Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a technical reason why IOS requires the device's domain-name to be set (via ip domain-name) before an SSH key can be generated? Is the domain-name used in any way in the generation of the key?

Is there any way to force the generation of a key before the domain name is set?

UPDATE: Myself (before I posted this question) and others in your answer seem to think it may be used as either a salt or a source of entropy for the key. Wouldn't the domain-name be very predictable? This doesn't seem like a suitable source of entropy.

share|improve this question
add comment

migrated from stackoverflow.com Aug 7 '11 at 21:43

This question came from our site for professional and enthusiast programmers.

3 Answers

up vote 8 down vote accepted

You do not need to set "ip domain-name" or "hostname" before creating a key. They are required if you don't name it yourself. Use the following command to name it yourself:

 crypto key generate rsa general-keys label MYKEYNAME

More info here:

http://cisco-network.com/hands-on/advanced-ssh-settings-for-cisco-ios/

share|improve this answer
add comment

Sorry Julian but Joseph is right

Before issuing this command, ensure your router has a host name and IP domain name configured (with the hostname and ip domain-name commands). You will be unable to complete the crypto key generate rsa command without a host name and IP domain name. (This is not true only when you generate a named-key-pair.)

source: http://www.cisco.com/en/US/docs/ios/12_2t/12_2t8/feature/guide/ftmltkey.html under the command reference section

share|improve this answer
add comment

It almost certainly uses the domain name as a salt in the key.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.