Contents

Introduction

Problem

Solution

Pre-requisites

Overview

Setting up the public/private key pair for the user account on the MDS

Setting up the public/private key pair for the user account on the Linux host

Test SCP from the switch to the Linux host.

Related Cisco Support Community Discussions

Introduction

This document describes how to setup the Multilayer Data Switch (MDS) 9000 to transfer information via the Secure Shell (SSH) protocol without providing a password for the user.

Problem

Transferring files from an MDS switch over SSH, using protocols like Secure Copy (SCP), requires a password by default.  Interactively providing an SSH password can be inconvenient and some external user scripts may not be able to provide the password interactively.

Solution

Generate public/private keypairs on the MDS switch and add the public key to a user account authorized_keys file on the SSH server.

Pre-requisites

For this example, a generic Linux server (RedHat, Ubuntu, etc.) configured with an SSH server and client installed.

Overview

This document outlines the steps required for an SSH transfer from the MDS 9000 to a linux server without providing a password, which is described in four steps.

- Setting up the public/private key pair for the user account which will be setup to “copy” the data out of the switch. (i.e. the account from which the SSH or SCP command will be executed, in this example “testuser”)

- Setting up the public/private key pair for the user account on the Linux host so that user “testuser” should copy or move the information out of the switch without having to provide the password from the switch prompt.

- Test SCP from the switch to the Linux host.

Setting up the public/private key pair for the user account on the MDS

From MDS 9000 switch, create the username “testuser” with password and role as network-admin. Make sure to create the user and network-admin role user for keypair generation to work.

sw12# conf t

Enter configuration commands, one per line.  End with CNTL/Z.

sw12(config)# username testuser password cisco_123 role network-admin

sw12(config)# cop run start

[########################################] 100%

sw12(config)#

SSH into the switch from the Linux host with the username created in previous step:

sj-lnx[85]:~$ ssh testuser@192.168.12.112

User Access Verification

Password:

Cisco Nexus Operating System (NX-OS) Software

TAC support: http://www.cisco.com/tac

Copyright (c) 2002-2010, Cisco Systems, Inc. All rights reserved.

The copyrights to certain works contained in this software are

owned by other third parties and used and distributed under

license. Certain components of this software are licensed under

the GNU General Public License (GPL) version 2.0 or the GNU

Lesser General Public License (LGPL) Version 2.1. A copy of each

such license is available at

http://www.opensource.org/licenses/gpl-2.0.php and

http://www.opensource.org/licenses/lgpl-2.1.php

sw12#

Generate the keypair for user testuser using rsa with length of 1024 bits.

sw12# conf t

Enter configuration commands, one per line.  End with CNTL/Z.

sw12(config)# username testuser keypair generate rsa 1024

generating rsa key(1024 bits)......

generated rsa key

sw12(config)# show username testuser keypair

**************************************

rsa Keys generated:Tue Apr 16 15:05:18 2013

ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAs3RocZLGp0y0sTdKXydmJDQVG//wAWXys7xk2DrcgQco

fY8+bRUBAUfMasoOVUvrCvV0qOdC8woV4KgF0nQgfX/mhuKqjWHW6IEBMmPY8v+OjXn+Avj3CH8K7h1z

tmbtFPo04rR7ivJx/boPQopk7mlpeocEzpVihOCIRiVJaj0=

bitcount:1024

fingerprint:

8b:d8:7b:2f:bf:14:ee:bc:a4:d3:54:0a:9a:4d:db:60

**************************************

could not retrieve dsa key information

**************************************

sw12(config)# cop run start

[########################################] 100%

sw12(config)#

Export the keypair to bootflash:, provide the Passphrase (Whatever you want, just make a note of it somewhere.)

sw12(config)# username testuser keypair export bootflash:testuser_rsa rsa

Enter Passphrase:

sw12(config)# dir bootflash:

16384    Apr 15 15:21:31 2012  lost+found/

18693120    Apr 15 15:22:55 2012  m9100-s3ek9-kickstart-mz.5.0.1a.bin

73579433    Apr 15 15:23:53 2012  m9100-s3ek9-mz.5.0.1a.bin

5778    Apr 15 15:24:48 2013  mts.log

951    Apr 16 15:07:01 2013  testuser_rsa

219    Apr 16 15:07:02 2013  testuser_rsa.pub

Usage for bootflash://sup-local

143622144 bytes used

533487616 bytes free

677109760 bytes total

sw12(config)#

Setting up the public/private key pair for the user account on the Linux host

Copy the rsa public key for user testuser from the switch onto the Linux host with username "testuser" already present. Please note that you will need to provide the password for username testuser which may or may not be the same as what was previously created on the switch.

