cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
684
Views
0
Helpful
10
Replies

wont let me choose key size 2048 for ssh server

robertkwild
Spotlight
Spotlight

hi all,

trying to enable ssh server on a cisco cat switch but it wont let me use key size 2048

crypto key generate rsa modulus 2048
% You already have RSA keys defined named hostname.domain.com
% They will be replaced.

% The key modulus size is 2048 bits
% Generating 2048 bit RSA keys, keys will be non-exportable...
[OK] (elapsed time was 8 seconds)

do show ip ssh | i size
Minimum expected Diffie Hellman key size : 1024 bits

thanks,

rob

1 Accepted Solution

Accepted Solutions

configure as suggest : then generate the key

ip ssh dh min size 2048

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

View solution in original post

10 Replies 10

balaji.bandi
Hall of Fame
Hall of Fame

what device and IOS code running on the device :

tried my router with 15.X IOS :

R1#show ip ssh
SSH Disabled - version 1.99

R1(config-line)#crypto key generate rsa
The name for the keys will be: R1.bb.com
Choose the size of the key modulus in the range of 360 to 4096 for your
General Purpose Keys. Choosing a key modulus greater than 512 may take
a few minutes.

How many bits in the modulus [512]: 2048
% Generating 2048 bit RSA keys, keys will be non-exportable...
[OK] (elapsed time was 4 seconds)

R1#show ip ssh | in size
Minimum expected Diffie Hellman key size : 2048 bits

 

may be try zero the keys and re-generate.

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

robertkwild
Spotlight
Spotlight
sh ver
Cisco IOS Software, IOS-XE Software, Catalyst 4500 L3 Switch  Software (cat4500e                              -UNIVERSALK9-M), Version 03.10.02.E RELEASE SOFTWARE (fc4)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2018 by Cisco Systems, Inc.
Compiled Thu 13-Sep-18 07:38 by prod_rel_team



Cisco IOS-XE software, Copyright (c) 2005-2015 by cisco Systems, Inc.
All rights reserved.  Certain components of Cisco IOS-XE software are
licensed under the GNU General Public License ("GPL") Version 2.0.  The
software code licensed under GPL Version 2.0 is free software that comes
with ABSOLUTELY NO WARRANTY.  You can redistribute and/or modify such
GPL code under the terms of GPL Version 2.0.
(http://www.gnu.org/licenses/gpl-2.0.html) For more details, see the
documentation or "License Notice" file accompanying the IOS-XE software,
or the applicable URL provided on the flyer accompanying the IOS-XE
software.



ROM: 15.0(1r)SG5
4510MCR01 uptime is 4 years, 47 weeks, 4 days, 13 hours, 17 minutes
Uptime for this control processor is 4 years, 47 weeks, 4 days, 13 hours, 20 minutes
System returned to ROM by power-on
System image file is "bootflash:cat4500e-universalk9.SPA.03.10.02.E.152-6.E2.bin"
Jawa Revision 7, Snowtrooper Revision 0x0.0x1C

Last reload reason: power-on



This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.


License Information for 'WS-X45-SUP7-E'
    License Level: ipbase   Type: Permanent
    Next reboot license Level: ipbase

cisco WS-C4510R+E (MPC8572) processor (revision 10) with 2097152K bytes of physical memory.
Processor board ID FOX1609GVNA
MPC8572 CPU at 1.5GHz, Supervisor 7
Last reset from PowerUp
9 Virtual Ethernet interfaces
192 Gigabit Ethernet interfaces
8 Ten Gigabit Ethernet interfaces
511K bytes of non-volatile configuration memory.

Configuration register is 0x2102

you have base code.

Next reboot license Level: ipbase

can you post show ip ssh (full output)

did you configure ip ssh version 2 ? 

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

as i mentioned earlier, suggest to rekey by zero the keys and configure again and let us know.

 

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

didnt work

crypto key zeroize rsa
% All keys will be removed.
% All router certs issued using these keys will also be removed.
Do you really want to remove these keys? [yes/no]: yes
4510MCR01(config)#crypto key generate rsa modulus 2048
The name for the keys will be: 4510MCR01.domain.com

% The key modulus size is 2048 bits
% Generating 2048 bit RSA keys, keys will be non-exportable...
[OK] (elapsed time was 2 seconds)

4510MCR01(config)#do show ip ssh | i size
Minimum expected Diffie Hellman key size : 1024 bits

can you post show run all | in ssh  (if that show still 1024)

then yoiu need to manually rise to 2048

ip ssh dh min size 2048

https://community.cisco.com/t5/security-knowledge-base/guide-to-better-ssh-security/ta-p/3133344

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

still shows 1024

sh run all | in ssh
ip ssh time-out 120
ip ssh authentication-retries 5
ip ssh break-string ~break
ip ssh version 2
ip ssh dh min size 1024
ip ssh pubkey-chain

but if i manually resize to 2048 will that be the same as the other method ie generating it

configure as suggest : then generate the key

ip ssh dh min size 2048

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

Ruben Cocheno
Spotlight
Spotlight

@robertkwild 

Get the following command ip ssh version 2 and run again the command crypto key generate rsa modulus 2048

Note that with that uptime (4 years), probably a reload might not be a bad idea.

 

Tag me to follow up.
Please mark it as Helpful and/or Solution Accepted if that is the case. Thanks for making Engineering easy again.
Connect with me for more on Linkedin https://www.linkedin.com/in/rubencocheno/

robertkwild
Spotlight
Spotlight
sh ip ssh
SSH Enabled - version 2.0
Authentication methods:publickey,keyboard-interactive,password
Authentication Publickey Algorithms:x509v3-ssh-rsa,ssh-rsa
Hostkey Algorithms:x509v3-ssh-rsa,ssh-rsa
Encryption Algorithms:aes128-ctr,aes192-ctr,aes256-ctr
MAC Algorithms:hmac-sha1,hmac-sha1-96
Authentication timeout: 120 secs; Authentication retries: 5
Minimum expected Diffie Hellman key size : 1024 bits
IOS Keys in SECSH format(ssh-rsa, base64 encoded): 4510MCR01.domain.com
%SSH: Failed to encode IOS ASN.1 to SECSH format
Review Cisco Networking for a $25 gift card