Importing a host key into the Central Management System global host-keys database using the CLI

Use the commands in this section to import the host key from an appliance into the Central Management System appliance global host-keys database. This procedure is required for global host-key authentication, in which the connection will be allowed only if the host key the appliance sends is already in this database.

Caution

If you choose to use global host-key authentication, you must explicitly enable the feature in addition to importing the host key. For details, see Enabling strict and global host-key checking using the CLI.

Important

Before you perform this procedure, you must obtain the host key from the managed appliance. You can obtain this key from the appliance Web UI or CLI. For details, see Obtaining a host key using the Web UI, Obtaining a managed appliance host key using the CLI, or Obtaining the host key of the CM Series appliance using the CLI.

The host-key string may need to be modified in a Network Address Translation (NAT) deployment. For details, see Global host-key authentication on a CM Series Appliance in a NAT deployment and Global host-key authentication on a managed appliance in a NAT deployment.

Note

See the ssh commands in the CLI Reference for advanced authentication options.

To import a host key:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

Import the key into the global host-keys database:
```
hostname (config) # ssh client global known-host "<keyString>"
```
Important
The key must start with the managed appliance IP address, and it must be enclosed in double quotation marks. If the key starts with the hostname, replace the hostname with the IP address.
Verify your change:
```
hostname (config) # show ssh client
```
Save your changes:
```
hostname (config) # write memory
```

To remove a host key:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

Remove the key:

hostname (config) # no ssh client global known-host "<keyString>"

Verify your change:
```
hostname (config) # show ssh client
```
Save your changes:
```
hostname (config) # write memory
```

Caution

If you delete a host key that is in use, the connection between the Central Management System appliance and the managed appliance is broken.

Example

This example imports the host key from a managed appliance into the Central Management System platform global host-key database.

hostname (config) # ssh client global known-host "172.17.74.54 ssh-rsa AAAAB3
NAfgbzYulDSIxOKZTh2VBnKsy0qRWrCps64Itlh6iRlr7JxazaC1yc2EAAAADAQABAAABAQCzd5Jw
Ktk5BjHLe/jxkF0JzWcXOTw9l0bz2SctkQrihkqg/zXqrmxtE6Z2f2oxUobcax+eqS6QMp5nnbPTD
LJTbHCNnjkawdDC6IhLk0BdncChpTS9E+ZF/F67YwpuIpgraWrchTCwfG+jAtTAGsygD0VVrchTCc
ncChpTS9E+ZF/F67YwpuIpgraWcoXuZxZKy13wfsJDhMfWk/nrEqicQ4BJN4M/8AzP+fd9sda3li"
hostname (config) # show ssh client
SSH client Strict Hostkey Checking: ask
Minimum protocol version: 2
Cipher list: compatible
Minimum key length: 1024 bits

SSH Global Known Hosts:
    Entry 1:
          Host:              172.17.74.54
          Finger Print:      54:fa:10:2a:f4:c2:cf:3a:46:b1:a4:ed:72:78:b8:22
          Key Length (bits): 2048
...