SSH

SSH server configuration for NX-OS devices. This section controls SSH protocol settings including ciphers, key exchange algorithms, message authentication codes, login behavior, and host key generation. SSH requires the ssh feature to be enabled.

Diagram

Classes

system (nxos.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
ssh	Class	[ssh]	No

ssh (nxos.devices.configuration.system)

Name	Type	Constraint	Mandatory	Default Value
ciphers_all	Boolean	true, false	No
ciphers_weak	Boolean	true, false	No
kexalgos_all	Boolean	true, false	No
keytypes_all	Boolean	true, false	No
login_attempts	Integer	min: 1, max: 10	No
login_gracetime	Integer	min: 0, max: 3600	No
macs_all	Boolean	true, false	No
port	Integer	min: 22, max: 65535	No
keys	List	[keys]	No

keys (nxos.devices.configuration.system.ssh)

Name	Type	Constraint	Mandatory	Default Value
type	Choice	rsa, dsa, ecdsa	Yes
key_length	Integer	min: 0, max: 4096	No

Examples

Example 1: Basic SSH hardening with weak ciphers disabled

nxos:
  devices:
    - name: LEAF1
      configuration:
        system:
          ssh:
            ciphers_weak: false
            login_attempts: 3
            login_gracetime: 60

Example 2: SSH with custom port and key generation

nxos:
  devices:
    - name: LEAF1
      configuration:
        system:
          ssh:
            port: 2222
            login_attempts: 3
            login_gracetime: 120
            keys:
              - type: rsa
                key_length: 2048
              - type: ecdsa
                key_length: 256

Example 3: Full SSH hardening configuration

nxos:
  devices:
    - name: LEAF1
      configuration:
        system:
          ssh:
            ciphers_all: true
            ciphers_weak: false
            kexalgos_all: true
            keytypes_all: true
            macs_all: true
            login_attempts: 3
            login_gracetime: 60
            port: 22
            keys:
              - type: rsa
                key_length: 2048
              - type: ecdsa
                key_length: 521