Security

We'd like to setup SSH key authentication for multiple admins, while retaining password auth for the 'manager' and 'operator' accounts.

Has anyone got this working?

The only way to specify keys seems to relate to the 'manager' or 'operator' accounts?

ip ssh public-key manager username <username> <key>

We've got multiple admins working with password auth as follows:

aaa authentication local-user "user1" group "Level-15" password sha1 <hash>

aaa authentication local-user "user2" group "Level-15" password sha1 <hash>

password operator user-name "readonly" sha1 <hash>

password manager user-name "readwrite" sha1 <hash>

Hi Chris, did you work out a resolution for this, I want to do the same thing!

Hi Rafter,

No sadly we didn't get this working - still not sure it is actually possible.

I recently set up SSH key auth across all of our HP/Aruba gear in our environment. To my knowledge, it is not possible to set up individual user names on Procurve/ArubaOS devices. You can change the username for the operator and manager accounts, but you can't set up multiple operator/manager accounts with different usernames. However, you can set it up so that you have multiple RSA keys associated with the operator and manager accounts, so your users would be able to log in using the same username but with their specific key. ArubaOS-CX does support individual users with SSH keys, however. HTH.

Hi guys, thanks for feeding back.

I've had further look into it.  I've worked out the way of importing the SSH public keys (restricted to 10) and login with those for different users:

Create the extra user(s) as normal,set password, I've used Level-15 for full access but Level-1 if just want operator access - group not relevent if importing keys to use at manager level:

  aaa authentication local-user "$username$" group "Level-15" password plaintext

Then copy the SSH public keys to the public keys store - note the append (that will enable importing and storing more than 1 key - appeas to be a 10 maximum) and the manager access level (operator also available then you could use "enable" for higher priviledges if needed - which would match the above role group set on the user).

  copy tftp pub-key-file $tftp-server-ip$ $key-file-name$ manager username $username$ append

Set SSH authentication to use public-key (can set failback here and two factor although I've not)

  aaa authentication ssh login public-key

Thats it.

Other helpful commands:

show crypto client-public-key (show what keys been imported)

clear crypto client-public-key (deletes whats been imported)

Hope thats helpful.