To remove the generated RSA host keys and zeroize the key storage location, use the crypto key zeroizersa command in CONFIGURATION mode.Dell(conf)#crypto key zeroize rsaConfiguring When to Re-generate an SSH KeyYou can configure the time-based or volume-based rekey threshold for an SSH session. If both thresholdtypes are configured, the session rekeys when either one of the thresholds is reached.To configure the time or volume rekey threshold at which to re-generate the SSH key during an SSH session,use the ip ssh rekey [time rekey-interval] [volume rekey-limit] command. CONFIGURATION mode.Configure the following parameters:• rekey-interval: time-based rekey threshold for an SSH session. The range is from 10 to 1440 minutes.The default is 60 minutes.• rekey-limit: volume-based rekey threshold for an SSH session. The range is from 1 to 4096 tomegabytes. The default is 1024 megabytes.ExamplesThe following example configures the time-based rekey threshold for an SSH session to 30 minutes.Dell(conf)#ip ssh rekey time 30The following example configures the volume-based rekey threshold for an SSH session to 4096 megabytes.Dell(conf)#ip ssh rekey volume 4096Configuring the SSH Server Cipher ListTo configure the cipher list supported by the SSH server, use the ip ssh server cipher cipher-listcommand in CONFIGURATION mode.cipher-list-: Enter a space-delimited list of ciphers the SSH server will support.The following ciphers are available.• 3des-cbc• aes128-cbc• aes192-cbc• aes256-cbc• aes128-ctr• aes192-ctr• aes256-ctrThe default cipher list is aes256-ctr, aes256-cbc, aes192-ctr, aes192-cbc, aes128-ctr, aes128-cbc, 3des-cbc.Security 1003
