wont let me choose key size 2048 for ssh server

[robertkwild]

hi all,

trying to enable ssh server on a cisco cat switch but it wont let me use key size 2048

crypto key generate rsa modulus 2048
% You already have RSA keys defined named hostname.domain.com
% They will be replaced.

% The key modulus size is 2048 bits
% Generating 2048 bit RSA keys, keys will be non-exportable...
[OK] (elapsed time was 8 seconds)

do show ip ssh | i size
Minimum expected Diffie Hellman key size : 1024 bits

thanks,

rob

[balaji.bandi]

what device and IOS code running on the device :

tried my router with 15.X IOS :

R1#show ip ssh
SSH Disabled - version 1.99

R1(config-line)#crypto key generate rsa
The name for the keys will be: R1.bb.com
Choose the size of the key modulus in the range of 360 to 4096 for your
General Purpose Keys. Choosing a key modulus greater than 512 may take
a few minutes.

How many bits in the modulus [512]: 2048
% Generating 2048 bit RSA keys, keys will be non-exportable...
[OK] (elapsed time was 4 seconds)

R1#show ip ssh | in size
Minimum expected Diffie Hellman key size : 2048 bits

may be try zero the keys and re-generate.

[robertkwild]

sh ver
Cisco IOS Software, IOS-XE Software, Catalyst 4500 L3 Switch  Software (cat4500e                              -UNIVERSALK9-M), Version 03.10.02.E RELEASE SOFTWARE (fc4)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2018 by Cisco Systems, Inc.
Compiled Thu 13-Sep-18 07:38 by prod_rel_team



Cisco IOS-XE software, Copyright (c) 2005-2015 by cisco Systems, Inc.
All rights reserved.  Certain components of Cisco IOS-XE software are
licensed under the GNU General Public License ("GPL") Version 2.0.  The
software code licensed under GPL Version 2.0 is free software that comes
with ABSOLUTELY NO WARRANTY.  You can redistribute and/or modify such
GPL code under the terms of GPL Version 2.0.
(http://www.gnu.org/licenses/gpl-2.0.html) For more details, see the
documentation or "License Notice" file accompanying the IOS-XE software,
or the applicable URL provided on the flyer accompanying the IOS-XE
software.



ROM: 15.0(1r)SG5
4510MCR01 uptime is 4 years, 47 weeks, 4 days, 13 hours, 17 minutes
Uptime for this control processor is 4 years, 47 weeks, 4 days, 13 hours, 20 minutes
System returned to ROM by power-on
System image file is "bootflash:cat4500e-universalk9.SPA.03.10.02.E.152-6.E2.bin"
Jawa Revision 7, Snowtrooper Revision 0x0.0x1C

Last reload reason: power-on



This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.


License Information for 'WS-X45-SUP7-E'
    License Level: ipbase   Type: Permanent
    Next reboot license Level: ipbase

cisco WS-C4510R+E (MPC8572) processor (revision 10) with 2097152K bytes of physical memory.
Processor board ID FOX1609GVNA
MPC8572 CPU at 1.5GHz, Supervisor 7
Last reset from PowerUp
9 Virtual Ethernet interfaces
192 Gigabit Ethernet interfaces
8 Ten Gigabit Ethernet interfaces
511K bytes of non-volatile configuration memory.

Configuration register is 0x2102

[balaji.bandi]

you have base code.

Next reboot license Level: ipbase

can you post show ip ssh (full output)

did you configure ip ssh version 2 ? 

[balaji.bandi]

as i mentioned earlier, suggest to rekey by zero the keys and configure again and let us know.

[robertkwild]

didnt work

crypto key zeroize rsa
% All keys will be removed.
% All router certs issued using these keys will also be removed.
Do you really want to remove these keys? [yes/no]: yes
4510MCR01(config)#crypto key generate rsa modulus 2048
The name for the keys will be: 4510MCR01.domain.com

% The key modulus size is 2048 bits
% Generating 2048 bit RSA keys, keys will be non-exportable...
[OK] (elapsed time was 2 seconds)

4510MCR01(config)#do show ip ssh | i size
Minimum expected Diffie Hellman key size : 1024 bits

[balaji.bandi]

can you post show run all | in ssh  (if that show still 1024)

then yoiu need to manually rise to 2048

ip ssh dh min size 2048

https://community.cisco.com/t5/security-knowledge-base/guide-to-better-ssh-security/ta-p/3133344

[robertkwild]

still shows 1024

sh run all | in ssh
ip ssh time-out 120
ip ssh authentication-retries 5
ip ssh break-string ~break
ip ssh version 2
ip ssh dh min size 1024
ip ssh pubkey-chain

but if i manually resize to 2048 will that be the same as the other method ie generating it

[balaji.bandi · Accepted solution]

configure as suggest : then generate the key

ip ssh dh min size 2048

[Ruben Cocheno]

@robertkwild 

Get the following command ip ssh version 2 and run again the command crypto key generate rsa modulus 2048

Note that with that uptime (4 years), probably a reload might not be a bad idea.

[robertkwild]

sh ip ssh
SSH Enabled - version 2.0
Authentication methods:publickey,keyboard-interactive,password
Authentication Publickey Algorithms:x509v3-ssh-rsa,ssh-rsa
Hostkey Algorithms:x509v3-ssh-rsa,ssh-rsa
Encryption Algorithms:aes128-ctr,aes192-ctr,aes256-ctr
MAC Algorithms:hmac-sha1,hmac-sha1-96
Authentication timeout: 120 secs; Authentication retries: 5
Minimum expected Diffie Hellman key size : 1024 bits
IOS Keys in SECSH format(ssh-rsa, base64 encoded): 4510MCR01.domain.com
%SSH: Failed to encode IOS ASN.1 to SECSH format