Configuring Secure Shell (SSH)

 

Configuring the Switch for SSH Operation

 

 

Note

When you generate a host key pair on the switch, the switch places the key

 

pair in flash memory (and not in the running-config file). Also, the switch

 

maintains the key pair across reboots, including power cycles. You should

 

consider this key pair to be “permanent”; that is, avoid re-generating the key

 

pair without a compelling reason. Otherwise, you will have to re-introduce the

 

switch’s public key on all management stations you have set up for SSH access

 

to the switch using the earlier pair.

 

Removing (zeroing) the switch’s public/private key pair renders the switch

 

unable to engage in SSH operation and automatically disables IP SSH on the

 

switch. (To verify whether SSH is enabled, execute show ip ssh.)However, any

 

active SSH sessions will continue to run, unless explicitly terminated with the

 

CLI 'kill' command.

 

To Generate or Erase the Switch’s Public/Private Host Key Pair.

 

 

Because the host key pair is stored in flash instead of the running-config file,

 

it is not necessary to use write memory to save the key pair. Erasing the key

 

pair automatically disables SSH.

 

Syntax: crypto key generate <autorun-key [rsa] cert [rsa] <keysize> ssh [dsa

 

rsa] bits <keysize>>

 

Installs authentication files for ssh or https server, or for

 

autorun.

 

autorun-key

 

Install RSA key for autorun. See “Configuring Autorun

 

on the Switch” in Appendix A of the Management and

 

Configuration Guide for more information.

 

cert

 

Install RSA key for https certificate. See “Configuring

 

the Switch for SSL Operation” on page 7-7in this guide

 

for more information.

 

ssh [dsa rsa]

 

Install host key for ssh server. Specify the key type as

 

DSA or RSA.

 

bits <keysize>

 

Specify the key size (in bits). See Table 6-2.

 

zeroize <ssh cert autorun [rsa]>

 

Erases the switch’s public/private key pair and dis-

 

ables SSH operation.

6-11