Does anyone know how to import ssh public key to ASR9K (IOS-XR)?

Question

I am trying to login ASR9001 router using ssh public key authentication. I tried to import my ssh public key to the router but no success.

RP/0/RSP0/CPU0:ASR9K-1#crypto key import authentication rsa disk0:/test.pem
Cannot execute the command : Invalid argument

Does any one know how to do that?

Thanks.

Answer 1

I got response from Cisco Tech support and there are a few things not correctly described in the manual.

First, ASR router supports key size 1024 bit or smaller contrary to its manual(supporting up to 2048 bit key).
Second, only the key part of SSH public key must be 'de'coded w/ base64 en/decoding program.

SSH Key Generation

ssh-keygen -b 1024 -t rsa -f myrouter_sshkey

This will generate myrouter_sshkey and myrouter_sshkey.pub. When you look into the public key file, it looks like followings:

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDR/ggtknqBZ50pIAyzw0E93wfu2EsGLnft/uF6N4ov6Dsp1H7yoC5ssE+yOcrWHeDEQnD0BsNCLZPW+ye7jjYeE+CUrOINpi04PtD+zx95knpAFnREMV7w8fJ9c7/SMb2L4Jk6KlmTcqtM+lUgrxEnCD7Z1kpCUzkP+0D0N/RG2Q== [email protected]

We only need the second part of the public key file separated by space for base64 decoding.

'de'code SSH public key with base64.

cut -d" " -f2 myrouter_sshkey.pub | base64 -d > myrouter_sshkey.pub.b64

This generated file is binary format and can be imported to ASR router.
Note that if you're using MAC, use -D option instead.

Upload 'de'coded public key to the router.

RP/0/RSP0/CPU0:ASR9K#copy ftp:myrouter_sshkey.pub.b64 harddisk:/

I used ftp but you can use tftp or else.

import public key to a router user.

RP/0/RSP0/CPU0:ASR9K#admin
RP/0/RSP0/CPU0:ASR9K(admin)#crypto key import authentication rsa username admin

Verify key import

RP/0/RSP0/CPU0:ASR9K(admin)#sh crypto key authentication rsa all    
Key label: admin
Type     : RSA public key authentication
Size     : 1024
Imported : 18:39:54 UTC Thu Jul 03 2014
Data     :
 {{intentionally removed}}

Login test

ssh -oIdentitiesOnly=yes -i myrouter_sshkey ${myrouter}

Note that if you have more than one ssh keys, -oIdentitiesOnly=yes must be given or your connection will fail. SSH tries every keys sequentially until one of the keys is accepted or finally falls back to password authentication if applicable. SSH server may allow this multiple key trials even if the first key trial fails. Unfortunately ASR router seems not to allow this. If the first tried key fails, it disconnect the session. To explicitly specify the key you use, give -oIdentitiesOnly=yes option to ssh.

Answer 2

ip ssh pubkey-chain
  username ...
    key-string
    ...
    exit
  exit
exit

IOS-XR on the ASR9k appears to be poorly documented on the subject (other than saying it supports it.) crypto key import authentication rsa general-keys would appear to be the command, but there's no example of using it to import a user key, vs. the router's own identity.

Answer 3

Minsuk Song instructions worked, however some of the steps were not clear to me. Couple things I would like to clarify.

Re: "Upload 'de'coded public key to the router." section. The example does not share the exact syntax to pull the key from a remote system. Also note, you need to run an FTP server. For windows you can use Filezilla, for Linux I use the python library pyftpdlib (you can pip install the module) then run

sudo python -m pyftpdlib -p 21 -w

The actual syntax to pull from a remote server would be

copy ftp://@10.10.10.10//yourpublickey.pub harddisk:/

The Cisco will then prompt you for login info.

Re: "import public key to a router user." I did not need to type "admin" (I am running Cisco IOS XR 7.4.15). The syntax I used was the following:

crypto key import authentication rsa username yourusernameonthecisco ftp://@10.10.10.10//yourpublickey.pub

Everything else worked fine.