9

Is there a technical reason why IOS requires the device's domain-name to be set (via ip domain-name) before an SSH key can be generated? Is the domain-name used in any way in the generation of the key?

Is there any way to force the generation of a key before the domain name is set?

UPDATE: Myself (before I posted this question) and others in your answer seem to think it may be used as either a salt or a source of entropy for the key. Wouldn't the domain-name be very predictable? This doesn't seem like a suitable source of entropy.

Improve this question

3 Answers 3

Reset to default
9

You do not need to set "ip domain-name" or "hostname" before creating a key. They are required if you don't name it yourself. Use the following command to name it yourself:

 crypto key generate rsa general-keys label MYKEYNAME

More info here:

http://cisco-network.com/hands-on/advanced-ssh-settings-for-cisco-ios/

Improve this answer
2

Sorry Julian but Joseph is right

Before issuing this command, ensure your router has a host name and IP domain name configured (with the hostname and ip domain-name commands). You will be unable to complete the crypto key generate rsa command without a host name and IP domain name. (This is not true only when you generate a named-key-pair.)

source: http://www.cisco.com/en/US/docs/ios/12_2t/12_2t8/feature/guide/ftmltkey.html under the command reference section

Improve this answer
0

It almost certainly uses the domain name as a salt in the key.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .