CISCO-SECURE-SHELL-MIB

All MIBs › CISCO-SECURE-SHELL-MIB

Organization: Cisco Systems, Inc.

Last Updated: 2005-06-01

Category: Cisco Devices, VPN and Security

Description: Manages SSH (Secure Shell) sessions, version negotiation, cipher configuration, and connection statistics on Cisco devices.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCO-SECURE-SHELL-MIB?

CISCO-SECURE-SHELL-MIB is a Cisco vendor module for managing and monitoring SSH (Secure Shell) server functionality on Cisco devices, covering both host-key management and live SSH session/connection tracking. It exposes configuration objects for generating and managing RSA/DSA host keys (bit length, overwrite behavior, creation time) as well as session-related data describing SSH service activation, capability, and mode. Its monitoring relevance is to the software/service status of the device's remote-management access path: whether the SSH service is enabled and in what mode, whether host keys exist and when they were last generated, and what SSH sessions are currently active -- all important for confirming secure management access is functioning and not compromised. The module description references the (now superseded) IETF SSH draft rather than a finalized RFC, indicating it predates the standardized SSH transport MIB work. It's deployed across Cisco IOS/IOS-XE devices wherever administrators manage the device remotely via SSH and want SNMP visibility into that access path. Engineers researching Cisco Secure Shell (SSH) session and configuration monitoring via SNMP reference this MIB directly.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-SECURE-SHELL-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco routers and switches (IOS/IOS-XE) with SSH server

Monitoring Examples

An administrator would poll cssKeyTable/cssKeyEntry, keyed by cssKeyIndex, to check cssKeyNBits and cssKeyLastCreationTime and confirm the device's SSH host key meets current key-length policy and hasn't silently reverted to a weak default. cssServiceActivation and cssServiceMode would be checked to confirm SSH is enabled and running in the expected version/mode, while cssKeyGenerationStatus would reveal whether a recent key regeneration (e.g., cssKeyRowStatus-triggered) completed successfully or is still in progress -- useful for confirming a security remediation actually took effect.

What Can Be Monitored

SSH service activation state
SSH host key length and creation time
key generation status
SSH service mode/capability

Imported Objects

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
RowStatus
TEXTUAL-CONVENTION
TimeStamp
TruthValue

How to Use in IPNetwork Monitor

Example using cssKeyGenerationStatus OID:

