To create a key pair for SSH client authentication by public key (either by generating a key or by importing a key), use the
ip ssh-client key command in Global Configuration mode. To remove a key, use the no form of the command.
Syntax
ip ssh-client key {dsa | rsa} {generate | key-pair privkey pubkey}
encrypted ip ssh-client key {dsa | rsa} key-pair encrypted-privkey pubkey
no ip ssh-client key [dsa | rsa]
Parameters
-
dsa—DSA key type.
-
rsa—RSA key type.
-
key-pair—Key that is imported to the device.
privkey—Plaintext private key.
encrypted-privkey—private key is in encrypted format.
pubkey—The plaintext pubic key.
Default Configuration
The application creates a key automatically; this is the default key.
Command Mode
Global Configuration mode
User Guidelines
When using the keyword generate, a private key and a public key of the given type (RSA/DSA) are generated for the SSH client. Downloading a configuration
file with a Key Generating command is not allowed, and such download will fail.
When using the keyword key-pair, the user can import a key-pair created by another device. In this case, the keys must follow the format specified by RFC
4716.
If the specified key already exists, a warning will be issued before replacing the existing key with a new key.
Use the no ip ssh-client key command to remove a key pair. Use this command without specifying a key-type to remove both key pairs.
Table 1. Keys, Defaults and Users
|
From/To
|
Show
|
Show (detailed)
|
Copy/Upload of Running Config
|
Copy/Upload of Startup Config
|
Download text-based CLI (TFTP/Backup)
|
|
Startup Config
|
Only user-defined
|
N/A
|
All keys (default and user)
|
N/A
|
All keys (default and user)
|
|
Running Config
|
Keys are not displayed.
|
All keys (default and user)
|
N/A
|
Only user defined.
|
Same as user configuration
|
|
Text-based CLI (TFTP/Backup)
|
As it was copied.
|
N/A
|
All keys (default and user)
|
Only user defined.
|
As a text file.
|
If no keys are included in text-based configuration file, the device generates it’s own keys during initialization. If the
Running Configuration contains default keys (not user-defined), the same default keys remain.
Examples
Example 1 - In the following example, a key pair of the RSA type is created:
switchxxxxxx(config)# ip ssh-client key rsa generate
The SSH service is generating a private RSA key.
This may take a few minutes, depending on the key size.
Example 2 - In the following example, both public and private keys of the RSA type are imported (private key as plaintext):
switchxxxxxx(config)# ip ssh-client key rsa key-pair
Please paste the input now, add a period (.) on a separate line after the input
-----BEGIN RSA PRIVATE KEY-----
MIICXAIBAAKBgQDH6CU/2KYRl8rYrK5+TIvwS4zvhBmiC4I31m9cR/1iRTFViMRuJ++TEr
p9ssqWyI1Ti9d0jzmG0N3jHzp2je5/DUTHZXvYaUzchBDnsPTJo8dyiBl4YBqYHQgCjUhk
tXqvloy+1uxRJTAaLVXCBAmuIU/kMLoEox8/zwjB/jsF9wIBIwKBgC2xZ5mQmvy0+yo2GU
FwlQO5f0yweuM11J8McTmqDgfVTRrdbroXwbs3exVqsfaUPY9wa8Le6JPX+DPp4XovEfC/
iglZBSC8SeDmI2U7D6HrkAyD9HHf/r32jukB+5Z7BlHPz2Xczs2clOOwrnToy+YTzjLUxy
WS7V/IxbBllipLAkEA/QluVSCfFmdMlZxaEfJVzqPO1cF8guovsWLteBf/gqHuvbHuNy0t
OWEpObKZs1m/mtCWppkgcqgrB0oJaYbUFQJBAMo/cCrkyhsiV/+ZsryeD26NbPEKiak16V
Tz2ayDstidGuuvcvm2YF7DjM6n6NYz3+/ZLyc5n82okbld1NhDONsCQQCmSAas+C4HaHQn
zSU+/lWlDI88As4qJN2DMmGJbtsbVHhQxWIHAG4tBVWa8bV12+RPyuan/jnk8irniGyVza
FPAkEAiq8oV+1XYxA8V39V/a42d7FvRjMckUmKDl4Rmt32+u9i6sFzaWcdgs87+2vS3AZQ
afQDE5U6YSMiGLVewC4YWwJBAOFZmhO+dIlxT8Irzf2cUZGggopfnX6Y+L+Yl09MuZHbwH
tXaBGj6ayMYvXnloONecnApBjGEm37YVwKjO2DV2w=
-----END RSA PRIVATE KEY-----
-----BEGIN RSA PUBLIC KEY-----
MIGHAoGBAMfoJT/YphGXytisrn5Mi/BLjO+EGaILgjfWb1xH/WJFMVWIxG4n75MSun2yyp
bIjVOL13SPOYbQ3eMfOnaN7n8NRMdle9hpTNyEEOew9Mmjx3KIGXhgGpgdCAKNSGS1eq+W
jL7W7FElMBotVcIECa4hT+QwugSjHz/PCMH+OwX3AgEj
-----END RSA PUBLIC KEY-----
Example 3 - In the following example, both public and private keys of the DSA type are imported (private key as encrypted):
switchxxxxxx(config)# encrypted ip ssh-client key rsa key-pair
(Need to encrypted SSH client RSA key pair, for example:)
-----BEGIN RSA ENCRYPTED PRIVATE KEY-----
gxeOjs6OzGRtL4qstmQg1B/4gexQblfa56RdjgHAMejvUT02elYmNi+m4aTu6mlyXPHmYP
lXlXny7jZkHRvgg8EzcppEB0O3yQzq3kNi756cMg4Oqbkm7TUOtdqYFEz/h8rJJ0QvUFfh
BsEQ3e16E/OPitWgK43WTzedsuyFeOoMXR9BCuxPUJc2UeqQVM2IJt5OM0FbVt0S6oqXhG
sEEdoTlhlDwHWg97FcV7x+bEnPfzFGrmbrUxcxOxlkFsuCNo3/94PHK8zEXyWtrx2KoCDQ
qFRuM8uecpjmDh6MO2GURUVstctohEWEIVCIOr5SBCbciaxv5oS0jIzXMrJA==
-----END RSA PRIVATE KEY-----
-----BEGIN RSA PUBLIC KEY-----
MIGHAoGBALLOeh3css8tBL8ujFt3trcX0XJyJLlxxt4sGp8Q3ExlSRN25+Mcac6togpIEg
tIzk6t1IEJscuAih9Brwh1ovgMLRaMe25j5YjO4xG6Fp42nhHiRcie+YTS1o309EdZkiXa
QeJtLdnYL/r3uTIRVGbXI5nxwtfWpwEgxxDwfqzHAgEj
-----END RSA PUBLIC KEY-----
Example 4 - In the following example, a DSA key pair is removed:
switchxxxxxx(config)# no ip ssh-client key dsa
Example 5 - In the following example, all key pairs (RSA and DSA types) are removed.
switchxxxxxx(config)# no ip ssh-client key
Feedback