| 13.4 |  | System Maintenance via Remote Access |
| 13.4.2 |  | SSH connections to the PIX Security Appliance |

| Secure Shell (SSH) provides another option for remote management of the PIX Security Appliance. SSH provides a higher degree of security than Telnet, which provides lower-layer encryption and application security. The PIX Security Appliance supports the SSH remote functionality, as provided in SSH version 1, which includes strong authentication and encryption capabilities. SSH, an application running on top of a reliable transport layer such as TCP, supports logging onto another computer over a network, executing commands remotely, and moving files from one host to another.

Both ends of an SSH connection are authenticated, and passwords are protected by being encrypted. Since SSH uses Rivet, Shamir, and Adleman (RSA) public key cryptography, an Internet encryption and authentication system, it is necessary to generate an RSA key-pair for the PIX Security Appliance before clients can connect to the PIX Security Appliance console. The PIX Security Appliance must also have a Data Encryption Standard (DES) or Triple-Data Encryption Standard (3DES) activation key.

The PIX Security Appliance allows up to five SSH clients to simultaneously access its console. Specific hosts or networks can be defined that are authorized to initiate an SSH connection to the PIX Security Appliance. This is also an addition to how long a session can remain idle before being disconnected.

The corresponding demonstration activity illustrates how to configure SSH access to the PIX Security Appliance. The Command Reference then looks in more detail at the commands that must be applied to the PIX in order to enable it to support the SSH remote access functionality.

The PIX Security Appliance SSH implementation provides a secure remote shell session without IPSec, and only functions as a server, which means that the PIX Security Appliance cannot initiate SSH connections.

Once a PIX Security Appliance has been configured to support remote access to it via SSH, it is then useful for an administrator to know how to verify and troubleshoot SSH connections. The Command Reference looks at some of the most common commands used for this purpose.

| Media Activity Demonstration Activity: Configuring SSH Access on the PIX Security Appliance In this activity, students will learn about how to configure SSH access on the PIX Security Appliance.