ssh
Here is the running-config for the line vty:
line vty 0 4
password 1111
login local
transport input ssh
line vty 5 15
password 1111
login local
transport input ssh
However, when I type ssh -l domain-name ip-address, the cmd will show:
Open
Password:
Since it is in login local, it should ask for a user account, but it doesn't. Also, it accepts the password "1111", when as far as I know, should only be accepted if it is in login only.
Unfortunately the ASA doesn't show a good explanation in the error message. It's required to create an RSA key on the ASA, either via console or command line in the ASDM, executing the command crypto key generate rsa, for example with highest possible modulus size:
crypto key generate rsa modulus 2048
in global configuration mode. The default modulus would be 1024.
With the ASDM it can also be done in the configuration menu, device management, identity certificates, add, new:
Since the other requirements were already met, the connection should be successful.
Since I cannot add images to comments to the question above, here a screenshot about mass bumping comment spam starting with one to this question and answer. That's a screenshot of moderator activity, no action by me.
The reasoning behind your current setup is probably some combination of the following three reasons.
The VPN is a security solution for outside your company's network (See #1 below). SSH however, might be a second layer of security outside of your company's network... but its main purpose is to secure the traffic within your company's network (See #2 Below). VPN is also necessary if the device you are trying to SSH into is using a private address on your companies network (See #3 below).
VPN creates the tunnel to your company network that you push data through. Thus no one seeing the traffic between you and your company's network can actually see what you're sending. All they see is the tunnel. This prevents people that are outside the company network from intercepting your traffic in a way that is useful.
SSH is an encrypted way of connecting to devices on your network (as opposed to Telnet, which is clear text). Companies often require SSH connections even on a company network for security sake. If I have installed malware on a network device and you telnet into that device (even if you're coming through a VPN tunnel - as the VPN tunnel usually terminates at the perimeter of a company's network), I can see your username and password. If it's SSH you're using, then I cannot.
If your company is using private addressing for the internal network, then the device you are connecting to may not be rout-able over the internet. Connecting via a VPN tunnel would be like you are directly connected in the office, therefore you would use the internal routing of the company network that would not be reachable outside of the company network.
Best Answer
You provide credentials for
with
or
The password alone lets you because you set it in line context and it falls through as old style vty login....`