphers 'aes256-gcm@openssh.com'
set service ssh ciphers 'aes128-gcm@openssh.com'

# Modern MAC
set service ssh mac 'hmac-sha2-512-etm@openssh.com'
set service ssh mac 'hmac-sha2-256-etm@openssh.com'

# Modern key exchange
set service ssh key-exchange 'curve25519-sha256@libssh.org'
set service ssh key-exchange 'diffie-hellman-group-exchange-sha256'

# Access control
set service ssh access-control allow user admin

# Attack protection
set service ssh dynamic-protection
set service ssh dynamic-protection threshold 2
set service ssh dynamic-protection block-time 1800
set service ssh dynamic-protection allow-from 192.168.1.0/24

commit

Multiple Ports and Addresses

# Listen on several addresses
set service ssh port 22
set service ssh listen-address 192.168.1.1
set service ssh listen-address 10.0.0.1
set service ssh listen-address 2001:db8::1

# Access control
set service ssh access-control allow group operators

# Basic protection
set service ssh dynamic-protection

commit

Operational Commands

Viewing the Configuration

show service ssh

Viewing SSH Fingerprints

show ssh server-fingerprints

Restarting SSH

restart ssh

Generating Server Keys

generate ssh server-key

Viewing Active Sessions

show users

SSH Logs

show log ssh
monitor log | grep sshd

Connecting to VyOS

From Linux/macOS

Standard connection:

ssh vyos@192.168.1.1

Specifying the port:

ssh -p 2222 vyos@192.168.1.1

Specifying the key:

ssh -i ~/.ssh/id_ed25519 vyos@192.168.1.1

From Windows

PowerShell (Windows 10/11):

ssh vyos@192.168.1.1

PuTTY:

  1. Launch PuTTY
  2. Enter the address: 192.168.1.1
  3. Port: 22 (or yours)
  4. Connection type: SSH
  5. Click “Open”

Troubleshooting

Cannot Connect

Check the SSH status:

show service ssh

Check the firewall:

show firewall

Make sure the port is open:

show firewall ipv4 input filter

Check whether SSH is listening:

netstat -tlnp | grep sshd

Disabled Passwords and Lost Access

If you have console access:

configure
delete service ssh disable-password-authentication
commit

If you have no console access, physical access to the device or a restore from backup will be required.

Key Problems

Check the key format:

show system login user admin authentication public-keys

Check the logs:

show log ssh

Make sure the key is of the correct type (RSA, Ed25519, etc.).

Firewall Blocking

Allow SSH in the firewall:

set firewall ipv4 input filter rule 10 action accept
set firewall ipv4 input filter rule 10 destination port 22
set firewall ipv4 input filter rule 10 protocol tcp
set firewall ipv4 input filter rule 10 source address 192.168.1.0/24
commit

Security and Best Practices

1. Use Key-Based Authentication

Disable passwords:

set service ssh disable-password-authentication

2. Change the Default Port

set service ssh port 2222

This reduces the number of automated attacks.

3. Restrict Access

By user:

set service ssh access-control allow user admin

By address (via firewall):

set firewall ipv4 input filter rule 10 action accept
set firewall ipv4 input filter rule 10 destination port 22
set firewall ipv4 input filter rule 10 protocol tcp
set firewall ipv4 input filter rule 10 source address 192.168.1.0/24

4. Enable Brute-Force Protection

set service ssh dynamic-protection
set service ssh dynamic-protection threshold 3
set service ssh dynamic-protection block-time 600

5. Use Modern Algorithms

Disable deprecated ciphers and MAC algorithms.

6. Monitor the Logs

Review the SSH logs regularly:

show log ssh

7. Use a Jump Host

For critical systems, use a bastion host (jump server) instead of direct access.

8. Rotate Keys Regularly

Regenerate SSH keys periodically (every 1-2 years).

9. Use Strong Keys

Ed25519 or RSA 4096-bit:

ssh-keygen -t ed25519
# or
ssh-keygen -t rsa -b 4096

10. Back Up the Configuration

Always keep a backup of the configuration:

save

Integration with Other Systems

Jump Host / Bastion

Using VyOS as a jump host:

  1. Allow port forwarding in sshd
  2. Connect through ProxyJump:
ssh -J vyos@jumphost.example.com user@internal-server

SSH Agent Forwarding

On the client, add the following to ~/.ssh/config:

Host vyos-router
    HostName 192.168.1.1
    User vyos
    ForwardAgent yes

SSH Certificates (CA)

For large infrastructures, use an SSH Certificate Authority instead of individual keys.

Next Steps

Reviewed by OpenNix LLC · Last updated on
DNS ForwardingNTP Service