3-48
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter 3 Setting Up the Sensor
Configuring SSH
Step 7
Remove an entry. The host is removed from the SSH known hosts list.
sensor(config)# no ssh host-key 10.16.0.0
Step 8
Verify the host was removed. The IP address no longer appears in the list.
sensor(config)# exit
sensor# show ssh host-keys
Adding Authorized RSA1 and RSA2 Keys
Use the ssh authorized-key command to define public keys for a client allowed to use RSA1 or RSA2
authentication to log in to the local SSH server. The default is RSA2. You can configure the sensor to
fall back to RSA1. To modify an authorized key, you must remove and recreate the entry. Use the no
form of the command to remove the entry. Users can only create and remove their own keys.
The following options apply:
•
id—Specifies a 1 to 256-character string that uniquely identifies the authorized key. You can use
numbers, “_,” and “-,” but spaces and “?” are not accepted.
•
rsa-pubkey—Specifies the RSA (SSHv2) key details.
–
pubkey—Specifies the Base64 encoded public key.
•
rsa1-pubkey—Specifies the RSA1 (SSHv1) key details:
–
key-modulus-length—Specifies an ASCCI decimal integer in the range[511, 2048].
–
public-exponent—Specifies an ASCII decimal integer in the range [3, 2^32].
–
public-modulus—Specifies an ASCII decimal integer, x, such that (2^(key-modulus-length-1))
< x < (2^(key-modulus-length)).
Each user who can log in to the sensor has a list of authorized public keys. An SSH client with access to
any of the corresponding RSA private keys can log in to the sensor as the user without entering a
password.
For SSHv1, use an RSA key generation tool on the client where the private key is going to reside. Then,
display the generated public key as a set of three numbers (modulus length, public exponent, public
modulus) and enter those numbers as parameters for the ssh authorized-key command. For SSHv2, yo u
just need the ID and the public key.
Note
You configure your own list of SSH authorized keys. An administrator cannot manage the list of SSH
authorized keys for other users on the sensor.
Note
An SSH authorized key provides better security than passwords if the private key is adequately
safeguarded. The best practice is to create the private key on the same host where it will be used and
store it with a pass phrase on a local file system. To minimize password or pass phrase prompts, use a
key agent.