Cisco交换机SSH使用RSA公钥免密登录(IOS与Nexus,服务器以RHEL8为例)

news/2024/9/23 1:18:44/

目录

  • 需求
  • 实验步骤
    • 0. 实验环境
    • 1. Linux
    • 2. CiscoIOS
      • 基础设置
      • 保存密钥
      • 登陆测试
    • 3. CiscoNexus
      • 基础配置
      • 保存密钥
      • 登陆测试

需求

在实际工作中,常会遇到自动化的需求,那么在自动采集、配置等对网络设备的自动化需求中,不可避免的会遇到需要登录->采集->录入的流程。
而第一步登录,一般采用ssh进行安全的远程连接。不过每次需要输入密码的远程登陆不便于自动化的应用,因此需要采用免密登录

一般针对服务器如Linux的ssh免密登录,仅需要将需要免密登录进来的其他服务器的rsa公钥放入自己的authorized_keys文件中即可。
详细可以见我之前的笔记:linux下的openssh简介(centos 8)

那么,针对网络设备没有这个文件,应该如何进行rsa公钥的存放和ssh免密登录?
网络上对于华为设备如何配置ssh免密登录的文章很多(同时现网中很多华为真实设备有自动保存登录设备的RSA公钥的功能),但对于Cisco尤其存在IOS和Nexus两种软件版本的交换机反而没有直接可以使用的文章,因此本文将对此进行分享。

Cisco官网上有RSA和X.509两种配置方式,分别是公钥和CA两种方式,这里介绍的是RSA公钥免密登陆方式。
可以参考的官方文档:Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 10.5(x)

实验步骤

  1. 服务器创建rsa密钥对
  2. Cisco交换机保存服务器创建的rsa公钥
  3. 服务器ssh登录Cisco设备进行测试

0. 实验环境

在这里插入图片描述

设备型号IP
LinuxRHEL8192.168.100.141
SwitchCisco IOS192.168.100.100
NXOSCisco Nexus192.168.100.101
NetCLoud0(桥接VMnet8)N/A

1. Linux

Linux上仅需要能ping通两台交换机,申请rsa密钥对并将公钥记录下来即可

# 查看ip
[root@linux ~]# ip a s ens33 | awk 'NR==4 {print $2}'
192.168.100.141/24# 生成一个2048长度的密钥
# 交换机可能因为版本限制rsa的长度,2048是一个非常稳妥的长度
[root@linux ~]# ssh-keygen -b 2048
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
/root/.ssh/id_rsa already exists.
Overwrite (y/n)? y
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:WwIJVzyTw89Rsp2JVfUbUwjRr0g+LCUqXoXPT4NMC14 root@docker01
The key's randomart image is:
+---[RSA 2048]----+
|    . .+....==.oo|
|     o .B .* oo o|
|      o  Bo.+  +.|
|       .o E o   =|
|       .SX.O . o |
|      . ++B B .  |
|     . o.  + o   |
|      .     .    |
|                 |
+----[SHA256]-----+# 查看公钥,记录下来,可以用
# 以64字符为一行,因为Cisco IOS的公钥录入有行长度限制,需要多行录入,提前设置好方便录入
# 仅需要记录从ssh-rsa开始到主机名空格前结束
[root@linux ~]# fold -w 64 ~/.ssh/id_rsa.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCoVHfQEHOq50u7kl5ukfPwwoYn
RHGCaYEHht4Fy8O3pGM3hk9GyT/IsBBquiBR1cxPjvZFlIGUd9gc2v4Xk8JHPIsH
f3IaS/5lhL257N4CZcL+aZh/PWCaY3DSmZqJ3ywFlX1YLUDlUvelcG2fmc/p0brM
LCxawgePkzl/MQq++aiEW/cqfXHR134InlV9nhBYyADGQff7Mmg6ysq+EK+KBMqG
h6dSquXo3i8PnQSI0RwIf8W9oUOWFIFJAzaaauqmMQhwxFbsc6vL+OdctHc9Ndgy
z04O5bmoI7qT0Tgh1yuynHWmkfuUnC+Ci/S83BaFOyOKxn4ymEVA3mJCcA1t roo
t@linux

