These steps describe how to copy client public keys into the switch for challenge-response authentication, and require an understanding of how to use your SSH client application.
A client public key
NOTE:
Comments in public-key files may appear in a SSH client application's generated public key. While such comments may help to distinguish one key from another, they do not pose any restriction on the use of a key by multiple clients and/or users.
usually include line breaks as a method for showing the whole key. However, in practice, line breaks in a public key will cause errors resulting in authentication failure.
Procedure
Use your SSH client application to create a public/private key pair, and see the documentation provided with your SSH client application for details. The switch supports the following client public-key properties:
Property
Supported value
Comments
Key format
ASCII
See
Providing the switch public key to clients. The key must be one unbroken ASCII string. If you add more than one client public key to a file, terminate each key (except the last one) with a <CR><LF>. Spaces are allowed within the key to delimit the key's components. Note that, unlike the use of the switch public key in an SSH client application, the format of a client public key used by the switch does not include the client's IP address.
Key type
RSA or DSA
You can choose either RSA or DSA key types when using the
crypto key generate ssh command. The
cert parameter only use RSA key type.
Maximum supported public-key length
3072 bits
Shorter key lengths allow faster operation, but also mean diminished security.
Maximum host key sizes in bits
RSA:1024, 2048, 3072DSA:1024
Includes the bit size, public index, modulus, any comments,<CR>, <LF>, and all blank spaces.
If necessary, you can use an editor application to verify the size of a key. For example, placing a client public key into a Word for Windows text file and clicking on
File|Properties|Statistics lets you view the number of characters in the file, including spaces.
Copy the client's public key into a text file (filename.txt). For example, use the Notepad editor included with the
Microsoft®
Windows® software. If you want several clients to use client public-key authentication, copy a public key for each of these clients (10) into the file. Each key should be separated from the preceding key by a
<CR><LF>.
Copy the client public-key file into a TFTP server accessible to the switch.
Copying a client public key into the switch requires the following:
One or more client-generated public keys. See the documentation provided with your SSH client application.
A copy of each client public key stored in a single text file or individually on a TFTP server to which the switch has access. Terminate all client public keys in the file except the last one with a
<CR><LF>.
NOTE:
The actual content of a public-key entry in a public-key file is determined by the SSH client application generating the key. Although you can manually add or edit any comments the client application adds to the end of the key.
