Change SSH Key in Cisco Nexus Switch

[johnlloyd_13]

hi,

our cisco nexus switch got flagged for using a "weak" SSH key.

previous admin probably forgot to generate the "proper" SSH/RSA 2048 bit key.

can i do this remotely change this on the fly? meaning, i generate a new SSH/RSA 2048 bit key without losing my SSH session?

or do i temporarily enable "feature telnet", telnet to nexus switch, generate SSH 2048 bit key, then disable telnet?

SW# sh ssh server
ssh version 2 is enabled

SW# sh ssh key
**************************************
rsa Keys generated:Thu Apr 7 05:12:15 2005

ssh-rsa AAAAB3NzaCxxx

bitcount:1024
fingerprint:

SW(config)# crypto key generate rsa label Switch modulus ?
<512-2048> Key-pair size

(config)# feature t?
tacacs+ Enable/Disable tacacs+
telnet Enable/Disable telnet

[balaji.bandi]

i suggest to do this command in the Lan or come console. (to be safe side)

most case that should work remotely, (enable telnet or any other method to connect ) while changing.

some time we cutting our own branch..

[Leo Laohoo]

I do this remotely with Catalyst switches.  Never tried with Nexus but the situation should be the same as Catalyst switches and routers.

[pieterh]

isn't the key used for initiating the SSH session?
after the key exchange and subsequesnt phase are complete and the  session is established it will remain active and you can
- generate a new key
- test the key by initiating a second session keeping the current session active to make corrections if needed.

https://www.cisco.com/c/en/us/support/docs/security-vpn/secure-shell-ssh/222335-understand-secure-shell-packet-exchange.html 

[M02@rt37 · Accepted solution]

Hello @johnlloyd_13 

You can generate a new RSA key on your nexus remotely over SSH without dropping your current session. The change only affect new conection; the existing session stays active.