This article describes how to generate SSH keys on a device running Junos OS, and to configure the device to use a password-less, public-key-based encrypted SSH authentication (SSH RSA keys).

I want to generate SSH RSA keys locally to allow remote login instead of using passwords that are stored locally.

To generate SSH RSA keys on a device that is running Junos OS, perform the following:

1. Enable SSH service on the switch by using the following command:

root@Juniper# set system services ssh

2. Generate the SSH key on the device that is running Junos OS by logging in to the shell prompt as the root user:

root@Juniper>start shell
root@Juniper% ssh-keygen -t rsa

Generating public/private rsa key pair.

Enter file in which to save the key (/root/.ssh/id_rsa):
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:

Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub. 

The SSH RSA key fingerprint is:

91:6e:b9:52:fd:14:85:1e:8c:40:9a:7c:2d:c7:d4:0d root@SW_Jaffa_Monitor_104 

3. When the SSH RSA keys are generated, you can associate the key with the "userid" by using the following command:

root@Juniper#set system login user  <userid>  uid 2000
root@Juniper#set system login user  <userid>  class super-user
root@Juniper#set system login user  <userid>  authentication load-key-file /root/.ssh/id_rsa.pub 

After running the above configuration commands, a directory with <userid> will be created in /var/home and the authorized_key for SSH will be created.

When an upgrade or a downgrade is performed, the files "id_rsa.pub," which are locally created and are not part of the configuration, will not be restored. Hence, you will have to copy the contents of the /root/.ssh directory and put them back after the upgrade/downgrade is complete. You must also associate the user with the SSH RSA key by using the following CLI command:

root@Juniper#set system login user  <userid>  authentication load-key-file /root/.ssh/id_rsa.pub

Example

The below is an example that will make what was said earlier easier to follow. 

1. There are two keys involved: 

• • public key ~homedir/.ssh/ id_rsa.pub 

  • private key ~homedir/.ssh/.ssh/id_rsa
    

The private key is where you are logging in from.

The public key is found on the system that you are logging in to.

2. Assuming that you have created the SSH RSA key on the system that you are logging in from via ssh-keygen,copying to the target system is easy:  

ssh-copy-id -i .ssh/id_rsa.pub [email protected]

The first time you will be prompted for your password. After logging out, you will not be prompted again unless the keys do not match or change. 

2021-03-26 Removing references of "DSA" since the "DSA" key type has been deprecated.

2022-08-16: Article checked for accuracy; article found valid and relevant

2026-02-11: Minor, non-technical changes made for search optimization

2026-04-28: The changes are as follows.

Before:
- private key ~homedir/.ssh/authorized_keys
The public key is where you are logging in from.
The private key is found on the system that you are logging in to

After:
- private key ~homedir/.ssh/id_rsa
The private key is where you are logging in from.
The public key is found on the system that you are logging in to