connection that is encrypted. With authentication and encryption, the SSH client allows for a secure
communication over an insecure network.
The SSH client in the Cisco NX-OS software works with publicly and commercially available SSH servers.
SSH Server Keys
SSH requires server keys for secure communications to the Cisco NX-OS device. You can use SSH server
keys for the following SSH options:
• SSH version 2 using Rivest, Shamir, and Adelman (RSA) public-key cryptography
• SSH version 2 using the Digital System Algrorithm (DSA)
• SSH version 2 using the Elliptic Curve Digital Signature Algorithm (ECDSA)
Be sure to have an SSH server key-pair with the appropriate version before enabling the SSH service. You
can generate the SSH server key-pair according to the SSH client version used. The SSH service accepts two
types of key-pairs for use by SSH version 2:
• The
dsa
option generates the DSA key-pair for the SSH version 2 protocol.
• The
rsa
option generates the RSA key-pair for the SSH version 2 protocol.
• The
ecdsa
option generates the ECDSA key-pair for the SSH version 2 protocol.
By default, the Cisco NX-OS software generates an RSA key using 1024 bits.
SSH supports the following public key formats:
• OpenSSH
• IETF Secure Shell (SECSH)
• Public Key Certificate in Privacy-Enhanced Mail (PEM)
If you delete all of the SSH keys, you cannot start the SSH services.
Caution
SSH Authentication Using Digital Certificates
SSH authentication on Cisco NX-OS devices provide X.509 digital certificate support for host authentication.
An X.509 digital certificate is a data item that ensures the origin and integrity of a message. It contains
encryption keys for secured communications and is signed by a trusted certification authority (CA) to verify
the identity of the presenter. The X.509 digital certificate support provides either DSA or RSA algorithms for
authentication.
The certificate infrastructure uses the first certificate that supports the Secure Socket Layer (SSL) and is
returned by the security infrastructure, either through a query or a notification. Verification of certificates is
successful if the certificates are from any of the trusted CAs configured and if not revoked or expired.
You can configure your device for SSH authentication using an X.509 certificate. If the authentication fails,
you are prompted for a password.
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
128
Configuring SSH and Telnet
SSH Server Keys
