SSH client public-key authentication
Secure Shell version 2 (SSHv2) is used by switches to provide remote access to SSH-enabled management stations. Although SSH provides Telnet-like functions, unlike Telnet, SSH provides encrypted, two-way authenticated transactions. SSH client public-key authentication is one of the types of authentication used.
Client public-key authentication uses one or more public keys (from clients) that must be stored on the switch. Only a client with a private key that matches a public key stored on the switch can gain access at the manager or operator level. For more information about how to configure and use SSH public keys to authenticate SSH clients that try to connect to the switch.
ip ssh public-key
command used to authenticate SSH clients for manager or operator access, along with the hashed content of each SSH client public key.
Syntax
ip ssh public-key < manager | operator > keystring
Set a key for public-key authentication.
- manager
Allows manager-level access using SSH public-key authentication.
- operator
Allows operator-level access using SSH public-key authentication.
- keystring
A legal SSHv2 (RSA or DSA) public key. The text string for the public key must be a single quoted token. If the keystring contains double-quotes, it can be quoted with single quotes (
'keystring'
). The following restrictions for a keystring apply.A keystring cannot contain both single and double quotes.
A keystring cannot have extra characters, such as a blank space or a new line. However, to improve readability, you can add a backlash at the end of each line.
The
ip ssh public-key
command allows you to configure only one SSH client public key at a time. The
ip ssh public-key
command behavior includes an implicit append that never overwrites existing public-key configurations on a running switch.
If you download a software configuration file that contains SSH client publickey configurations, the downloaded public keys overwrite any existing keys, as happens with any other configured values.
To display the SSH public-key configurations (72 characters per line) stored in a configuration file, enter the
show config
or
show running-config
command. The following example shows the SSH public keys configured for manager access, along with the hashed content of each SSH client public key stored in a configuration file.
If a switch configuration contains multiple SSH client public keys, each public key is saved as a separate entry in the configuration file. You can configure up to 10 SSH client public keys on a switch.