System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

Public-key authentication for SSH clients

Updated: September 18, 2026

Want to summarize with AI?

Explains how passwordless public-key authentication works when a Cisco IOS XR router acts as an SSH, SFTP, or SCP client for a locally configured user.

SSH client public-key authentication is a passwordless method that

generates a user-specific RSA key pair on the router acting as the client
installs the public key on the remote SSH server, and
uses the private key on the client to prove the user's identity.

The method also supports passwordless SFTP and SCP operations for locally configured users.

Table 1. Feature History Table
Feature Name	Release Information	Feature Description
Public Key-Based Authentication of SSH Clients on Cisco IOS XR Routers	Release 25.4.1	Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only) This feature is supported on: 8011-32Y8L2H2FH 8011-12G12X4Y-A/D
Public Key-Based Authentication of SSH Clients on Cisco IOS XR Routers	Release 25.1.1	Introduced in this release on: Fixed Systems (8700 [ASIC: K100], 8010 [ASIC: A100])(select variants only) This feature is supported on: 8712-MOD-M 8011-4G24Y4H-I
Public Key-Based Authentication of SSH Clients on Cisco IOS XR Routers	Release 24.4.1	Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100])(select variants only); Modular Systems (8800 [LC ASIC: P100])(select variants only) *This feature is supported on: 8212-48FH-M 8711-32FH-M 88-LC1-36EH 88-LC1-12TH24FH-E 88-LC1-52Y8H-EM
Public Key-Based Authentication of SSH Clients on Cisco IOS XR Routers	Release 7.10.1	You are now assured of cryptographic strength even as you avail of automated password-less login while establishing SSH connections with the server. With the password and keyboard-interactive authentication, Cisco IOS XR routers configured as SSH clients now support public key-based authentication. In this authentication method, passwords need not be sent over the network; hence, it provides an additional layer of security and aids in automation processes. This feature is available only for users locally configured on the router; not those configured on remote servers. Previous releases supported SSH public key-based authentication only for Cisco IOS XR routers configured as SSH servers. The feature introduces these changes: CLI: crypto key generate authentication-ssh rsa crypto key zeroize authentication-ssh rsa show crypto key mypubkey authentication-ssh rsa Yang Data Models: New Xpaths for: `Cisco-IOS-XR-crypto-act.yang` `Cisco-IOS-XR-crypto-cepki-new-oper.yang` (see GitHub, YANG Data Models Navigator)

Security characteristics

The private key is not sent over the network. The server challenges the client with the stored public key, and only the client holding the corresponding private key can produce the required response.

How SSH client public-key authentication works

The router generates and retains an RSA authentication key pair for a locally configured user.

Summary

The server stores the public key. The client keeps the private key and uses it to answer the server's authentication challenge.

Workflow

These stages describe SSH client public-key authentication:

An administrator generates an RSA authentication key pair on the router acting as the SSH client.
The administrator installs the public key in the remote user's authorized-key store.
The client requests an SSH connection for the locally configured user.
The server uses the stored public key to challenge the client. The client uses the corresponding private key to produce the valid response.
The server verifies the response and authenticates the user without requesting the account password.

Result

The router establishes a passwordless SSH, SFTP, or SCP connection to the remote server.

Guidelines for public-key authentication of SSH clients

Prepare the client key pair and server authorization before requesting public-key authentication.

Use an RSA authentication key; the client feature supports only RSA.
Configure the user locally on the router. RADIUS and TACACS+ do not authenticate direct public keys.
Use a root-privileged account to create or delete another user's keys.
Install the correct public key for the user on the SSH server.
Generate the authentication key before starting the connection. Without a key, the client does not attempt public-key authentication.

A missing client key or an incorrect server-side public key causes user authentication to fail.

Enable public-key authentication for an SSH client

Authenticate a router acting as an SSH client without sending a user password.

Before you begin

Configure the user locally on the router.
Obtain administrator access or existing user credentials that permit installation of the public key on the remote server.

Procedure

Generate the RSA authentication key pair.

Example:

Router# crypto key generate authentication-ssh rsa
How many bits in the modulus [2048]: 2048
Generating RSA keys ...
Done w/ crypto generate keypair
[OK]

The supported modulus range is 512 through 4096 bits.

Display and copy the generated public key in OpenSSH format.

Example:

Router# show crypto key mypubkey authentication-ssh rsa
Key label: sample-user
Type : RSA Authentication
Size : 2048
OpenSSH Format:
ssh-rsa AAAA...sample-public-key

Install the public key for the user on the remote SSH server.
- On a Cisco IOS XR SSH server, import the key with crypto key import authentication rsa .
- On a Linux SSH server, add the key to the user's ~/.ssh/authorized_keys file.
Connect to the remote SSH server.
Example:
```
Router# ssh sample-user@192.0.2.225
```

The router authenticates with its private key and opens the SSH connection without prompting for the remote account password.

Delete SSH client authentication keys

Remove client authentication keys that are no longer authorized for outbound SSH connections.

Before you begin

Use root privileges when deleting keys that belong to another user.

Procedure

Delete the RSA authentication keys for the user.

Example:

Router# crypto key zeroize authentication-ssh rsa username sample-user

The SSH client can no longer use the deleted key pair for public-key authentication.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.