Set 'transport input ssh' for 'line vty' connections

HighLevel 1Automatedcisco-ios

Description

Selects the Secure Shell (SSH) protocol. Configuring VTY access control restricts remote access to only those authorized to manage the device and prevents unauthorized users from accessing the system. Fails if any 'line vty' block lacks 'transport input ssh' or still allows telnet/all. Audited against the output of 'show running-config' (run 'terminal length 0' first; do not use 'show running-config all' or 'show startup-config').

How it is checked

Audit method: Configuration pattern

Pattern: (?m)(?:^line vty[^\n]*\n(?:[ \t]+(?:$|[^t \t\n]|t(?:$|[^r\n]|r(?:$|[^a\n]|a(?:$|[^n\n]|n(?:$|[^s\n]|s(?:$|[^p\n]|p(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^t\n]|t(?:$|[^ \n]| (?:$|[^i\n]|i(?:$|[^n\n]|n(?:$|[^p\n]|p(?:$|[^u\n]|u(?:$|[^t\n]|t(?:$|[^ \n]| (?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^h\n])))))))))))))))))))[^\n]*\n)*(?:[^ \t]|\z))|(?:^line vty[^\n]*\n(?:[ \t][^\n]*\n)*?[ \t]+transport input [^\n]*\b(?:telnet|all)\b)

How it is fixed

Fix method: Guidance or infrastructure patch

! Apply SSH to transport input on all VTY management lines line vty <line-number> <ending-line-number> transport input ssh

Properties

Operating systems: Any
Tags: cisco-iosnetworkmanagement-plane
Reference: CIS Cisco IOS XE 17.x Benchmark v2.2.1 - 1.2.2 Set 'transport input ssh' for 'line vty' connections

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target cisco-ios