is encrypted. With authentication and encryption, the SSH client allows for a secure communication over an
insecure network.
The SSH client in the Cisco Nexus device works with publicly and commercially available SSH servers.
SSH Server Keys
SSH requires server keys for secure communications to the Cisco Nexus device. You can use SSH keys for
the following SSH options:
•
SSH version 2 using Rivest, Shamir, and Adelman (RSA) public-key cryptography
•
SSH version 2 using the Digital System Algrorithm (DSA)
Be sure to have an SSH server key-pair with the appropriate version before enabling the SSH service. You
can generate the SSH server key-pair according to the SSH client version used. The SSH service accepts three
types of key-pairs for use by SSH version 2:
•
The dsa option generates the DSA key-pair for the SSH version 2 protocol.
•
The rsa option generates the RSA key-pair for the SSH version 2 protocol.
By default, the Cisco Nexus device generates an RSA key using 1024 bits.
SSH supports the following public key formats:
•
OpenSSH
•
IETF Secure Shell (SECSH)
If you delete all of the SSH keys, you cannot start the SSH services.
Caution
SSH Authentication Using Digital Certificates
SSH authentication on CiscoNX-OS devices provide X.509 digital certificate support for host authentication.
An X.509 digital certificate is a data item that ensures the origin and integrity of a message. It contains
encryption keys for secured communications and is signed by a trusted certification authority (CA) to verify
the identity of the presenter. The X.509 digital certificate support provides either DSA or RSA algorithms for
authentication.
The certificate infrastructure uses the first certificate that supports the Secure Socket Layer (SSL) and is
returned by the security infrastructure, either through a query or a notification. Verification of certificates is
successful if the certificates are from any of the trusted CAs.
You can configure your device for SSH authentication using an X.509 certificate. If the authentication fails,
you are prompted for a password.
Beginning with Cisco NX-OS Release 7.0(3)I5(1), you can configure SSH authentication using X.509v3
certificates (RFC 6187). X.509v3 certificate-based SSH authentication uses certificates combined with a
smartcard to enable two-factor authentication for Cisco device access. The SSH client is provided by Cisco
partner Pragma Systems.
Cisco Nexus 3600 NX-OS Security Configuration Guide, Release 7.x
60
Configuring SSH and Telnet
SSH Server Keys