Note: These instructions use an example where the testuser account path is /users/testuser. Depending on your Linux version this path may be different.

sw12(config)# copy bootflash:testuser_rsa.pub scp://testuser@192.168.12.100/users/testuser/.ssh

The authenticity of host '192.168.12.100 (192.168.12.100)' can't be established.

RSA key fingerprint is 91:42:28:58:f9:51:31:4d:ba:ac:95:50:51:09:96:74.

Are you sure you want to continue connecting (yes/no)? yes

Warning: Permanently added '192.168.12.100' (RSA) to the list of known hosts.

testuser@192.168.12.100's password:

testuser_rsa.pub                                 100%  219     0.2KB/s   00:00

sw12(config)# dir bootflash:

16384    Apr 15 15:21:31 2012  lost+found/

18693120    Apr 15 15:22:55 2012  m9100-s3ek9-kickstart-mz.5.0.1a.bin

73579433    Apr 15 15:23:53 2012  m9100-s3ek9-mz.5.0.1a.bin

5778    Apr 15 15:24:48 2013  mts.log

951    Apr 16 15:07:01 2013  testuser_rsa

219    Apr 16 15:07:02 2013  testuser_rsa.pub

Usage for bootflash://sup-local

143622144 bytes used

533487616 bytes free

677109760 bytes total

sw12(config)#

On the Linux server you need to add contents of the testuser_rsa.pub file to the authorized_keys file (or authorized_keys2 file depending on your version of SSH):

sj-lnx[91]:~/$ cd .ssh

sj-lnx[92]:~/.ssh$ chmod 644 authorized_keys2

sj-lnx[93]:~/.ssh$ ls -lrt

lrwxrwxrwx 1 testuser  eng    16 Apr  7  2005 authorized_keys -> authorized_keys2

-rw-r--r-- 1 testuser eng  1327 Apr 16 15:04 authorized_keys2

-rw-r--r-- 1 testuser eng   219 Apr 16 15:13 testuser_rsa.pub

sj-lnx[94]:~/.ssh$ cat testuser_rsa.pub

ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAs3RocZLGp0y0sTdKXydmJDQVG//wAWXys7xk2DrcgQcofY8+bRUBAUfMasoOVUvrCvV0qOdC8woV4KgF0nQgfX/mhuKqjWHW6IEBMmPY8v+OjXn+Avj3CH8K7h1ztmbtFPo04rR7ivJx/boPQopk7mlpeocEzpVihOCIRiVJaj0= root@sw12

sj-lnx[95]:~/.ssh$ cat testuser_ras.pub >> authorized_keys2

sj-lnx[96]:~/.ssh$ cat authorized_keys2

ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA1XMy4dbF5Vy4+wvYWS7s/luE/HoyX+HD6Kwrre5lEP7ZRKm1S3blWxZeYIYuhL7kU714ZM0r4NzEcV2Jdt6/7Hai5FlnKqA04AOAYH6jiPcw0fjdLB98q96B4G5XvaoV7VP2HTNn7Uw5DpQ3+ODwjCgQE7PvBOS2yGKt9gYbLd8= root@sw12

ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAs3RocZLGp0y0sTdKXydmJDQVG//wAWXys7xk2DrcgQcofY8+bRUBAUfMasoOVUvrCvV0qOdC8woV4KgF0nQgfX/mhuKqjWHW6IEBMmPY8v+OjXn+Avj3CH8K7h1ztmbtFPo04rR7ivJx/boPQopk7mlpeocEzpVihOCIRiVJaj0= root@sw12

sj-lnx[97]:~/.ssh$

Test SCP from the switch to the Linux host.

Test SCP from the switch to Linux server and verify the copy from switch to the server without providing the password. (Please note that “No password is prompted for…”)

sw12(config)# dir bootflash:

16384    Apr 15 15:21:31 2012  lost+found/

18693120    Apr 15 15:22:55 2012  m9100-s3ek9-kickstart-mz.5.0.1a.bin

73579433    Apr 15 15:23:53 2012  m9100-s3ek9-mz.5.0.1a.bin

5778    Apr 15 15:24:48 2013  mts.log

951    Apr 16 15:07:01 2013  testuser_rsa

219    Apr 16 15:07:02 2013  testuser_rsa.pub

Usage for bootflash://sup-local

143622144 bytes used

533487616 bytes free

677109760 bytes total

sw12(config)# copy bootflash:mts.log scp://testuser@192.168.12.100/users/testuser

mts.log                                       100% 5778     5.6KB/s   00:00

sw12(config)#