Select a Cisco router or switch (IOS/IOS-XE) with SSH server as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type cssKeyGenerationStatus into the Find box to locate it in the OID tree, then select it and click OK. This object specifies the status of the last key generation request. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is an INTEGER-type OID, Value bounds is the most useful condition here — trigger an alert if the value is anything other than 'successful', since that indicates the condition this object reports has changed to one worth investigating. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
ciscoSecureShellMIB	1.3.6.1.4.1.9.9.339			MIB module for displaying and configuring accounting and Secure Shell (SSH) related features in a device. SSH is a program to log into another computer over a network, to execute commands in a remote machine and to move files from one machine to another. It provides strong authentication and secure communications over unsecure channels. For more information on SSH, please refer to IETF draft, draft-ietf-tls-ssh-00.txt.
ciscoSecureShellMIBObjects	1.3.6.1.4.1.9.9.339.1
cssConfiguration	1.3.6.1.4.1.9.9.339.1.1
T/F cssServiceActivation	1.3.6.1.4.1.9.9.339.1.1.1	TruthValue	read-write	Enables or disables the Secure Shell (SSH) service on the device.
cssKeyTable	1.3.6.1.4.1.9.9.339.1.1.2		not-accessible	cssKeyTable is a table that lets the user configure the SSH keys
cssKeyEntry	1.3.6.1.4.1.9.9.339.1.1.2.1		not-accessible	A SSH key table entry. The index specifies which protocol the user wants to generate the key for. To create the key for a protocol (for the first time), following steps are to be taken by the Network Management System. 1. Choose the Protocol, by specifying the cssKeyIndex 2. Choose nbits, by specifying the cssKeyNBits value 3. cssKeyRowStatus as createAndGo (4) To delete the key for a protocol, following steps are to be taken by the Network Management System 1. Choose the Protocol, by specifying the cssKeyIndex 2. cssKeyRowStatus as destroy (6) To overwrite the existing key for a protocol 1. Choose the Protocol, by specifying the cssKeyIndex 2. Choose the nbits, by specifying the cssKeyNBits value 3. cssKeyOverWrite as true(1).
INT cssKeyIndex	1.3.6.1.4.1.9.9.339.1.1.2.1.1	INTEGER	not-accessible	The SSH Protocol Identifier for which this entry pertains to. The protocol can be rsa1, dsa or rsa. rsa - A public-key cryptosystem defined by Rivest, Shamir and Adleman. This is used with version 2 of the SSH. rsa1 - Same as rsa, but this is used with version 1 of the SSH. dsa - Digital Signature Algorithm, a public key cipher used to generate digital signatures.
I32 cssKeyNBits	1.3.6.1.4.1.9.9.339.1.1.2.1.2	Integer32	read-create	The number of bits provided to generate the key. This determines the length of the kestring generated by the SSH. This object cannot be modified while this row is active, unless the associated cssKeyOverWrite object is set to True in the same Set PDU.
T/F cssKeyOverWrite	1.3.6.1.4.1.9.9.339.1.1.2.1.3	TruthValue	read-create	This object specifies whether an existing key for the protocol should be overwritten with a new key. No action is taken if this object is set to 'false'. The value of this object when read is always 'false'.
TIM cssKeyLastCreationTime	1.3.6.1.4.1.9.9.339.1.1.2.1.4	TimeStamp	read-only	The time of the last creation of the key.
ROW cssKeyRowStatus	1.3.6.1.4.1.9.9.339.1.1.2.1.5	RowStatus	read-create	Status of this row.
STR cssKeyString	1.3.6.1.4.1.9.9.339.1.1.2.1.6	DisplayString	read-only	The SSH public key string that is generated.
CSS cssServiceCapability	1.3.6.1.4.1.9.9.339.1.1.3	CssVersions	read-only	The object indicates which versions of Secure Shell protocol are supported by the device. If the bit 'v1' is set to 1, it indicates that the device supports SSH protocol version 1. If the bit 'v2' is set to 1, it indicates that the device supports SSH protocol version 2.
CSS cssServiceMode	1.3.6.1.4.1.9.9.339.1.1.4	CssVersions	read-write	This object specifies which versions of Secure Shell protocol connections that device will accept from Secure Shell clients. If the bit 'v1' is set to 1, the device will accept SSH version 1 connections. If the bit 'v2' is set to 1, the device will accept SSH version 2 connections. At least one of the version bits must be set to 1.
INT cssKeyGenerationStatusEx	1.3.6.1.4.1.9.9.339.1.1.5	INTEGER	read-only	This object specifies the status of the last key generation request.
cssSessionInfo	1.3.6.1.4.1.9.9.339.1.2
cssSessionTable	1.3.6.1.4.1.9.9.339.1.2.1		not-accessible	Table to list detailed information about existing Secure Shell sessions on the device.
cssSessionEntry	1.3.6.1.4.1.9.9.339.1.2.1.1		not-accessible	An entry in the cssSessionTable, that provides detailed information about all the existing SSH sessions on the device. An entry will be created for every SSH session established on the device. The entry will be removed upon termination of the SSH session.
U32 cssSessionID	1.3.6.1.4.1.9.9.339.1.2.1.1.1	Unsigned32	not-accessible	An arbitrary index that uniquely identifies a Secure Shell Session
INT cssSessionVersion	1.3.6.1.4.1.9.9.339.1.2.1.1.2	INTEGER	read-only	The object indicates the version of Secure Shell used by this session.
INT cssSessionState	1.3.6.1.4.1.9.9.339.1.2.1.1.3	INTEGER	read-only	The object indicates the current state of Secure Shell Session. The state sshSessionVersionOk(1) indicates that server and client versions of SSH are exchanged and are compatible. The state sshSessionKeysExchanged(2) indicates that key exchange has been completed. The state sshSessionAuthenticated(3) indicates that the client has been successfully authenticated. The state sshSessionOpen(4) indicates that the session has been successfully opened. The state sshSessionDisconnecting(5) indicates that the session disconnection has begun. The state sshSessionDisconnected(6) indicates that the session has been disconnected. The state sshSessionClosed(7) indicates that the session has closed.
U32 cssSessionPID	1.3.6.1.4.1.9.9.339.1.2.1.1.4	Unsigned32	read-only	The object indicates the process ID of the process serving this SSH session on the device.
STR cssSessionUserID	1.3.6.1.4.1.9.9.339.1.2.1.1.5	SnmpAdminString	read-only	The object indicates user name associated with this SSH session.
IPt cssSessionHostAddrType	1.3.6.1.4.1.9.9.339.1.2.1.1.6	InetAddressType	read-only	This object describes the type of Internet address used by host associated with this SSH session.
IP cssSessionHostAddr	1.3.6.1.4.1.9.9.339.1.2.1.1.7	InetAddress	read-only	The object indicates the Internet address of the host associated with this SSH session.
ciscoSecureShellMIBConformance	1.3.6.1.4.1.9.9.339.2
ciscoSecureShellMIBCompliances	1.3.6.1.4.1.9.9.339.2.1
ciscoSecureShellMIBCompliance	1.3.6.1.4.1.9.9.339.2.1.1			The compliance statement for entities which implement the CISCO-SECURE-SHELL-MIB.
ciscoSecureShellMIBComplianceRv1	1.3.6.1.4.1.9.9.339.2.1.2			The compliance statement for entities which implement the CISCO-SECURITY-MIB.
ciscoSecureShellMIBComplianceRv2	1.3.6.1.4.1.9.9.339.2.1.3			The compliance statement for entities which implement the CISCO-SECURE-SHELL-MIB.
ciscoSecureShellMIBComplianceRv3	1.3.6.1.4.1.9.9.339.2.1.4			The compliance statement for entities which implement the CISCO-SECURE-SHELL-MIB.
ciscoSecureShellMIBGroups	1.3.6.1.4.1.9.9.339.2.2
cssConfigurationGroup	1.3.6.1.4.1.9.9.339.2.2.1			A collection of objects for SSH configuration.
cssConfigurationGroupRev1	1.3.6.1.4.1.9.9.339.2.2.2			A collection of objects for SSH configuration.
cssServiceModeCfgGroup	1.3.6.1.4.1.9.9.339.2.2.3			A collection of objects for SSH mode configuration.
cssSessionInfoGroup	1.3.6.1.4.1.9.9.339.2.2.4			A collection of objects to display SSH session related information.
cssConfigurationGroupSupp1	1.3.6.1.4.1.9.9.339.2.2.5			A collection of objects for SSH configuration.

RFC description

MIB module for displaying and configuring SSH (Secure Shell) accounting and remote access features in Cisco devices.

Start monitoring Cisco routers and switches (IOS/IOS-XE) with SSH server with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-SECURE-SHELL-MIB