SSH Public Key Authentication on Cisco IOS
We will add our public key to a Cisco IOS router and use it for SSH authentication instead of a password.
Cisco IOS basic SSH configuration
First, we will need to set up a basic SSH configuration on our router.
Our router will need a domain name
R1(config)#ip domain-name example.local
Generate a 2048 bit RSA key pair
R1(config)#crypto key generate rsa modulus 2048
The name for the keys will be: R1.example.local% The key modulus size is 2048 bits
% Generating 2048 bit RSA keys, keys will be non-exportable…
[OK] (elapsed time was 27 seconds)%SSH-5-ENABLED: SSH 1.99 has been enabled
Enable SSH version 2
R1(config)#ip ssh version 2
Configure the VTY lines to accept SSH and use local authentication
R1(config)#line vty 0 4
R1(config-line)#transport input ssh
R1(config-line)#login local
Import Public keys to the router
On Linux and macOS the public key is printed on a single line which exceeds the maximum single line length of 254 characters that Cisco IOS supports, we can use the fold command to break the key over multiple lines. We can remove the “ssh-rsa” at the beginning and the comment at the end.
fold -b -w100 .ssh/id_rsa.pub
on Windows, the public key is already split over multiple lines. We can remove the “begin” and “end” lines, as well as any comments.
— — -BEGIN PUBLIC KEY — — -
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDMc4/ju5lQOouBQKN+DcGNyJ0v
fv+lLdeCyPPpaLsdL3r3yw2hs/L+hAPemMSUoxb0w9MyEyhrrur7poyQbKmdonX8
5PUMmIXv+BiFlUO11pWU9iYo6kKAfahqhoEooNsy9s0CrqJzcghiFaHLVCN/WdDt
— — -END PUBLIC KEY — — -
Enter public key chain configuration mode
ip ssh pubkey-chain
Select the username, then enter the key-string command
username example
key-string
Paste the lines of the public key, then type exit
We can now test connecting using our SSH Key
ssh example@192.168.1.1
If our private key is protected by a passphrase, we will be prompted for it before we can connect.
Now that we can authenticate using our public key we can disable password authentication on the router.
R1(config)#no ip ssh server algorithm authentication password
R1(config)#no ip ssh server algorithm authentication keyboard