Junos can allow users to authenticate using an SSH key pair, rather than using a username and password.
In this post we’ll look at the following examples:
- Adding an SSH key for a regular user
- Adding a second key for a regular user
- Adding an SSH key for the root user
Adding An SSH Key For A Regular User
First, we need to generate an SSH key pair. In this case, we’ll do this from a Linux host, allow the keys to be stored in the default location, and not enter a passphrase. The file id_rsa is the private key that we need to keep safe and not share. The id_rsa.pub is the public part of the key.
eve@linux-1:~$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/eve/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/eve/.ssh/id_rsa
Your public key has been saved in /home/eve/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:AnmGs4JswL+gfPiTNsNWPdsrEUq1v17ZnYNlZ7xNyfY eve@linux-1
The key's randomart image is:
+---[RSA 3072]----+
| |
|. o . |
|.. = + . |
|o.. B o ...|
|.+..o + S *=|
|+ o..o = . o *o*|
|.o.oo = .o o =E|
| oO o o. .|
| o.+ oo. |
+----[SHA256]-----+Now that we have the new keypair, we need to associate the public part of the keypair with our user on the Junos device. We’ll be using user5 for this.
There are two ways of doing this.
Method 1 – Display .pub file and paste contents in
The id_rsa.pub file is just a plain text file, so we can simply cat the file the view the contents.
eve@linux-1:~$ cat .ssh/id_rsa.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCI+Ezq8iFwpGnkWO2h7Qot0FeKfXHe63QLdhVDaueKW2gCrTypw8AC6JafOaOobOrYjHcCTzEmnxpJvNGvMx5jYEV/rpP9VYPyCvJIRGfIMAfZ4OwaV+/n7jkuKa2QKSGm8k3RdWXP48ioKg2e94b4A/VdBaWQ5UZBdAzY2Iwf8N3pQWNV4G865EGW8ELuZjSeqv0y4JdrOs38J8fMyMRq/rtgVUDOe5AwjZjFea5z0x7nkNbGQJlhkk/tKlZKnGMI4atezjF5JmZ8MrW9pQY4aBcD79S5HXpvr1MIUPFeC7Gg5NiHU9GYaUXR1l5fxY9wlpCkSLQ6o8e3sIMrhkQ0VoQ+UjlZvdQ1mYy92cwYDZmyPRq3DHLgmPktmKvPbODbcCqHUxbpobQUAIyo1PYIqWL2a7OFnn3OBsW+SJSvnMbO5cV9Mco9FP8A1QLsIjcDybPyMh2DU1BvKIqEkX030mFhBWRmK537uHQNxcm93lvdLqeHriwgUyXXTxSNtBs= eve@linux-1
eve@linux-1:~$Then use the ‘set system login user user5 authentication ssh-rsa <id_rsa.pub contents>’ command on the Junos device. The contents of the public key should be enclosed in double-quotes. It should look something like this when you’re done. Note that you should replace user5 with the relevant username.
[edit]
lab@vMX-1# show system login user user5
uid 2002;
class super-user;
authentication {
encrypted-password "REMOVED"; ## SECRET-DATA
ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCI+Ezq8iFwpGnkWO2h7Qot0FeKfXHe63QLdhVDaueKW2gCrTypw8AC6JafOaOobOrYjHcCTzEmnxpJvNGvMx5jYEV/rpP9VYPyCvJIRGfIMAfZ4OwaV+/n7jkuKa2QKSGm8k3RdWXP48ioKg2e94b4A/VdBaWQ5UZBdAzY2Iwf8N3pQWNV4G865EGW8ELuZjSeqv0y4JdrOs38J8fMyMRq/rtgVUDOe5AwjZjFea5z0x7nkNbGQJlhkk/tKlZKnGMI4atezjF5JmZ8MrW9pQY4aBcD79S5HXpvr1MIUPFeC7Gg5NiHU9GYaUXR1l5fxY9wlpCkSLQ6o8e3sIMrhkQ0VoQ+UjlZvdQ1mYy92cwYDZmyPRq3DHLgmPktmKvPbODbcCqHUxbpobQUAIyo1PYIqWL2a7OFnn3OBsW+SJSvnMbO5cV9Mco9FP8A1QLsIjcDybPyMh2DU1BvKIqEkX030mFhBWRmK537uHQNxcm93lvdLqeHriwgUyXXTxSNtBs= eve@linux-1"; ## SECRET-DATA
}
[edit]
lab@vMX-1#Method 2 – Copy the .pub file to the Junos Device
The second method is to copy the public key to the Junos device and use the load-key-file command. The following command assumes the public key is in the home directly of the currently logged-in user, lab in this case.
