Cisco Secure Copy (SCP) User Manual: Настройка и руководство по использованию

Information About Secure Copy

Secure Copy This document provides the procedure to configure a Cisco device for Secure Copy (SCP) server-side functionality. Prerequisites for Secure Copy, on page 1 Information About Secure Copy, on page 1 How to Configure Secure Copy, on page 2 Configuration Examples for Secure Copy, on page 6 Additional References for Secure Copy, on page 6 Feature History for Secure Copy, on page 7 Prerequisites for Secure Copy • Configure Secure Shell (SSH), authentication, and authorization on the device. • Because the Secure Copy Protocol (SCP) relies on SSH for its secure transport, the device must have a Rivest, Shamir, and Adelman (RSA) key pair.

Information About Secure Copy The Secure Copy feature provides a secure and authenticated method for copying switch configurations or switch image files. The Secure Copy Protocol (SCP) relies on Secure Shell (SSH), an application and a protocol that provides a secure replacement for the Berkeley r-tools. The behavior of SCP is similar to that of Remote Copy Protocol (RCP), which comes from the Berkeley r-tools suite (Berkeley university’s own set of networking applications), except that SCP relies on SSH for security.

In addition, SCP requires authentication, authorization, and accounting (AAA) to be configured to ensure that the device can determine whether a user has the correct privilege level. SCP allows only users with a privilege level of 15 to copy a file in the Cisco IOS File System (Cisco IFS) to and from a device by using the copy command. An authorized administrator can also perform this action from a workstation. Secure Copy 1

Page 1

Configuring Secure Copy

Note • Enable the SCP option while using the pscp.exe file. • An RSA public-private key pair must be configured on the device for SSH to work. Similar to SCP, SSH File Transfer Protocol (SFTP) can be used to copy switch configuration or image files. For more information, refer the Configuring SSH File Transfer Protocol chapter of the Security Configuration Guide . Secure Copy Performance Improvements SSH bulk data transfer mode can be used to enhance the throughput performance of SCP that is operating in the capacity of a client or a server. Beginning from Cisco IOS XE Dublin 17.10.1, SSH bulk data transfer mode is enabled by default with default window size of 128KB.

TCP selective acknowledgement (SACK) is enabled by default if the bulk mode window size is configured. The default bulk mode window size of 128 KB is optimal to copy large files in most network settings. However, in long big networks where the round-trip time (RTT) is high, 128 KB is not enough. You can enable the most optimal SCP throughput performance by configuring the bulk mode window size using the ip ssh bulk-mode window-size command. For example, in an ideal lab testing environment, a window size of 2 MB in a 200-milliseconds round-trip time setting can give around 500 percent improved throughput performance when compared to the default 128-KB window size.

The bulk mode window size must be configured as per the network bandwidth-delay product, that is, a multiple of total available bandwidth in bits per second and the round-trip time in seconds. Because the CPU usage may increase with the increased window size, make sure to balance this by choosing the right window size. How to Configure Secure Copy The following sections provide information about the Secure Copy configuration tasks. Configuring Secure Copy To configure a Cisco device for SCP server-side functionality, perform the following steps. Procedure Secure Copy Secure Copy Performance Improvements Command or Action Purpose Step 1 enable Example:

Device> enable Enables privileged EXEC mode. Enter your password, if prompted. Step 2 configure terminal Example: Enters global configuration mode. Secure Copy 2

Page 2

Configuring SCP Username Password

Configuring SCP Username Password To configure a username and password for SCP, perform the following steps: Procedure Secure Copy Configuring SCP Username Password Command or Action Purpose Device# configure terminal Step 3 aaa new-model Example: Device(config)# aaa new-model Sets AAA authentication at login. Step 4 aaa authentication login {default | list-name} method1 [ method2... ] Example: Device(config)# aaa authentication login default group tacacs+ Enables the AAA access control system. Step 5 username name [privilege level] password encryption-type encrypted-password Example:

Device(config)# username superuser privilege 2 password 0 superpassword Establishes a username-based authentication system. Note You can omit this step if a network-based authentication mechanism, such as TACACS+ or RADIUS, has been configured. Step 6 ip scp server enable Example: Device(config)# ip scp server enable Enables SCP server-side functionality. Step 7 exit Example: Device(config)# exit Exits global configuration mode and returns to privileged EXEC mode. Step 8 debug ip scp Example: Device# debug ip scp (Optional) Troubleshoots SCP authentication problems. Command or Action Purpose Step 1 enable Example: Enables privileged EXEC mode. Enter your password, if prompted. Secure Copy 3

Page 3

Enabling Secure Copy on the SSH Server

Enabling Secure Copy on the SSH Server The following task shows how to configure the server-side functionality for SCP. This task shows a typical configuration that allows a device to securely copy files from a remote workstation. Procedure Secure Copy Enabling Secure Copy on the SSH Server Command or Action Purpose Device> enable Step 2 configure terminal Example: Device# configure terminal Enters global configuration mode. Step 3 ip scp usernameusername Example: Device# ip scp username cisco Defines the username. Step 4 ip scp passwordpassword Example: Device# ip scp password 0 cisco Defines the password. Specify the encryption level. • 0 – Unencrypted password. • 0 – Encrypted password.

• Line – Clear text password. Step 5 exit Example: Device(config)# exit Exits global configuration mode and returns to privileged EXEC mode. Command or Action Purpose Step 1 enable Example: Device> enable Enables privileged EXEC mode. Enter your password, if prompted. Step 2 configure terminal Example: Device# configure terminal Enters global configuration mode. Step 3 aaa new-model Example: Device(config)# aaa new-model Enables the Authentication, Authorization, and Accounting (AAA) access control model. Step 4 aaa authentication login default local Example: Sets AAA authentication to use the local username database for authentication at login. Secure Copy 4

Page 4