Firepower Management Center Backup SSH Keypair

[goraprhelmad]

Hi,

we store our backups to a remote storage via sftp. It's possible to do this with SSH public/private keys. The FMC default uses ssh-rsa key for root@firepower which is stored in /etc/ssh on the filesystem. The remote server doesn't accept rsa keypairs anymore. How can I change this, such that the FMCv uses the ed25519 or ecdsa keypair, which is also in /etc/ssh?

Thx in advance.

[vishalbhandari]

You can’t directly change the key type used by FMC’s backup process through the GUI or CLI. The FMC backup function is hardcoded to use the default ssh-rsa key for root@firepower. Since your remote SFTP server no longer accepts RSA, the practical solution is to either:

1. Re-enable RSA temporarily on the SFTP server (if possible), or

2. Use an intermediate SFTP host that accepts RSA from FMC and forwards via ED25519/ECDSA, or

3. Open a TAC case to request an enhancement or verified workaround from Cisco, since manually modifying /etc/ssh or the backup script is unsupported and may break after upgrades.