The procedures in this topic describe how to use CLI commands to enable host-key checking. You can enable strict host-key checking, global host-key checking, or both.
Strict host-key checking
If you enable strict host-key checking on a Central Management System appliance, the connection will be allowed only if the local host-keys database for the Central Management System appliance remote user already has an entry that matches the key the managed appliance sends.
If you enable strict host-key checking on a managed appliance, the connection will be allowed only if the local host-keys database for the managed appliance remote user already has an entry that matches the key the Central Management System appliance sends.
Global host-key checking
If you enable global host-key checking on a Central Management System appliance, the connection will be allowed only if the managed appliance global host-keys database already has an entry that matches the key the Central Management System appliance sends.
If you enable global host-key checking on a managed appliance, the connection will be allowed only if the Central Management System appliance global host-keys database already has an entry that matches the key the managed appliance sends.
Enabling strict host-key checking
You can use these commands on a Central Management System appliance or on a managed appliance.
To enable strict host-key checking:
Log in to the appliance CLI.
Go to CLI configuration mode:
hostname > enable hostname # configure terminalEnable strict host-key checking:
hostname (config) # cmc auth ssh host-key strictVerify your changes:
hostname (config) # show cmc auth sshSave your changes:
hostname (config) # write memory
Enabling global host-key checking
You can use these commands on a Central Management System appliance or on a managed appliance.
Caution
When you enable global host-key authentication, any established connections will be broken until you explicitly add the host key to the global host-keys database.
To enable global host-key checking:
Log in to the appliance CLI.
Go to CLI configuration mode:
hostname > enable hostname # configure terminalEnable global host-key checking:
hostname (config) # cmc auth ssh host-key global-onlyAny established connections are broken
Verify your changes:
hostname (config) # show cmc auth sshSave your changes:
hostname (config) # write memoryTo add the host-key to the global database, follow the instructions at Importing a host key into the CM Series global host-keys database using the CLI or, for a Central Management System appliance, Importing a host key into the global host-keys database using the CM Series Web UI.
Disabling strict or global host-key checking
You can use these commands on a Central Management System appliance or on a managed appliance.
To disable strict or global host-key authentication:
Log in to the managed appliance CLI.
Go to CLI configuration mode:
hostname > enable hostname # configure terminalPerform the following steps as needed.
To disable strict host-key checking:
hostname (config) # no cmc auth ssh host-key strictTo disable global host-key checking:
hostname (config) # no cmc auth ssh host-key global
Verify your changes:
hostname (config) # show cmc auth sshSave your changes:
hostname (config) # write memory
Example
This example enforces both strict and global host-key checking on a Central Management System appliance or a managed appliance.
hostname (config) # cmc auth ssh host-key strict
hostname (config) # cmc auth ssh host-key global-only
hostname (config) # show cmc auth ssh
CMC SSH configuration:
Strict host key checking enabled: yes
Global only known hosts enabled: yes
Minimum protocol version: 2
Cipher list: compatible
Minimum key length: 1024 bits