use keys, not passwords

it’s subject old as world (password-protected world, that is). i had to do some of cleanup on my devices and i hit a problem with 4096 bit keys.

so, just as a reference that may be helpful somewhere for someone - you import keys to Cisco IOS without any special problems:

router#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
router(config)#ip ssh pubkey-chain
router(conf-ssh-pubkey)#username TEST
router(conf-ssh-pubkey-user)#key-string
router(conf-ssh-pubkey-data)#AAAAB3NzaC1yc2EAAAADAQABAAACAQDCiLBaopUwsFb9YJNhGqVYqBajlrH
S/zwD6/yR6N8VcRzrpqMMNCFXe1q5GMGM[...]ANWInd9GHBjTzbJWVwavxy1ooQewii8ErofZuv1l/SXSdXLzfL
p0zMoZ0L+BNPS0j4XBS0N3t8Vl8oVixqIeG2BNTCNaDDt6hx2Q== lukasz@bromirski.net
router(conf-ssh-pubkey-user)#exit
router(conf-ssh-pubkey)#exit

for Cisco ASA, keys that are longer than 2048 bits need to be prepared using pkf format, as command line has limit of 512 bytes. so, to move key in OpenSSH compliant format like this one:

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACA[...]hx2Q== lukasz@bromirski.net

to new one, you need to convert it, by simply typing:

z3us:~/.ssh$ ssh-keygen -e -f id_rsa.pub
---- BEGIN SSH2 PUBLIC KEY ----
Comment: "4096-bit RSA, converted by z3us.local from OpenSSH"
AAAAB3NzaC1yc2EAAAADAQABAAACAQDCiLBaopUwsFb9YJNhGqVYqBajlrHwm95N1Fyc4K
vq4e720TmFhC65XQO4S/zwD6/yR6lele[...]TRpY01mqQ9MhEHDd9ANWInd93Kih3bZrk
3qpiNY1ooQewii8ErofZuv1l/SXSdXLzfLp0zMoZ0L+BNPS0j4XBS0N3t8Vl8oVixqIeG2
/spOwpAfKnhx2Q==
---- END SSH2 PUBLIC KEY ----

now this can be imported to Cisco ASA:

asa-fw(config)#username TEST attributes
asa-fw(config-username)#ssh authentication pkf

Enter an SSH public key formatted file.
End with the word "quit" on a line by itself:
---- BEGIN SSH2 PUBLIC KEY ----
Comment: "4096-bit RSA, converted by z3us.local from OpenSSH"
AAAAB3NzaC1yc2EAAAADAQABAAACAQDCiLBaopUwsFb9YJNhGqVYqBajlrHwm95N1Fyc4K
vq4e720TmFhC65XQO4S/zwD6/yR6lele[...]TRpY01mqQ9MhEHDd9ANWInd93Kih3bZrk
3qpiNY1ooQewii8ErofZuv1l/SXSdXLzfLp0zMoZ0L+BNPS0j4XBS0N3t8Vl8oVixqIeG2
/spOwpAfKnhx2Q==
---- END SSH2 PUBLIC KEY ----
quit
INFO: Import of an SSH public key formatted file completed successfully.
asa-fw(config-username)#

and you should be happy :)