topic Re: Can You Enable SSHv2 via APIC-EM REST API? in Controllers

Can You Enable SSHv2 via APIC-EM REST API?

dandemer — Fri, 01 Mar 2019 12:31:17 GMT

Deploying/Enabling SSH during device turn up is an interactive process at the moment.

key generation and key length selection
confirming the key selection

Can APIC-EM REST API configure SSH via the API? This same use case can be applied to any configuration that is interactive in nature...the IOS asks you questions or to confirm a change/selected.

Thank You,

Dan

Re: Can You Enable SSHv2 via APIC-EM REST API?

Joe Clarke — Wed, 07 Sep 2016 16:52:04 GMT

Currently APIC-EM does not provide for arbitrary CLI automation. That's where something like Prime Infrastructure fits today. PI will allow you to create a template to perform all kinds of CLI changes (including interactive commands). PI also offers a northbound REST API so that you can upload templates and trigger them to run.

That said, the PnP process can bootstrap a device with SSHv2, including keys so that the device goes from zero (i.e., out of the box) to fully manageable by APIC-EM and Prime Infra.

Re: Can You Enable SSHv2 via APIC-EM REST API?

dandemer — Wed, 07 Sep 2016 17:24:29 GMT

To clarify with PnP you can import the keys and commands without having to go through the interactive prompt? Would this mean using a predefined RSA key pair and not having the device generate their own? I ask the second question as importing a key may work but it would not be unique to the device it sounds.

Thank you again as your earlier reply was quite helpful!

Dan

Re: Can You Enable SSHv2 via APIC-EM REST API?

Joe Clarke — Wed, 07 Sep 2016 17:34:22 GMT

Hmmm, maybe I was confused on what keys you're talking about. I was referring to a private key in order to enable SSH. That said, PnP deals with the config of the device, so if you're talking about users' SSH public keys, then, yes. You can have a config template that has the fingerprints of public keys. I have successfully generated those in a config template that I've pushed to APIC-EM in order to PnP-provision a device.