# SSH Server

> Configure the SSH server on VyOS: secure remote access, key-based authentication, access control, and brute-force protection for Yandex Cloud and VK Cloud

Source: https://opennix.org/en/docs/vyos/services/vyos-ssh/


SSH (Secure Shell) is a cryptographic network protocol for securely managing a VyOS system remotely.

## Overview

SSH provides:
- Secure remote connection to the CLI
- Encryption of all traffic
- Password- or key-based authentication
- A replacement for insecure protocols (Telnet, rlogin)

By default, SSH runs on port 22/TCP.

## Basic Configuration

### Enabling SSH

Minimal configuration:

```
set service ssh
commit
```

SSH will listen on all interfaces on port 22.

### Setting the Port

Changing the default port:

```
set service ssh port 2222
commit
```

### Binding to an Address

Restricting to a specific IP address:

```
set service ssh listen-address 192.168.1.1
commit
```

Multiple addresses:

```
set service ssh listen-address 192.168.1.1
set service ssh listen-address 10.0.0.1
set service ssh listen-address 2001:db8::1
commit
```

## Authentication

### Password Authentication

Enabled by default. Users can log in with passwords.

Disabling password authentication:

```
set service ssh disable-password-authentication
commit
```

**Important**: Before disabling it, make sure key-based authentication is configured!

### SSH Key Authentication

#### Adding a Public Key for a User

```
set system login user admin authentication public-keys user@host key 'AAAAB3NzaC1yc2EAAAADAQABAAABAQC...'
set system login user admin authentication public-keys user@host type 'ssh-rsa'
commit
```

Key types:
- `ssh-rsa` - RSA key
- `ssh-dss` - DSA key (deprecated, not recommended)
- `ecdsa-sha2-nistp256` - ECDSA 256-bit
- `ecdsa-sha2-nistp384` - ECDSA 384-bit
- `ecdsa-sha2-nistp521` - ECDSA 521-bit
- `ssh-ed25519` - Ed25519 (recommended)

#### Generating Keys on the Client

On Linux/macOS:
```bash
ssh-keygen -t ed25519 -C "user@vyos"
```

On Windows (PowerShell):
```powershell
ssh-keygen -t ed25519 -C "user@vyos"
```

The public key will be stored in the file `~/.ssh/id_ed25519.pub`.

#### Copying the Key to VyOS

From a Linux/macOS client:
```bash
ssh-copy-id -i ~/.ssh/id_ed25519.pub vyos@192.168.1.1
```

Alternatively, copy the contents of `id_ed25519.pub` manually and add it through the CLI.

### Disabling root Login

Root login is disabled by default starting with VyOS 1.2+.

To verify:
```
show service ssh
```

## Access Control

### By User

Allowing only specific users:

```
set service ssh access-control allow user admin
set service ssh access-control allow user operator
commit
```

Denying specific users:

```
set service ssh access-control deny user guest
commit
```

### By Group

Allowing by group:

```
set service ssh access-control allow group operators
commit
```

Denying by group:

```
set service ssh access-control deny group guests
commit
```

## Security Settings

### Encryption Algorithms (Ciphers)

Specifying the allowed encryption algorithms:

```
set service ssh ciphers 'chacha20-poly1305@openssh.com'
set service ssh ciphers 'aes256-gcm@openssh.com'
set service ssh ciphers 'aes128-gcm@openssh.com'
set service ssh ciphers 'aes256-ctr'
set service ssh ciphers 'aes192-ctr'
set service ssh ciphers 'aes128-ctr'
commit
```

Recommended modern algorithms:
- `chacha20-poly1305@openssh.com` - ChaCha20-Poly1305
- `aes256-gcm@openssh.com` - AES256-GCM
- `aes128-gcm@openssh.com` - AES128-GCM

Not recommended (deprecated):
- `3des-cbc` - Triple DES
- `aes128-cbc`, `aes192-cbc`, `aes256-cbc` - CBC mode
- `arcfour`, `arcfour128`, `arcfour256` - RC4