[edit]
lab@vMX-1# show system login user user5
uid 2002;
class super-user;
authentication {
encrypted-password "REMOVED"; ## SECRET-DATA
}
[edit]
lab@vMX-1# set system login user user5 authentication load-key-file id_rsa.pub
[edit]
lab@vMX-1# show system login user user5
uid 2002;
class super-user;
authentication {
encrypted-password "REMOVED"; ## SECRET-DATA
ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCI+Ezq8iFwpGnkWO2h7Qot0FeKfXHe63QLdhVDaueKW2gCrTypw8AC6JafOaOobOrYjHcCTzEmnxpJvNGvMx5jYEV/rpP9VYPyCvJIRGfIMAfZ4OwaV+/n7jkuKa2QKSGm8k3RdWXP48ioKg2e94b4A/VdBaWQ5UZBdAzY2Iwf8N3pQWNV4G865EGW8ELuZjSeqv0y4JdrOs38J8fMyMRq/rtgVUDOe5AwjZjFea5z0x7nkNbGQJlhkk/tKlZKnGMI4atezjF5JmZ8MrW9pQY4aBcD79S5HXpvr1MIUPFeC7Gg5NiHU9GYaUXR1l5fxY9wlpCkSLQ6o8e3sIMrhkQ0VoQ+UjlZvdQ1mYy92cwYDZmyPRq3DHLgmPktmKvPbODbcCqHUxbpobQUAIyo1PYIqWL2a7OFnn3OBsW+SJSvnMbO5cV9Mco9FP8A1QLsIjcDybPyMh2DU1BvKIqEkX030mFhBWRmK537uHQNxcm93lvdLqeHriwgUyXXTxSNtBs= eve@linux-1"; ## SECRET-DATA
}
[edit]
lab@vMX-1#Now the public key is loaded on the Junos device, we can try to ssh from the Linux host.
Last login: Fri Dec 29 05:55:33 2023 from 192.168.20.5
--- JUNOS 20.4R3-S2.6 Kernel 64-bit JNPR-11.0-20211117.c779bdc_buil
user5@vMX-1>Note that because our private key, id_rsa, had the default name and was in the default location, ssh used it. Also, because we did not set a passphrase on the key pair, we did not need to enter a passphrase to use the key to log in to the router.
Adding A Second SSH Key For A Regular User
You can add more than one key for a locally defined user on Junos.
Typically, another person would create their own key pair and share the public key portion. We’re going to create another key pair, but this time we will use a non-default location and also set a passphrase for the key pair.
eve@linux-1:~$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/eve/.ssh/id_rsa): new-user5-key
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in new-user5-key
Your public key has been saved in new-user5-key.pub
The key fingerprint is:
SHA256:dvWGIj0+OmqsHlUaAHugR7YWQBc0XV7MgiOjxCOVvuE eve@linux-1
The key's randomart image is:
+---[RSA 3072]----+
|++OB+ o.o. |
|.BoB.=...o |
|+.B + o.o . |
| +o. + . . o |
| . o o S = . o |
| E . . + o . |
| .. o |
| .o .. . |
| .oo.... |
+----[SHA256]-----+
eve@linux-1:~$ ls
backup config-backup1.conf config-backup2.conf config-backup3.conf new-user5-key new-user5-key.pub tmp
eve@linux-1:~$ We can now add this new-user5-key.pub information under user5 on the Junos device. The configuration now looks like this:
[edit]
lab@vMX-1# show system login user user5
uid 2002;
class super-user;
authentication {
encrypted-password "REMOVED"; ## SECRET-DATA
ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCI+Ezq8iFwpGnkWO2h7Qot0FeKfXHe63QLdhVDaueKW2gCrTypw8AC6JafOaOobOrYjHcCTzEmnxpJvNGvMx5jYEV/rpP9VYPyCvJIRGfIMAfZ4OwaV+/n7jkuKa2QKSGm8k3RdWXP48ioKg2e94b4A/VdBaWQ5UZBdAzY2Iwf8N3pQWNV4G865EGW8ELuZjSeqv0y4JdrOs38J8fMyMRq/rtgVUDOe5AwjZjFea5z0x7nkNbGQJlhkk/tKlZKnGMI4atezjF5JmZ8MrW9pQY4aBcD79S5HXpvr1MIUPFeC7Gg5NiHU9GYaUXR1l5fxY9wlpCkSLQ6o8e3sIMrhkQ0VoQ+UjlZvdQ1mYy92cwYDZmyPRq3DHLgmPktmKvPbODbcCqHUxbpobQUAIyo1PYIqWL2a7OFnn3OBsW+SJSvnMbO5cV9Mco9FP8A1QLsIjcDybPyMh2DU1BvKIqEkX030mFhBWRmK537uHQNxcm93lvdLqeHriwgUyXXTxSNtBs= eve@linux-1"; ## SECRET-DATA
ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDxy4VJXTkFnp/oxaO6lZhohocz8a8Awmdx0Z+utUDNktVqzcicB5NsLymFovMF9hclnrMycxFATpR8KCKZ/DomJiV+0+tZFm0l1HeFoiB93aIL9VIaMwM04FPRJl2xjUDxBN1RIOxzjY7Fs3YVUKXCbsvWuYBKGpjz9o7TXFShB4x0pZt4Ij1xE0GcWRHoYMheu5v0bikqO622nelVWtCnwn2RgWnmmdysguoVcIzrPqJFJSo0X5LmOj9M0onA5tPg7DAcbh33Sd//pN82mczEIA4fl6PmV5RLlDKbkgnlrKP5+qElgbUoV7vVumsSRevarhiXZvL1MrrG/TiuKy2EfOClXzvXM5vhlXdmwzf4EX+6TJf+VVpSpa+S4Ntot9P/GBlDesv+rwW23gGRwr5tiDtpmPF144USz+zgUBk8C7c8jja6VONweDbN+/lAzIMyoXkN4cFA6aE6jMtRx6GRyhMiXrOLk549lj6WlfU/sEm+GXlccng0jhFdOKqqoZE= eve@linux-1"; ## SECRET-DATA
}
[edit]
lab@vMX-1#Notice how there are now two ssh-rsa entries under authentication for user5. Let’s use this new key pair to log in to the router. We need to use -i to specify the identity or key file that we want to use, and also supply the passphrase for that key.
eve@linux-1:~$ ssh -i ./new-user5-key [email protected]
Enter passphrase for key './new-user5-key':
Last login: Fri Dec 29 12:56:00 2023 from 192.168.20.5
--- JUNOS 20.4R3-S2.6 Kernel 64-bit JNPR-11.0-20211117.c779bdc_buil
user5@vMX-1>Adding An SSH Key For The Root User
Again, let’s make another keypair, this time called new-root-key and with a blank passphrase.
eve@linux-1:~$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/eve/.ssh/id_rsa): new-root-key
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in new-root-key
Your public key has been saved in new-root-key.pub
The key fingerprint is:
SHA256:CO5cMoOoPap8n6WU+pJ2e3ZrLaJeaJcA+Qa61ieU9Es eve@linux-1
The key's randomart image is:
+---[RSA 3072]----+
| |
| . |
| =. |
| .oo*. . |
|...o=Eo S |
|..+oo== . |
|.ooo+B = . |
|o. **.*+ + . |
|+.o.*O= +.o |
+----[SHA256]-----+
eve@linux-1:~$ ls
backup config-backup2.conf new-root-key new-user5-key tmp
config-backup1.conf config-backup3.conf new-root-key.pub new-user5-key.pub
eve@linux-1:~$When adding the public key, this time it is added under system root-authentication. Once added it should look similar to this:
[edit]
lab@vMX-1# show system root-authentication
encrypted-password "REMOVED"; ## SECRET-DATA
ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCpF2EsVagSPMpXG6sjY6L9UmeaZltlD8TOIgnJ/hzOiaUrHacaKmViawtUV1MXsD6Da9bBahfMLFcUz7IJjSR0LD/W6CMqqs760hi3f7JZ4a/JDJILW8uoAy02+MvvvMsvFmjIDyZ7GNYMTvGeqx30s0WP8PO+7tQoSOx0hF8j+/0S6MXdLYjSzK7giV5bwtISl8D7BY0xyHyxi9c1TFYaawDUWaJndnKdwhFY/djpmRtEI1uabuJU64OPJKfQR97rQluuAvCkjGicxRT1+YhoO868W5wUyAhyRaAPLQndVL07VHCwv4VBwJr739vvFitv4mg8q/csK/oXxqx0HZQktojBO0oW8dxdhcRiOaKDPk1EFxD8sJqTf6qiD81vgt5bt/mlQpt4qilMa5AfIELayt6UfewylzFmgCmnzQWa5or1Rb1iJwBWUSqZ/nHv6Sg/fdlQW5mj5LtSvHWCS7IWb1ZEsCBNxRRrakZZg+NtlF1mwfHxeVH6+eMe1S8JQKs= eve@linux-1"; ## SECRET-DATA
[edit]
lab@vMX-1#This results in the following from the Linux host:
eve@linux-1:~$ ssh -i ./new-root-key [email protected]
Last login: Fri Dec 29 13:14:48 2023 from 192.168.20.5
--- JUNOS 20.4R3-S2.6 Kernel 64-bit JNPR-11.0-20211117.c779bdc_buil
root@vMX-1:~ #When using SSH keys to log in to the root account, the behavior will depend on whether root logins over SSH have been enabled.
Using SSH Keys And RADIUS Authentication
From a very quick test, it appears that when using SSH keys and RADIUS authentication, the SSH keys take precedence.
A locally defined user account using SSH keys will log in using just key-based authentication.
A locally defined user not using SSH keys will log in using a password, and that will be validated against RADIUS. The exact behavior will depend upon the authentication order that has been set.
A non-locally defined will only be able to log in using their RADIUS account, as the use of keys requires the public key to be defined for the user locally.
Are SSH Keys Widely Used In Production Networks To Log In To Network Devices
In my experience, the answer is no. That doesn’t mean this method isn’t used, just that it is rare. Instead, a centralized authentication system such as RADIUS or TACACS is used.
If you think about the use of keys, it requires all users to be locally defined on the device so the public key can be specified. When working on a network of any real size, where there could be hundreds of devices, and hundreds of users needing accounts, key management would quickly become a problem. Keys would need updating as staff join and leave, or as devices are added and decommissioned from the network.
The key management problem could be solved with automation, but why do that when centralized authentication methods are already available and widely in use?
That said, there may be situations when you need to manage a device over an untrusted network, where SSH keys can provide additional security. For a small number of devices with a limited number of user accounts, this should work well.