SSH

SSH server configuration for NX-OS devices. This section controls SSH protocol settings including ciphers, key exchange algorithms, message authentication codes, login behavior, and host key generation. SSH requires the ssh feature to be enabled.

Diagram

Diagram

Classes

nxos

Name	Type	Constraint	Mandatory	Default Value
devices	List	devices	No
device_groups	List	device_groups	No
global	Class	global	No
templates	List	templates	No

devices (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

device_groups (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

global (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

templates (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

configuration (nxos.devices)

Name	Type	Constraint	Mandatory	Default Value
system	Class	system	No

system (nxos.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
ssh	Class	ssh	No
ip_ssh_source_interfaces	List	ip_ssh_source_interfaces	No

system (nxos.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
ssh	Class	ssh	No

ssh (nxos.devices.configuration.system)

Name	Type	Constraint	Mandatory	Default Value
ciphers_all	Boolean	true, false	No
ciphers_weak	Boolean	true, false	No
kexalgos_all	Boolean	true, false	No
keytypes_all	Boolean	true, false	No
login_attempts	Integer	min: 1, max: 10	No
login_gracetime	Integer	min: 0, max: 3600	No
macs_all	Boolean	true, false	No
port	Integer	min: 22, max: 65535	No
keys	List	keys	No

ip_ssh_source_interfaces (nxos.devices.configuration.system)

Name	Type	Constraint	Mandatory	Default Value
vrf	String		Yes
source_interface_type	Choice	ethernet, loopback, mgmt, port-channel, vlan, vni	No
source_interface_id	Any	String or Integer[min: 0]	No

keys (nxos.devices.configuration.system.ssh)

Name	Type	Constraint	Mandatory	Default Value
type	Choice	rsa, dsa, ecdsa	Yes
key_length	Integer	min: 0, max: 4096	No

Examples

Example 1: Basic SSH hardening with weak ciphers disabled

nxos:
  devices:
    - name: LEAF1
      configuration:
        system:
          ssh:
            ciphers_weak: false
            login_attempts: 3
            login_gracetime: 60

Example 2: SSH with custom port and key generation

nxos:
  devices:
    - name: LEAF1
      configuration:
        system:
          ssh:
            port: 2222
            login_attempts: 3
            login_gracetime: 120
            keys:
              - type: rsa
                key_length: 2048
              - type: ecdsa
                key_length: 256

Example 3: Full SSH hardening configuration

nxos:
  devices:
    - name: LEAF1
      configuration:
        system:
          ssh:
            ciphers_all: true
            ciphers_weak: false
            kexalgos_all: true
            keytypes_all: true
            macs_all: true
            login_attempts: 3
            login_gracetime: 60
            port: 22
            keys:
              - type: rsa
                key_length: 2048
              - type: ecdsa
                key_length: 521

Example 4: SSH source-interface per VRF (ip ssh source-interface <intf> vrf <vrf>)

nxos:
  devices:
    - name: LEAF1
      configuration:
        system:
          ip_ssh_source_interfaces:
            - vrf: management
              source_interface_type: mgmt
              source_interface_id: 0
            - vrf: default
              source_interface_type: loopback
              source_interface_id: 0

Examples

Example 1: Basic SSH hardening with weak ciphers disabled

nxos:
  devices:
    - name: LEAF1
      configuration:
        system:
          ssh:
            ciphers_weak: false
            login_attempts: 3
            login_gracetime: 60

Example 2: SSH with custom port and key generation

nxos:
  devices:
    - name: LEAF1
      configuration:
        system:
          ssh:
            port: 2222
            login_attempts: 3
            login_gracetime: 120
            keys:
              - type: rsa
                key_length: 2048
              - type: ecdsa
                key_length: 256

Example 3: Full SSH hardening configuration

nxos:
  devices:
    - name: LEAF1
      configuration:
        system:
          ssh:
            ciphers_all: true
            ciphers_weak: false
            kexalgos_all: true
            keytypes_all: true
            macs_all: true
            login_attempts: 3
            login_gracetime: 60
            port: 22
            keys:
              - type: rsa
                key_length: 2048
              - type: ecdsa
                key_length: 521