CiscoIOS_74">2. CiscoIOS

基础设置

# 查看版本
Switch#show version
Cisco IOS Software, vios_l2 Software (vios_l2-ADVENTERPRISEK9-M), Experimental Version 15.2(20200924:215240) [sweickge-sep24-2020-l2iol-release 135]# 修改主机名
test>en
test#configure terminal
test(config)#hostname Switch# 设置svi1 ip
Switch(config-if)#int vlan 1
Switch(config-if)#ip add 192.168.100.100 255.255.255.0# ping测试
Switch#ping 192.168.100.141
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.100.141, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 4/4/5 ms

保存密钥

# 均在配置模式下配置# 设置域名,不设置不能启用ssh和rsa
Switch(config)#ip domain-name test# 创建rsa密钥,用于开始ssh
Switch(config)#crypto key generate rsa
% You already have RSA keys defined named Switch.test.
Choose the size of the key modulus in the range of 360 to 4096 for yourGeneral Purpose Keys. Choosing a key modulus greater than 512 may takea few minutes.
How many bits in the modulus [512]: 2048
% Generating 2048 bit RSA keys, keys will be non-exportable...
[OK] (elapsed time was 3 seconds)# 启用sshv2
Switch(config)#ip ssh version 2# 启用ssh登录
Switch(config)#line vty 0 4
Switch(config-line)#transport input ssh
Switch(config-line)#login local
Switch(config-line)#exit# 设置无密码账号linux
Switch(config)#username linux privilege 15# 导入linux的公钥
Switch(config)#ip ssh pubkey-chain
Switch(conf-ssh-pubkey)#username linux
Switch(conf-ssh-pubkey-user)#key-string
# 以下是录入密钥,将前面录入的复制下来
Switch(conf-ssh-pubkey-data)#$2EAAAADAQABAAABAQCoVHfQEHOq50u7kl5ukfPwwoYn
Switch(conf-ssh-pubkey-data)#$k9GyT/IsBBquiBR1cxPjvZFlIGUd9gc2v4Xk8JHPIsH
Switch(conf-ssh-pubkey-data)#$Zh/PWCaY3DSmZqJ3ywFlX1YLUDlUvelcG2fmc/p0brM
Switch(conf-ssh-pubkey-data)#$/cqfXHR134InlV9nhBYyADGQff7Mmg6ysq+EK+KBMqG
Switch(conf-ssh-pubkey-data)#$8W9oUOWFIFJAzaaauqmMQhwxFbsc6vL+OdctHc9Ndgy
Switch(conf-ssh-pubkey-data)#$HWmkfuUnC+Ci/S83BaFOyOKxn4ymEVA3mJCcA1t
#录入完后退出,即完成录入
Switch(conf-ssh-pubkey-data)#exit
Switch(conf-ssh-pubkey-user)#exit
Switch(conf-ssh-pubkey)#exit

登陆测试

linuxssh Cisco交换机

# 登录后,可以看到回显有“永久将主机(RSA)添加入已知列表“
[root@docker01 ~]# ssh linux@192.168.100.100
The authenticity of host '192.168.100.100 (192.168.100.100)' can't be established.
RSA key fingerprint is SHA256:1DfhYAi7UO9ZocSjUhqnF6zCSYrAhXKrSI21J9+b+HE.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.100.100' (RSA) to the list of known hosts.IOSv - Cisco Systems Confidential -Supplemental End User License RestrictionsThis IOSv software is provided AS-IS without warranty of any kind. Under no circumstances may this software be used separate from the Cisco Modeling Labs Software that this software was provided with, or deployed or used as part of a production environment.By using the software, you agree to abide by the terms and conditions of the Cisco End User License Agreement at http://www.cisco.com/go/eula. Unauthorized use or distribution of this software is expressly prohibited.IOSv - Cisco Systems Confidential -Supplemental End User License RestrictionsThis IOSv software is provided AS-IS without warranty of any kind. Under no circumstances may this software be used separate from the Cisco Modeling Labs Software that this software was provided with, or deployed or used as part of a production environment.By using the software, you agree to abide by the terms and conditions of the Cisco End User License Agreement at http://www.cisco.com/go/eula. Unauthorized use or distribution of this software is expressly prohibited.Switch#en
Switch#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#
# 作为权限15的账号,可以进入配置模式进行配置

