2

I've been going through book CCNA 200-301 Official Cert Guide, Volume 1, as I'm learning for the CCNA exam:

CCNA_200-301_Official_Cert_Guide/Odom,_Wendell_-_CCNA_200-301_Official_Cert_Guide,_Volume_1.pdf
  • I have years of experience of using ssh-keygen on the client, then copying the public key to the SSH server for the purpose of logging in with the private key that stays on the client's machine
  • Alternatively, I have an option of configuring the SSH server so that I can use a password; in that case, I don't have to worry about copying the public key to the ssh server

What is described within chapter 6, and shown in an example, is that the switch serves as the SSH server with a PC as the client:

  • IOS uses the three SSH-specific configuration commands in the figure to create the SSH encryption keys. The SSH server uses the fully qualified domain name (FQDN) of the switch as input to create that key. The switch creates the FQDN from the hostname and domain name of the switch. [...] Then the third command, the crypto key generate rsa command, generates the SSH encryption keys.

    The configuration in Figure 6-5 relies on two default settings that the figure therefore conveniently ignored. IOS runs an SSH server by default. In addition, IOS allows SSH connections into the vty lines by default.

    Seeing the configuration happen in configuration mode, step by step, can be particularly helpful with SSH configuration. [...] Example 6-5 shows the commands in Figure 6-5 being configured, with the encryption key as the final step

    crypto key generate rsa
    Creates and stores (in a hidden location in flash memory) the keys required by SSH.


  1. Why is the keypair explicitly generated on the server [the switch] and not the client [the PC]?
  2. In the example described in the book and shown in the video, is password chosen as the mode of authentication instead of private key (on the client) that corresponds to the public key that is on the server?
  3. Does a keypair get generated every time that I install opensssh-server with apt?

If key-pairs do get generated every time openssh-server gets installed, what are they used for, as I've noticed there are some keys in /etc/ssh on the server that I use:

-rw-r--r-- 1 root root 505426 Aug 24 15:40 moduli
-rw-r--r-- 1 root root   1650 Feb 26  2022 ssh_config
drwxr-xr-x 2 root root   4096 Feb 26  2022 ssh_config.d
-rw------- 1 root root    525 Dec 11 17:49 ssh_host_ecdsa_key
-rw-r--r-- 1 root root    193 Dec 11 17:49 ssh_host_ecdsa_key.pub
-rw------- 1 root root    432 Dec 11 17:49 ssh_host_ed25519_key
-rw-r--r-- 1 root root    113 Dec 11 17:49 ssh_host_ed25519_key.pub
-rw------- 1 root root   2622 Dec 11 17:49 ssh_host_rsa_key
-rw-r--r-- 1 root root    585 Dec 11 17:49 ssh_host_rsa_key.pub
-rw-r--r-- 1 root root    342 Dec  7  2020 ssh_import_id
-rw-r--r-- 1 root root   3254 Aug 24 15:40 sshd_config
drwxr-xr-x 2 root root   4096 Dec 11 20:43 sshd_config.d
John Smith
  • 180

0 Answers0