In which configuration mode is show ssh used?

The show ssh command is entered in Privileged EXEC mode on Cisco IOS devices.

SecurityPrivileged EXEC

show ssh

Displays the status and configuration of SSH server connections on a Cisco device, used to verify SSH sessions, authentication methods, and encryption settings.

Definition: show ssh is a Cisco IOS privileged exec command. Displays the status and configuration of SSH server connections on a Cisco device, used to verify SSH sessions, authentication methods, and encryption settings.

Overview

The `show ssh` command is a vital diagnostic tool in Cisco IOS that displays the status and configuration of Secure Shell (SSH) server connections on a device. SSH is the de facto standard for secure remote management of network devices, replacing insecure protocols like Telnet. This command allows network engineers to verify active SSH sessions, authentication methods, encryption algorithms, and version information.

It is particularly important for security audits, troubleshooting connectivity issues, and ensuring compliance with organizational security policies. When troubleshooting remote access problems, `show ssh` is often the first command used to check if the SSH server is enabled and if sessions are established. It differs from `show ip ssh`, which displays global SSH configuration parameters, while `show ssh` focuses on active sessions.

The command requires privileged EXEC mode (enable) and does not alter the running configuration. Output is buffered and may not reflect real-time changes immediately; it refreshes periodically. Understanding this command is essential for CCNA and CCNP candidates as SSH is a core security technology in modern networks.

Syntax·Privileged EXEC

show ssh

When to Use This Command

Verify active SSH sessions to the router for remote management.
Check SSH version and encryption algorithms configured on the device.
Troubleshoot SSH connectivity issues by reviewing session details.
Audit SSH configuration for compliance with security policies.

Command Examples

Basic show ssh output

show ssh

Connection Version Mode Encryption  Hmac          State         Username
0          2.0     IN   aes128-cbc  hmac-sha1     Session started admin
0          2.0     OUT  aes128-cbc  hmac-sha1     Session started admin
%No SSHv1 server connections running.

Line 1: Connection ID 0, SSH version 2.0, direction IN (incoming), encryption aes128-cbc, HMAC hmac-sha1, state 'Session started', username 'admin'. Line 2: Same connection OUT direction. Line 3: No SSHv1 connections.

Show ssh with multiple sessions

show ssh

Connection Version Mode Encryption  Hmac          State         Username
0          2.0     IN   aes256-cbc  hmac-sha2-256  Session started jdoe
0          2.0     OUT  aes256-cbc  hmac-sha2-256  Session started jdoe
1          2.0     IN   aes128-cbc  hmac-sha1      Session started admin
1          2.0     OUT  aes128-cbc  hmac-sha1      Session started admin
%No SSHv1 server connections running.

Two active SSH sessions: Connection 0 by user 'jdoe' with stronger encryption (aes256-cbc) and HMAC (sha2-256); Connection 1 by user 'admin' with weaker settings. Each session has IN and OUT lines.

Understanding the Output

The 'show ssh' command output lists each active SSH session with two lines per connection (IN and OUT). The 'Connection' column shows a unique session ID. 'Version' indicates SSH protocol version (1.99 or 2.0).

'Mode' is either IN (incoming from client) or OUT (outgoing to server). 'Encryption' shows the negotiated cipher (e.g., aes128-cbc, aes256-cbc). 'Hmac' shows the HMAC algorithm (e.g., hmac-sha1, hmac-sha2-256).

'State' indicates the session phase (e.g., 'Session started' means authenticated and open). 'Username' shows the authenticated user. A line '%No SSHv1 server connections running.' indicates no legacy SSHv1 sessions.

Good values include strong encryption (aes256-cbc) and HMAC (hmac-sha2-256). Bad values include weak ciphers (e.g., 3des-cbc) or SSHv1. Watch for unexpected users or multiple sessions from unknown IPs (IP not shown here; use 'show users' for IPs).

Configuration Scenarios

Verify SSH Server Status and Active Sessions

A network administrator needs to confirm that the SSH server is running and check for any active remote management sessions on a Cisco router.

Topology

R1(Gi0/0)---192.168.1.0/24---(Gi0/0)Admin-PC

Steps

1.Step 1: Enter privileged EXEC mode: R1> enable
2.Step 2: Display SSH server status and sessions: R1# show ssh

Configuration

! No configuration required; command is used for verification only.

Verify: Expected output shows SSH version, authentication method, encryption, and any active sessions. Example: SSH Enabled - version 2.0 Authentication timeout: 120 secs; Authentication retries: 3 Minimum expected Diffie-Hellman key size: 1024 bits IOS Keys in SECSH format(ssh-rsa, base64 encoded): ... %No SSHv2 server connections running.

Watch out: If SSH is not enabled, the command returns 'SSH Disabled'. Ensure the device has an RSA key pair generated with `crypto key generate rsa`.

Troubleshoot SSH Session Timeout or Authentication Failures

A remote engineer is unable to SSH into a router; the administrator uses `show ssh` to check if the SSH server is accepting connections and to view session details.

