0

I'm currently a trainee, and I am assigned to do a task where I have to find out whether it is possible if a switch can get its certificate by contacting the TACACS-Server.

To explain what I'm trying to say, I will describe my situation.

My company is currently accessing all switches on remote locations via Telnet (which is of course insecure). It is planned to switch to SSH. But because the switches are not in secured locations, my company doesn't want to keep the certificates for SSH on the switch itself, but on the TACACS server, and when logging into the switch, the switch gets the certificate from the server to authenticate. We're currently using TACACS for default authentication.

Is it possible that the switch can get the certificate from the TACACs server?

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 14, 2017 at 1:51

1 Answer 1

Reset to default
1

The short answer is no, because the SSH authentication happens before the login authentication (where the TACACS server is contacted).

Even if it were possible to download the certificate, you would then have the problem of verifying that the device that downloaded it is in fact the right switch.

I suspect having the certificate on the switch is relatively low risk. It would be very, very difficult (but not impossible) to steal the private key to impersonate the switch.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.