System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

FIDO2 authentication for SSH

Updated: September 18, 2026

Want to summarize with AI?

Log in

Explains how FIDO2 hardware security keys provide passwordless SSH authentication while retaining private keys on the authenticator and requiring user presence.

FIDO2 authentication for SSH is an open authentication standard that

  • enables passwordless SSH login and multifactor authentication

  • stores the private key only on a hardware security key, and

  • requires user presence, such as touch or biometric confirmation, during login.

The client sends the registered public key during authentication. The server verifies that the key exists in the authorized-key database for the user, and the hardware device signs the authentication request without exposing its private key.

Table 1. Feature History Table

Feature Name

Release Information

Feature Description

FIDO2 authentication for SSH

Release 26.2.1

Introduced in this release on: Fixed Systems (8200 [ASIC: Q100, Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8600 [ASIC: Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

FIDO2 support for SSH enables secure, passwordless logins by using hardware security keys to store private keys. This feature requires physical user presence to authenticate sessions and protects against phishing by verifying a signature from the security device during the login process.

Supported algorithms

FIDO2 SSH authentication supports ed25519-sk and ecdsa-sk public-key types.

FIDO2 authentication guidelines

Follow these guidelines when using FIDO2 authentication for SSH:

  • Use FIDO2 authentication only for local SSH public-key authentication.

  • Store FIDO2 public keys in the authorized_keys file.

  • Use the ssh-server authorized-keys command to import FIDO2 public keys.

  • The private key never leaves the FIDO2 device.

  • User presence, such as touch or biometric confirmation, is mandatory during SSH authentication.

  • You can import multiple FIDO2 public keys for a single user.

Keeping the private key on the FIDO2 device and requiring user presence protects the authentication process from credential theft and unauthorized key use.

The router authenticates the user with a registered FIDO2 public key while the corresponding private key remains on the FIDO2 device.

FIDO2 authentication restrictions

Review these restrictions before configuring FIDO2 authentication for SSH.

FIDO2 authentication for SSH has these restrictions:

  • Remote authentication through TACACS+ or RADIUS is not supported for FIDO2 keys.

  • FIDO2 public keys cannot be stored in the CEPKI system database.

  • XRSSH does not support FIDO2 authentication.

  • Only ed25519-sk and ecdsa-sk key types are supported.

  • Automation of the complete authentication flow is limited because user presence is mandatory.

  • You cannot import FIDO2 keys by using the crypto key import authentication command.

Configure FIDO2 authentication for SSH

Set up FIDO2-based SSH authentication on Cisco IOS XR routers, enabling secure logins using a hardware security key such as a YubiKey.

FIDO2 authentication strengthens device access security by requiring both the user’s credentials and physical presence of a hardware-backed authenticator. This protects against phishing attacks and credential theft. Use this method when you need to enhance SSH security for administrators or automation systems accessing Cisco IOS XR routers, or when organizational policy mandates strong, multi-factor authentication.

Before you begin

  • Ensure you have a supported client - macOS, Windows, or any OS running OpenSSH 8.2+.

  • Obtain a FIDO2-compatible device such as a YubiKey.

  • Access privileges on the target Cisco IOS XR router.

Procedure

  1. Connect your FIDO2 device to the client machine.

    Plug in your YubiKey to your client (macOS, Windows, or supported system).

  2. Generate FIDO2 key pairs on your client.

    Example:

    ssh-keygen -t ecdsa-sk -f id_ecdsa_sk
    1. In your terminal, run ssh-keygen -t ecdsa-sk -f id_ecdsa_sk command.
    2. When prompted, touch your authenticator of YubiKey to authorize key generation.
    3. Enter a passphrase for the key if desired, then confirm the passphrase.
    4. A public key (id_ecdsa_sk.pub) and private key will be generated.

  3. Import your public key to the IOS XR router.

    1. Copy the contents of id_ecdsa_sk.pub from your client.
    2. On the router, enter EXEC mode and run the ssh-server authorized-keys command.
    3. If you do not provide a username, the key is imported for the current logged-in user.
    4. Paste the public key when prompted.

  4. Verify the imported SSH key on the IOS XR router.

    Example:

    Router#show ssh server authorized-keys user <username>
    1. Confirm your key appears in the authorized keys list.

  5. Test SSH access using the FIDO2 key.

    Example:

    Router#show ssh
SSH version : Cisco-2.0 
id       chan pty     location        state           userid    host                  ver authentication connection type
-------------------------------------------------------------------------------------------------------------------------------
Incoming sessions
974       0   vty1    0/RP0/CPU0      SESSION_OPEN    cafyauto  10.189.219.24         v2  sk-ecdsa-sha2-nistp256@openssh Command-Line-Interface 
    1. On your client, use the command:

      Example:

      ssh -i id_ecdsa_sk <username>@<router_ip>
    2. When prompted, touch your YubiKey to confirm presence.
    3. Upon successful authentication, you will see a login confirmation.

  6. Import multiple public keys for a user.

    You can import additional keys using step 3 for a specific username; the behavior remains as with previous (non-FIDO) public keys.

You have successfully configured FIDO-based SSH authentication for enhanced security. SSH connections now require your FIDO device for login.