Hacker News Reader

I have no idea what's going on in the footnote, but deploying SSH keys on Cisco equipment is like 3 commands (conf t, user x, ssh something something) to deploy public keys, not hard at all.

View on HN

It's been a few years, but this requires manually deploying keys and adding/removing users on all your devices. Most use TACACS+ and/or Radius to centrally manage users, which don't support keys in that way (or at least didn't the last time I worked with them.)

There is an implementation with an extension: https://github.com/MarcJHuber/event-driven-servers/wiki/TACA.... But I don't know if there are any supported clients.

Another possibility would be to use CA certificates for authentication and only TACACS+ for authorization and accounting. Juniper now supports CA certificates. Cisco may in 10 years.

Not on IOS XR: https://vincent.bernat.ch/en/blog/2020-syncing-ssh-keys-iosx.... The commands you mention are for NXOS.

Reply on news.ycombinator.com