topic Is ssh with pki possible? in Network Security

Is ssh with pki possible?

misch1942 — Fri, 21 Feb 2020 12:46:02 GMT

Hi,

I found documentation that ssh login should be able using x509 certificates. At least in NX-OS. But I did not find any documentation HOW this can be configured. Does anybody has a hint for me, where I can find more documentation about this? Is it possible in IOS 15?

Thanks for any hint.

Greetings,

Michael Schwartzkopff

Is ssh with pki possible?

Rudy Sanjoko — Mon, 22 Oct 2012 13:10:20 GMT

It is possible, please refer to following document by Ivan Pepelnjak on his blog regarding SSH with PKI on IOS v15.0.

ssh-rsa-authentication-works-in-ios

Is ssh with pki possible?

misch1942 — Mon, 22 Oct 2012 13:20:20 GMT

Hi,

I thought my qustion was clear enough. I asked about x509 certificates, not about RSA key pairs. For RSA keys I would have to extract the keys from the certificate and configure it on all 1000+ switches.

Is ssh with pki possible?

Rudy Sanjoko — Mon, 22 Oct 2012 15:28:27 GMT

my mistake, kinda missed that part.

Is ssh with pki possible?

misch1942 — Tue, 23 Oct 2012 07:56:36 GMT

Hi,

I think I finally found the answer. The ssh service on a cisco device can extract the keypair from the certificate on the PKI. But it cannot authenticate the user certificate against the CA on the PKI.

At least that is what I found after long experiments.

Greetings,

Michael Schwartzkopff

Re: Is ssh with pki possible?

chad patterson — Wed, 13 Mar 2019 23:05:10 GMT

Ths document says that you can:

https://www.cisco.com/c/en/us/support/docs/security-vpn/secure-shell-ssh/212178-Configuring-SSH-with-x509-authentication.html

also

Public Key Infrastructure Configuration Guide, Cisco IOS Release 15MT

Re: Is ssh with pki possible?

Mike.Cifelli — Thu, 14 Mar 2019 12:47:07 GMT

I strongly suggest checking this out:
https://www.pragmasys.com/products/support/cisco-2-factor

This is how I have seen 2FA implemented with Cisco devices for pki ssh login.

Is it possible in IOS 15?
Yes. As long as you are running 15.2.4 or higher you can utilize the solution provided above. If you have IOS devices running something lower than 15.2.4 you can still do pki ssh login. The process is a bit different. You have to create local user profiles and store their public key on your device. Regardless you can definitely accomplish this.

HTH!