DETAILED STEPS
Purpose
Command or Action
Enters global configuration mode.
configure terminal
Example:
Step 1
switch# configure terminal
switch(config)#
Generates the SSH public and private keys and stores them
in the home directory ($HOME/.ssh) of the Cisco NX-OS
[
no
]
username username keypair generate
{
rsa
[
bits
[
force
]] |
dsa
[
force
]}
Step 2
device for the specified user. The Cisco NX-OS device uses
Example:
the keys to communicate with the SSH server on the remote
machine.
switch(config)# username user1 keypair generate
rsa 2048 force
The
bits
argument is the number of bits used to generate
the key. The range is from 768 to 2048. The default value
is 1024.
Use the
force
keyword to replace an existing key. The SSH
keys are not generated if the
force
keyword is omitted and
SSH keys are already present.
Displays the public key for the specified user.
(Optional)
show username username keypair
Step 3
Example:
For security reasons, this command does not
show the private key.
Note
switch(config)# show username user1 keypair
Exports the public and private keys from the home directory
of the Cisco NX-OS device to the specified bootflash or
volatile directory.
Required:
username username keypair export
{
bootflash:filename
|
volatile:filename
} {
rsa
|
dsa
} [
force
]
Example:
Step 4
Use the
force
keyword to replace an existing key. The SSH
keys are not exported if the
force
keyword is omitted and
SSH keys are already present.
switch(config)# username user1 keypair export
bootflash:key_rsa rsa
To export the generated key pair, you are prompted to enter
a passphrase that encrypts the private key. The private key
is exported as the file that you specify, and the public key
is exported with the same filename followed by a .pub
extension. You can now copy this key pair to any Cisco
NX-OS device and use SCP or SFTP to copy the public key
file (*.pub) to the home directory of the server.
For security reasons, this command can be
executed only from global configuration mode.
Note
Imports the exported public and private keys from the
specified bootflash or volatile directory to the home
directory of the Cisco NX-OS device.
Required:
username username keypair import
{
bootflash:filename
|
volatile:filename
} {
rsa
|
dsa
} [
force
]
Example:
Step 5
Use the
force
keyword to replace an existing key. The SSH
keys are not imported if the
force
keyword is omitted and
SSH keys are already present.
switch(config)# username user1 keypair import
bootflash:key_rsa rsa
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
137
Configuring SSH and Telnet
Configuring SSH Passwordless File Copy