Topology

R1(Gi0/0)---10.10.10.0/30---(Gi0/0)R2

Steps

1.Step 1: Enter privileged EXEC mode: R1> enable
2.Step 2: Check SSH server status: R1# show ssh
3.Step 3: If no sessions, check SSH configuration: R1# show ip ssh
4.Step 4: Verify RSA keys: R1# show crypto key mypubkey rsa

Configuration

! Ensure SSH is configured
R1(config)# ip domain-name example.com
R1(config)# crypto key generate rsa modulus 2048
R1(config)# ip ssh version 2
R1(config)# line vty 0 4
R1(config-line)# transport input ssh
R1(config-line)# login local

Verify: After configuration, `show ssh` should display 'SSH Enabled - version 2.0' and show active sessions when connected. Example output with session: Connection Version Mode Encryption Hmac State Username 0 2.0 IN aes256-ctr hmac-sha2-256 Session started admin 0 2.0 OUT aes256-ctr hmac-sha2-256 Session started admin

Watch out: Common mistake: forgetting to generate RSA keys or not setting the domain name. Without keys, SSH server will not start.

Troubleshooting with This Command

When troubleshooting SSH connectivity issues, `show ssh` is the first command to run. Healthy output shows 'SSH Enabled - version 2.0' and lists active sessions with encryption and HMAC algorithms. Problem indicators include 'SSH Disabled' or no output at all.

If SSH is disabled, check global configuration with `show ip ssh` and ensure RSA keys exist. If sessions are not appearing, verify that the VTY lines are configured for SSH input (`transport input ssh`). Focus on the 'State' field: 'Session started' indicates an established connection; 'Authentication in progress' may indicate a delay or failure.

Common symptoms: 'SSH Disabled' means the SSH server is not running; 'No SSHv2 server connections running' is normal if no sessions exist. For authentication failures, correlate with `debug ip ssh` or `debug ssh` to see detailed errors. Also check AAA or local user database.

The command does not show failed attempts; use `show logging` for that. Step-by-step diagnostic flow: 1) `show ssh` to check server status; 2) `show ip ssh` to view timeout and retries; 3) `show crypto key mypubkey rsa` to verify keys; 4) `show running-config | include ssh` to confirm configuration; 5) If sessions exist but are slow, check encryption algorithms with `show ssh` and compare with client capabilities. Correlate with `show tcp brief` to see TCP port 22 connections.

CCNA Exam Tips

Remember that 'show ssh' only shows active sessions, not configuration; use 'show ip ssh' for SSH server settings.

CCNA exam may ask to identify the SSH version in use; look for 'Version' column showing 1.99 (both v1 and v2) or 2.0.

Know that each SSH session has two lines (IN and OUT) representing bidirectional encryption.

The absence of '%No SSHv1 server connections running.' indicates SSHv1 is enabled, which is a security risk.

Common Mistakes

Confusing 'show ssh' with 'show ip ssh' — the former shows sessions, the latter shows configuration.

Assuming the output shows IP addresses of connecting clients; use 'show users' or 'show ssh session detail' for that.

Overlooking the '%No SSHv1 server connections running.' line; it indicates SSHv1 is not in use, which is good.

show ssh vs show ip ssh

Both 'show ssh' and 'show ip ssh' are used to verify SSH on Cisco IOS devices, but they serve different purposes: 'show ssh' displays active SSH sessions, while 'show ip ssh' shows SSH server configuration. They are often confused because of similar names and both relate to SSH functionality.

Aspect	show ssh	show ip ssh
Scope	Shows active SSH sessions (incoming connections)	Shows SSH server configuration and status
Output Fields	Session ID, version, cipher, MAC, authentication method, user, connection details	SSH enabled/disabled, version, authentication timeout, retries, host key type
Typical Use	Monitoring ongoing SSH connections and session details	Verifying SSH server settings and readiness
Configuration Dependency	Reflects currently established connections, not configuration	Displays configured parameters, independent of active sessions

Use show ssh when you need to see who is currently connected via SSH and inspect session-specific details like encryption ciphers or authentication methods.

Use show ip ssh when you need to verify that SSH is enabled, check the configured SSH version, or review server parameters like timeout and retry limits.

Platform Notes

In IOS-XE, the `show ssh` command syntax and output are identical to classic IOS. However, on newer IOS-XE versions (16.x+), the output may include additional fields like 'Session ID' and 'Authentication method'. On NX-OS, the equivalent command is `show ssh server` which displays server status and active sessions, but the output format differs (e.g., uses 'SSH server enabled: yes').

NX-OS also has `show ssh key` for RSA key details. On ASA firewalls, the command is `show ssh` but output includes session details and version; ASA uses a different SSH implementation. In IOS-XR, the command is `show ssh session` or `show ssh server`; syntax varies.

For IOS versions, 12.x supports SSHv1 only; 15.x and later default to SSHv2. The command exists in all IOS versions but output fields may vary slightly (e.g., older versions may not show encryption details). Always verify the specific platform documentation for exact syntax.

Related Commands

show ip ssh

Displays the status and configuration of SSH server on the Cisco IOS device, used to verify SSH is enabled and check connection details.

show users

Displays active user sessions on the router, including line type, idle time, and remote IP addresses, useful for monitoring who is logged in and troubleshooting connectivity issues.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions