Hello all,
I have an issue trying to set up public key authentication with an iosxr device.
I have generated the public key (ssh-keygen -t rsa), copied it to the device. I have also added it to NSO and created an authgroup that uses the private key.
Regular ssh (from the NSO host) works ok using public key authentication:
ssh nso@10.10.10.10 -i /home/nso/.ssh/nso_admin -s netconf
Thu May 19 16:33:39.940 UTC
<?xml version="1.0" encoding="UTF-8"?>
<hello xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
...
</hello>
]]>]]>
However, when i try to do a sync-from via NSO:
devices device test-device sync-from
result false
info Failed to connect to device test-device: closed
A debug of the SSH session shows the following error:
RP/0/RP0/CPU0:May 19 16:00:29.249 UTC: SSHD_[67379]: User:nso,service:ssh-connection,Method:publickey
RP/0/RP0/CPU0:May 19 16:00:29.249 UTC: SSHD_[67379]: (sshd_authenticate) RSA based authentication requested
RP/0/RP0/CPU0:May 19 16:00:29.249 UTC: SSHD_[67379]: (sshd_authenticate) Requested public-key algorithm rsa-sha2-512 not supported
During a regular ssh login (that works) i get a different message:
RP/0/RP0/CPU0:May 19 16:39:54.102 UTC: SSHD_[67567]: User:nso,service:ssh-connection,Method:publickey
RP/0/RP0/CPU0:May 19 16:39:54.102 UTC: SSHD_[67567]: (sshd_authenticate) RSA based authentication requested
RP/0/RP0/CPU0:May 19 16:39:54.102 UTC: SSHD_[67567]: (sshd_authenticate) bool: 1, Pub Alg: ssh-rsa
My first thought was to go and change the device public key algorithms and restrict to ssh-rsa
# show running-config devices device test-device ssh-algorithms public-key
ssh-algorithms public-key [ ssh-rsa ]
But this doesn't work, it's most likely related to the hostkey not the user authentication key.
Any hints on how to solve this? I'm guessing i have to specify somewhere the user auth key exchange algorithm, but i haven't found where.
