Is ssh with pki possible?

[misch1942]

Hi,

I found documentation that ssh login should be able using x509 certificates. At least in NX-OS. But I did not find any documentation HOW this can be configured. Does anybody has a hint for me, where I can find more documentation about this? Is it possible in IOS 15?

Thanks for any hint.

Greetings,

Michael Schwartzkopff

[Rudy Sanjoko]

It is possible, please refer to following document by Ivan Pepelnjak on his blog regarding SSH with PKI on IOS v15.0.

ssh-rsa-authentication-works-in-ios

[misch1942]

Hi,

I thought my qustion was clear enough. I asked about x509 certificates, not about RSA key pairs. For RSA keys I would have to extract the keys from the certificate and configure it on all 1000+ switches.

[Rudy Sanjoko]

my mistake, kinda missed that part.

[misch1942]

Hi,

I think I finally found the answer. The ssh service on a cisco device can extract the keypair from the certificate on the PKI. But it cannot authenticate the user certificate against the CA on the PKI.

At least that is what I found after long experiments.

Greetings,

Michael Schwartzkopff

[chad patterson]

Ths document says that you can:

https://www.cisco.com/c/en/us/support/docs/security-vpn/secure-shell-ssh/212178-Configuring-SSH-with-x509-authentication.html

also 

Public Key Infrastructure Configuration Guide, Cisco IOS Release 15MT

[Mike.Cifelli]

I strongly suggest checking this out:
https://www.pragmasys.com/products/support/cisco-2-factor

This is how I have seen 2FA implemented with Cisco devices for pki ssh login.

Is it possible in IOS 15?
Yes. As long as you are running 15.2.4 or higher you can utilize the solution provided above. If you have IOS devices running something lower than 15.2.4 you can still do pki ssh login. The process is a bit different. You have to create local user profiles and store their public key on your device. Regardless you can definitely accomplish this.

HTH!