Creating a new SSH key

Description:

Access points or routers based on LCOS can be remotely managed by means of another LCOS device, which sets up an SSH session. If the SSH keys stored in the devices are of different lengths or if the encryption and signature algorithms differ, no SSH session can be established. In this case, a new SSH key must be created and imported to one of the two devices.

As of LCOS 10.20, the minimum key length (Min-Hostkey-Length) has been increased to 2048 bits and outdated encryption and signature algorithms are no longer available by default.

This document describes how to create a new SSH key, either in the device itself or with the tool PuTTYgen, and upload it to the device.

Requirements:

• PuTTYgen to create a new SSH key
• Any SSH client, e.g. PuTTY

Procedure:

1) Check the encryption settings on both devices:

1.1) From the command line, connect to the first device (in this case a 1781VA) and check the encryption settings by entering the command ls /Setup/Config/SSH.

The encryption settings on this device are still at the level up until LCOS 10.12 and are thus no longer up to date.

An image displaying a configuration menu for network security settings including options for SSH server configurations like port settings, authentication methods, cipher algorithms, MAC algorithms, key exchange protocols, Diffie-Hellman groups, host key algorithms, elliptic curves, key length, compression settings, and keepalive intervals.

1.2) Connect to the second device (in this case an L-822acn) via the command line and check the encryption settings by entering the command ls /Setup/Config/SSH.

The encryption settings on this device are up to date as of LCOS 10.20.

A screenshot of a technical configuration interface displaying various settings including authentication methods, cipher algorithms, compression settings, and more for network or server setup.

2) Changing the encryption settings on one of the two devices:

 The encryption settings should be changed on the device with the older settings (in this case the 1781VA). All you actually need to do is to set a matching minimum key length (Min-Hostkey-Length). If the encryption and signature algorithms added in LCOS 10.20 are supported, we recommended that you set these too.

2.1) If the device has firmware version 10.20 and higher:  

2.1.1) Enter the command cd Setup/Config/SSH/ to go to the menu path for configuring the SSH encryption settings.

2.1.2) Enter the command default-r to reset the directory and all of its subdirectories to their factory settings.

Important:

Make sure you are in the correct directory when you run the command default-r. If this command is executed in the root directory, the entire configuration is reset to the factory settings!

Image displaying a technical configuration screen for SSH protocol settings, showing various options including cipher algorithms, MAC algorithms, key exchange algorithms, and host key settings.

2.2) If the device has firmware version up to 10.12:

2.2.1) Set the minimum key length to 2048 bits by entering the command Set Setup/Config/SSH/Min-Hostkey-Length 2048.

Image displaying a technical configuration menu for SSH settings, including parameters like Port, Authentication Methods, Cipher Algorithms, MAC Algorithms, Key Exchange Algorithms, and more, with various specifications and values listed.

3) Generating and importing a new SSH key:

  3.1) Generating a new SSH key on the command line:

3.1.1) Enter the command sshkeygen -b 2048 to create a 2048-bit SSH key.

If a message appears indicating that a key already exists, confirm the message with yes.

Info:
Unless further parameters are specified, an RSA key will be generated by default.

Important:
Generating of a new SSH key causes a high CPU load.

A screenshot of a security configuration interface displaying a message about an existing SSH key with an option to overwrite.

3.1.2) Enter the command sshkeygen -f ssh_rsakey to import the SSH key created in step 3.1.1 into the RSA container.

Image displaying a command line interface where an RSA key generation process is taking place with a prompt asking whether to overwrite an existing key.

3.2) Generating a new SSH key with the tool PuTTYgen:

3.2.1) Start the tool PuTTYgen and set the type of key to generate and the key length (number of bits in a generated key).

Clicking on Generate then creates a new SSH key.

Info:
LCOS only supports the key types RSA, DSA and ECDSA, where RSA the most widespread.

Important:
The key length must match the Min-Hostkey-Length (see steps 2.1 and 2.2).

Screenshot of the PuTTY Key Generator interface showing options for generating, loading, and saving key pairs, with settings for key type and bit number.

3.2.2) Enter a password under Key passphrase and Confirm passphrase to secure the SSH key.

Screenshot of the IEPPuTTYKey Generator interface displaying options for key generation, key loading, and key saving, along with parameters for type of key and bit number.

3.2.3) Export the SSH key by clicking on Conversions -> Export OpenSSH key.

Image of a user interface from the PuTTY Key Generator software showing options to generate a public-private key pair, load an existing key, and save keys, with additional settings for key type and bit number.

3.2.4) Open LANconfig and right-click on the device to which you want to upload the SSH key.

In the context menu, click on Configuration management -> Upload certificate or file.

Screenshot of a technical user interface showing options such as Name, Comment, Cluster Name, Address Location, Device Status, Progress, and Device Type in a configuration or monitoring application.

3.2.5) Enter the following parameters:

• File name: Select the SSH key exported in step 3.2.3.
• Certificate type: From the drop-down menu, select SSH - RSA key (*.key [BASE64 unencrypted]).
• password: Enter the password set in step 3.2.2.

Info:
If you set a different certificate type to RSA in step 3.2.1, you must now select the appropriate option for certificate type from the drop-down menu.

An image displaying a technical configuration interface with options related to SSH keys and certificate restoration, featuring partially obscured or incomplete text descriptions.