CiscoNexus_178">3. CiscoNexus

基础配置

# 查看版本,是9.3.8的Nexus OS
switch# show version
Cisco Nexus Operating System (NX-OS) Software
SoftwareBIOS: versionNXOS: version 9.3(8)BIOS compile time:NXOS image file is: bootflash:///nxos.9.3.8.binNXOS compile time:  8/4/2021 13:00:00 [08/04/2021 22:25:26]# 配置设备名
switch# conf t
Enter configuration commands, one per line. End with CNTL/Z.
switch(config)# hostn NXOS
NXOS(config)## 设置svi1 ip
NXOS(config-if)# ip add 192.168.100.101/24
NXOS(config-if)# do show ip int briIP Interface Status for VRF "default"(1)
Interface            IP Address      Interface Status
Vlan1                192.168.100.101 protocol-up/link-up/admin-up# ping测试
NXOS# ping 192.168.100.141
PING 192.168.100.141 (192.168.100.141): 56 data bytes
64 bytes from 192.168.100.141: icmp_seq=0 ttl=63 time=9.11 ms
64 bytes from 192.168.100.141: icmp_seq=1 ttl=63 time=8.318 ms
64 bytes from 192.168.100.141: icmp_seq=2 ttl=63 time=19.181 ms
64 bytes from 192.168.100.141: icmp_seq=3 ttl=63 time=7.7 ms
64 bytes from 192.168.100.141: icmp_seq=4 ttl=63 time=5.08 ms--- 192.168.100.141 ping statistics ---
5 packets transmitted, 5 packets received, 0.00% packet loss
round-trip min/avg/max = 5.08/9.877/19.181 ms

保存密钥

# 生成密钥,启用ssh
NXOS(config)# ssh key rsa
NXOS(config)# feature ssh# 查看ssh server key
NXOS(config)# show ssh key
**************************************
rsa Keys generated:Wed Aug 14 02:22:31 2024ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQC2ag54FDSbAT3Z3uVxHJ5LVEIedz6ximnx1lJr2gC6
r96XcUw2l+3vx704V6nMiFrdjsuMuP+k9cVmuHvdUy09/Q6pPiUD8I0/t+SdMz+PANoAsURLa06J/Gqo
v6RJVPtqKum1DsMR91d8UYXrNFKq62SvCDaNa486bAd8+/qMRw==bitcount:1024
fingerprint:
SHA256:RGZdz0/waQniT3HN+S+5haHBVst0N7DPHTc1WLadUyc
**************************************
could not retrieve dsa key information
**************************************
could not retrieve ecdsa key information
**************************************# 创建登陆方式为公钥登录的用户,输入linux的公钥
# 因为为一行输入,所以cat linux的公钥直接复制即可,不要切断换行
NXOS(config)# username linux sshkey ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCoVHfQEHOq50u7kl5ukfPwwoYnRHGCaYEHht4Fy8O3pGM3hk9GyT/IsBBquiBR1cxPjvZFlIGUd9gc2v4Xk8JHPIsHf3IaS/5lhL257N4CZcL+aZh/PWCaY3DSmZqJ3ywFlX1YLUDlUvelcG2fmc/p0brMLCxawgePkzl/MQq++aiEW/cqfXHR134InlV9nhBYyADGQff7Mmg6ysq+EK+KBMqGh6dSquXo3i8PnQSI0RwIf8W9oUOWFIFJAzaaauqmMQhwxFbsc6vL+OdctHc9Ndgyz04O5bmoI7qT0Tgh1yuynHWmkfuUnC+Ci/S83BaFOyOKxn4ymEVA3mJCcA1t

