SSH-Only Management: Disabling Telnet on R1

Bundle lab

Harden a Cisco IOS router so remote management is allowed only via SSH. You will remove Telnet from the VTY lines, keep local authentication, and add an idle-session timeout. Verify success from a Linux ADMIN host by confirming SSH works and Telnet is refused.

Learning objectives

• Explain why Telnet is insecure and must be disabled on managed devices
• Restrict VTY access to SSH only using transport input ssh
• Retain local authentication on VTY lines using login local
• Configure an SSH administrator idle timeout on VTY lines
• Verify SSH success and Telnet refusal from a Linux host
• Show and interpret IOS running-config sections related to VTY/SSH

Troubleshooting focus

• If SSH fails to connect, generate RSA keys (crypto key generate rsa) and confirm hostname and ip domain name are set
• If the login prompt never appears, ensure line vty 0 4 has login local and at least one username secret
• If Telnet is still accepted, check that transport input is set to ssh only (not all or telnet ssh)
• If the ADMIN host cannot reach R1, verify IP addressing and the host default route to 10.0.0.1
• If SSH connects but closes unexpectedly, verify exec-timeout settings and network stability