Hi Arne,
I tried the proposed solution and it did not work. I can ping and SSH from my ISE 2.7 patch 7 into the SFTP server (see next), BUT I cannot get the KEY FINGERPRINT as per your example (I also used IP for the SFTP no DNS resolution). I mean, not getting the 2nd part of the CRYPTO HOST KEY ADD HOST "IP" (see also below). I have tried everything and still not working. Any thoughts? I am exploring if the option of adding in the KNOWN Hosts of my ISE the key/fingerprint
# Host 10.48.148.10 found: line 1
10.48.148.10 RSA SHA256:e98rk9cO5vKtehEye+CgpvxcEkmoPpGhd1qi+MFMok4
myISE/admin# show repository myrepo13
6 [17055]:[info] transfer: cars_xfer.c[224] [admin]: sftp dir of repository myrepo13 requested
6 [17055]:[info] transfer: cars_xfer_util.c[2296] [admin]: Server validation successful 10.1.1.100
7 [17055]:[debug] transfer: sftp_handler.c[1093] [admin]: Running sftp command: 10.1.1.100 testing *** /home/isebck/ ls -l /home/isebck/
6 [17055]:[info] transfer: sftp_handler.c[583] [admin]: DEBUG: local user: admin UID: 0 sftp_run_parent FD: 5 remote host: 10.1.1.100 remote user: testing command: ls -l /home/isebck/
7 [17055]:[debug] transfer: sftp_handler.c[592] [admin]: fd is:5
7 [17057]:[debug] transfer: sftp_handler.c[290] [admin]: Executing SFTP command: 0 admin /usr/bin/sftp -oIdentityFile=/home/admin/.ssh/id_rsa -oUserKnownHostsFile=/home/admin/.ssh/known_hosts -oPasswordAuthentication=yes nsmgmt@10.1.1.100
3 [17055]:[error] transfer: sftp_handler.c[652] [admin]: sftp_run_parent Error: host key is not configured, or parsing error
% Error: Repository myrepo13 could not be accessed. In case Backup was Restored on different setup, Please reconfigure the repository passwords (expected behaviour).
7 [17055]:[debug] transfer: sftp_handler.c[962] [admin]: sftp parent status -306
% Error : Operation failed due to one of the following reasons
1. host key is not configured
2. host key is removed because of re-image
3. host key is removed from some other repository having same ip/hostname
% Please add the host key using the crypto host_key exec command
% SSH connect error
myISE/admin#
NOTHING from the following command output
myISE/admin#
myISE/admin show crypto host_keys
myISE/admin#
As I mentioned, when I followed the procedure of removing everything from CLI / GUI and recreated it, the next command did not provide me with the 2nd part of the output as your example
myISE/admin#
myISE/admin# crypto host_key add host 10.1.1.100
host key fingerprint added
Operating in CiscoSSL FIPS mode
**************NO RSA SHA 256 fingerprint output***************
# Host 10.48.148.10 found: line 1
10.48.148.10 RSA SHA256:e98rk9cO5vKtehEye+CgpvxcEkmoPpGhd1qi+MFMok4
myISE/admin#
********************SSH from ISE to SFTP Server*******************
my ISE/admin# ssh 10.1.1.100 testing
Operating in CiscoSSL FIPS mode
FIPS mode initialized
The authenticity of host '10.1.1.100 (10.1.1.100)' can't be established.
RSA key fingerprint is SHA256:0uSiedgerDEDGGG2341DDFTRVdfs.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.1.1.100' (RSA) to the list of known hosts.
testing@10.1.1.100's password:
Welcome to Ubuntu 22.04.3 LTS (GNU/Linux 5.15.0-78-generic x86_64)
System information as of Mon Aug 28 02:01:21 PM EDT 2023
System load: 1.11767578125 Processes: 273
Usage of /: 7.8% of 588.04GB Users logged in: 1
Memory usage: 8% IPv4 address for ens160: 10.1.1.100
Swap usage: 0%
*** System restart required ***
Last login: Mon Aug 28 13:48:56 2023 from 172.16.1.1
testing@mytoolbox:~$ ^C
testing@mytoolbox:~$