### MAC Algorithms

Message Authentication Code algorithms:

```
set service ssh mac 'hmac-sha2-512-etm@openssh.com'
set service ssh mac 'hmac-sha2-256-etm@openssh.com'
set service ssh mac 'hmac-sha2-512'
set service ssh mac 'hmac-sha2-256'
commit
```

Recommended:
- `hmac-sha2-512-etm@openssh.com`
- `hmac-sha2-256-etm@openssh.com`
- `hmac-sha2-512`
- `hmac-sha2-256`

Not recommended:
- `hmac-md5` - deprecated
- `hmac-sha1` - considered weak

### Key Exchange Algorithms

Key exchange algorithms:

```
set service ssh key-exchange 'curve25519-sha256@libssh.org'
set service ssh key-exchange 'diffie-hellman-group-exchange-sha256'
set service ssh key-exchange 'ecdh-sha2-nistp521'
set service ssh key-exchange 'ecdh-sha2-nistp384'
set service ssh key-exchange 'ecdh-sha2-nistp256'
commit
```

Recommended:
- `curve25519-sha256@libssh.org`
- `curve25519-sha256`
- `diffie-hellman-group-exchange-sha256`
- `ecdh-sha2-nistp521`

Not recommended:
- `diffie-hellman-group1-sha1` - deprecated
- `diffie-hellman-group14-sha1` - deprecated

### Host Key Validation

Disabling host key validation (not recommended for production):

```
set service ssh disable-host-validation
commit
```

## Brute-Force Attack Protection

### Dynamic Protection

Automatic blocking when the failed-attempt limit is exceeded:

```
set service ssh dynamic-protection
commit
```

### Tuning Protection Parameters

Number of attempts before blocking:

```
set service ssh dynamic-protection threshold 3
commit
```

Block duration (seconds):

```
set service ssh dynamic-protection block-time 600
commit
```

### Address Whitelist

Excluding trusted addresses from protection:

```
set service ssh dynamic-protection allow-from 192.168.1.0/24
set service ssh dynamic-protection allow-from 10.0.0.100
commit
```

## Configuration Examples

### Basic Secure Configuration

```
# Core settings
set service ssh port 22
set service ssh listen-address 192.168.1.1

# Key-based authentication only
set service ssh disable-password-authentication

# Access control
set service ssh access-control allow user admin
set service ssh access-control allow user operator

# Brute-force protection
set service ssh dynamic-protection
set service ssh dynamic-protection threshold 3
set service ssh dynamic-protection block-time 600

commit
```

### Hardened Security

```
# Non-standard port
set service ssh port 2222
set service ssh listen-address 192.168.1.1

# Key-based authentication only
set service ssh disable-password-authentication

# Modern encryption algorithms
set service ssh ciphers 'chacha20-poly1305@openssh.com'
set service ssh ciphers 'aes256-gcm@openssh.com'
set service ssh ciphers 'aes128-gcm@openssh.com'

# Modern MAC
set service ssh mac 'hmac-sha2-512-etm@openssh.com'
set service ssh mac 'hmac-sha2-256-etm@openssh.com'

# Modern key exchange
set service ssh key-exchange 'curve25519-sha256@libssh.org'
set service ssh key-exchange 'diffie-hellman-group-exchange-sha256'

# Access control
set service ssh access-control allow user admin

# Attack protection
set service ssh dynamic-protection
set service ssh dynamic-protection threshold 2
set service ssh dynamic-protection block-time 1800
set service ssh dynamic-protection allow-from 192.168.1.0/24

commit
```

### Multiple Ports and Addresses

```
# Listen on several addresses
set service ssh port 22
set service ssh listen-address 192.168.1.1
set service ssh listen-address 10.0.0.1
set service ssh listen-address 2001:db8::1

# Access control
set service ssh access-control allow group operators

# Basic protection
set service ssh dynamic-protection

commit
```