登陆测试

linuxssh Cisco交换机

# 使用创建的用户在linuxssh登录Cisco交换机
# 登录后,可以看到回显有“永久将主机(RSA)添加入已知列表“
[root@docker01 ~]# ssh linux@192.168.100.101
The authenticity of host '192.168.100.101 (192.168.100.101)' can't be established.
RSA key fingerprint is SHA256:RGZdz0/waQniT3HN+S+5haHBVst0N7DPHTc1WLadUyc.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.100.101' (RSA) to the list of known hosts.
User Access VerificationCisco NX-OS Software
Copyright (c) 2002-2021, Cisco Systems, Inc. All rights reserved.
Nexus 9000v software ("Nexus 9000v Software") and related documentation,
files or other reference materials ("Documentation") are
the proprietary property and confidential information of Cisco
Systems, Inc. ("Cisco") and are protected, without limitation,
pursuant to United States and International copyright and trademark
laws in the applicable jurisdiction which provide civil and criminal
penalties for copying or distribution without Cisco's authorization.Any use or disclosure, in whole or in part, of the Nexus 9000v Software
or Documentation to any third party for any purposes is expressly
prohibited except as otherwise authorized by Cisco in writing.
The copyrights to certain works contained herein are owned by other
third parties and are used and distributed under license. Some parts
of this software may be covered under the GNU Public License or the
GNU Lesser General Public License. A copy of each such license is
available at
http://www.gnu.org/licenses/gpl.html and
http://www.gnu.org/licenses/lgpl.html
***************************************************************************
*  Nexus 9000v is strictly limited to use for evaluation, demonstration   *
*  and NX-OS education. Any use or disclosure, in whole or in part of     *
*  the Nexus 9000v Software or Documentation to any third party for any   *
*  purposes is expressly prohibited except as otherwise authorized by     *
*  Cisco in writing.                                                      *
***************************************************************************
NXOS# conf t
Enter configuration commands, one per line. End with CNTL/Z.
# 该用户在创建时没有设置权限,因此没有权限进入接口视图,可以后续根据需求自行设置
NXOS(config)# int mgmt0
% Permission denied for the role
NXOS(config)# vlan 2
% Permission denied for the role

实验完毕。


http://www.ppmy.cn/news/1509053.html

相关文章

DALL-E 2: 重新定义图像生成的人工智能|深度学习|图像生成|Transformer|创意设计|艺术创作|图像优化|数据偏见|计算资源|精度|跨领域融合

目录 1. DALL-E 2 的技术原理 1.1 深度学习与Transformer架构 1.2 文本编码与图像生成 2. DALL-E 2 的应用场景 2.1 创意设计与广告行业 2.2 教育与科研 2.3 艺术创作 3. DALL-E 2 的实际操作 3.1 简单示例 3.2 图像优化与微调 4. DALL-E 2 的挑战与未来展望 4.1 数…

15.3 模型评估与调优

欢迎来到我的博客,很高兴能够在这里和您见面!欢迎订阅相关专栏: 工💗重💗hao💗:野老杂谈 ⭐️ 全网最全IT互联网公司面试宝典:收集整理全网各大IT互联网公司技术、项目、HR面试真题. ⭐️ AIGC时代的创新与未来:详细讲解AIGC的概念、核心技术、应用领域等内容。 ⭐…

什么是产品经理?产品经理需要具备哪些专业的能力?

一、什么是产品经理? 产品经理(Product Manager, PM)是一个关键的角色,通常在科技公司或任何需要开发和管理产品的组织中找到。产品经理负责规划、开发、发布和生命周期管理的产品或产品线。以下是产品经理的一些基本定义和特点&a…

DAMA学习笔记(十四)-数据管理成熟度评估

1.引言 能力成熟度评估(Capability Maturity Assessment,CMA)是一种基于能力成熟度模型(Capability Maturity Model,CMM)框架的能力提升方案,描述了数据管理能力初始状态发展到最优化的过程。CM…

中介者模式在Java中的实现:设计模式精解

中介者模式在Java中的实现:设计模式精解 中介者模式(Mediator Pattern)是一种行为型设计模式,用于定义一个中介者对象,以封装一系列对象之间的交互,从而使对象之间的交互不再直接发生,减少了系…

【Rust光年纪】数据库客户端大赏:Rust语言六款利器全面解析

探秘Rust数据库客户端:功能对比、使用场景剖析、快速上手指南 前言 在现代软件开发中,数据库操作是一个至关重要的领域。为了提高效率并简化开发人员的工作,许多编程语言都提供了各种数据库客户端和ORM工具。Rust语言作为一门快速、安全的系…

Android逆向题解 攻防世界难度4- Android2.0

Jeb打开apk 关键代码在Native函数getResult IDA 打开 so 发现代码比较简单,可以直接静态分析。 输出字符串也就是flag 长度是15,然后分成三段,第一段是可以整除3,第二段是除3取余1,第三段是除3取余等于2&#xff1…

前端代码书写规范

前端代码书写规范 前端代码书写规范是确保项目可维护性、可读性和团队协作效率的关键。以下是一些关键的注意事项,涵盖了项目命名规则、组件命名规则、代码规范以及JS, CSS, HTML和注释规范等方面。 项目命名规则 明确性:项目名称应该清晰地反映项目的…