DETAILED STEPS
Purpose
Command or Action
Enters global configuration mode.
configure terminal
Example:
Step 1
switch# configure terminal
switch(config)#
Configures a user account. The
user-id
argument is a
case-sensitive, alphanumeric character string with a
username user-id
[
password
[
0
|
5
]
password
]
Example:
Step 2
maximum length of 28 characters. Valid characters are
switch(config)# username jsmith password 4Ty18Rnt
uppercase letters A through Z, lowercase letters a through
z, numbers 0 through 9, hyphen (-), period (.), underscore
(_), plus sign (+), and equal sign (=). The at symbol (@)
is supported in remote usernames but not in local
usernames.
Usernames must begin with an alphanumeric character.
The default password is undefined. The
0
option indicates
that the password is clear text, and the
5
option indicates
that the password is encrypted. The default is
0
(clear text).
If you do not specify a password, the user might
not be able to log in to the Cisco NX-OS device.
Note
If you create a user account with the encrypted
password option, the corresponding SNMP user
will not be created.
Note
Specifies an SSH X.509 certificate distinguished name
and DSA or RSA algorithm to use for authentication for
username user-id ssh-cert-dn dn-name
{
dsa
|
rsa
}
Example:
Step 3
an existing user account. The distinguished name can be
switch(config)# username jsmith ssh-cert-dn "/O
= ABCcompany, OU = ABC1,
up to 512 characters and must follow the format shown in
the examples. Make sure the email address and state are
configured as emailAddress and ST, respectively.
emailAddress = [email protected], L =
Metropolis, ST = New York, C = US, CN = jsmith"
rsa
Configures a trustpoint.
[
no
]
crypto ca trustpoint trustpoint
Step 4
Example:
Before you delete a trustpoint using the
no
form
of this command, you must first delete the CRL
and CA certificate, using the
delete crl
and
delete ca-certificate
commands.
Note
switch(config)# crypto ca trustpoint winca
switch(config-trustpoint)#
Configures a CA certificate for the trustpoint.
crypto ca authenticate trustpoint
Step 5
Example:
To delete a CA certificate, enter the
delete
ca-certificate
command in the trustpoint
configuration mode.
Note
switch(config-trustpoint)# crypto ca authenticate
winca
This command is optional but highly recommended.
Configures the certificate revocation list (CRL) for the
(Optional)
crypto ca crl request trustpoint
bootflash:static-crl.crl
Step 6
trustpoint. The CRL file is a snapshot of the list of revoked
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
140
Configuring SSH and Telnet
Configuring X.509v3 Certificate-Based SSH Authentication