## Operational Commands

### Viewing the Configuration

```
show service ssh
```

### Viewing SSH Fingerprints

```
show ssh server-fingerprints
```

### Restarting SSH

```
restart ssh
```

### Generating Server Keys

```
generate ssh server-key
```

### Viewing Active Sessions

```
show users
```

### SSH Logs

```
show log ssh
monitor log | grep sshd
```

## Connecting to VyOS

### From Linux/macOS

Standard connection:
```bash
ssh vyos@192.168.1.1
```

Specifying the port:
```bash
ssh -p 2222 vyos@192.168.1.1
```

Specifying the key:
```bash
ssh -i ~/.ssh/id_ed25519 vyos@192.168.1.1
```

### From Windows

PowerShell (Windows 10/11):
```powershell
ssh vyos@192.168.1.1
```

PuTTY:
1. Launch PuTTY
2. Enter the address: `192.168.1.1`
3. Port: `22` (or yours)
4. Connection type: SSH
5. Click "Open"

## Troubleshooting

### Cannot Connect

Check the SSH status:
```
show service ssh
```

Check the firewall:
```
show firewall
```

Make sure the port is open:
```
show firewall ipv4 input filter
```

Check whether SSH is listening:
```
netstat -tlnp | grep sshd
```

### Disabled Passwords and Lost Access

If you have console access:

```
configure
delete service ssh disable-password-authentication
commit
```

If you have no console access, physical access to the device or a restore from backup will be required.

### Key Problems

Check the key format:
```
show system login user admin authentication public-keys
```

Check the logs:
```
show log ssh
```

Make sure the key is of the correct type (RSA, Ed25519, etc.).

### Firewall Blocking

Allow SSH in the firewall:

```
set firewall ipv4 input filter rule 10 action accept
set firewall ipv4 input filter rule 10 destination port 22
set firewall ipv4 input filter rule 10 protocol tcp
set firewall ipv4 input filter rule 10 source address 192.168.1.0/24
commit
```

## Security and Best Practices

### 1. Use Key-Based Authentication

Disable passwords:
```
set service ssh disable-password-authentication
```

### 2. Change the Default Port

```
set service ssh port 2222
```

This reduces the number of automated attacks.

### 3. Restrict Access

By user:
```
set service ssh access-control allow user admin
```

By address (via firewall):
```
set firewall ipv4 input filter rule 10 action accept
set firewall ipv4 input filter rule 10 destination port 22
set firewall ipv4 input filter rule 10 protocol tcp
set firewall ipv4 input filter rule 10 source address 192.168.1.0/24
```

### 4. Enable Brute-Force Protection

```
set service ssh dynamic-protection
set service ssh dynamic-protection threshold 3
set service ssh dynamic-protection block-time 600
```

### 5. Use Modern Algorithms

Disable deprecated ciphers and MAC algorithms.

### 6. Monitor the Logs

Review the SSH logs regularly:
```
show log ssh
```

### 7. Use a Jump Host

For critical systems, use a bastion host (jump server) instead of direct access.

### 8. Rotate Keys Regularly

Regenerate SSH keys periodically (every 1-2 years).

### 9. Use Strong Keys

Ed25519 or RSA 4096-bit:
```bash
ssh-keygen -t ed25519
# or
ssh-keygen -t rsa -b 4096
```

### 10. Back Up the Configuration

Always keep a backup of the configuration:
```
save
```

## Integration with Other Systems

### Jump Host / Bastion

Using VyOS as a jump host:

1. Allow port forwarding in sshd
2. Connect through ProxyJump:

```bash
ssh -J vyos@jumphost.example.com user@internal-server
```

### SSH Agent Forwarding

On the client, add the following to `~/.ssh/config`:

```
Host vyos-router
    HostName 192.168.1.1
    User vyos
    ForwardAgent yes
```

### SSH Certificates (CA)

For large infrastructures, use an SSH Certificate Authority instead of individual keys.

## Next Steps

- [HTTPS/API](/docs/vyos/services/vyos-https/) - web interface and REST API
- [Firewall](/docs/vyos/firewall/) - configuring SSH access
- [System Login](/docs/vyos/system/vyos-login/) - user management