RE: keying a fresh sshd
"Jackson, David M \(GE Infra, Energy\)" <[email protected]> Wed, 11 Oct 2006 16:24:25 -0400
| Newsgroups | gmane.network.ssh.windows |
|---|---|
| Message-ID | <72B5BC79ECF0CC4AAC902A96AB1B483C01B4B940@ALPMLVEM08.e2k.ad.ge.com> |
You could try and restore the original directory over the new install. -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Carl Karsten Sent: Wednesday, October 11, 2006 4:21 PM To: [email protected] Subject: Re: keying a fresh sshd Chris Rapier wrote: > You could do make install-nokeys on your linux box. um... huh? i have 2 linux boxes: BoxA is my main box that I use for day to day work. I run ssh on it to connect to BoxB (and other boxes) BoxB is the test box that gets wiped every few days. > This will maintain your current set of keys. If part of your test is > to actually test the keygen and installation then you want to look at > the CheckHostIP ssh client option. Try setting it to 'no'. I wouldn't > set it that way in the config file though. I would rather not dumb down BoxA (my normal box) or BoxA' (my laptop) - I also connect to real remote boxes (over the Net) so checking keys seems like a good idea. If I could turn it off for a particular host, that would be fine, but I don't think that is an option. Unless... is there a ssh command line switch? I looked at man ssh when this first started bugging me and couldn't find anything that helped. Looking for just something I can do to BoxB. I have a post install script that runs, which can wget files from a local web server. my thought is to put a set of key files on there and just whack the ones that the "apt-get install openssh-server" generate. > > > Carl Karsten wrote: >> I have an automated Ubuntu install that I run on a test box every few >> days. it also installs openssh-server (sshd) and that creates new >> keys, which conflict with the keys stored on my client machines. I >> keep editing my client files to get around this, but that is getting >> old. What would be a recommended way to deal with this? I also >> wouldn't mind dropping a private key on it. I have 0.0 concern for >> security of that box - it is only on about 1/4 the time, and I am the >> only one with any sort of access to it. But I do have visitors to my >> lan, and in general like to practice safe computing, and figure if I >> am going to put any effort into this I should learn something >> useful. below is the error I get when I try to connect an "old" >> client to a "new" install. >> >> Carl K >> >> >> >> carl@amd15:~$ ssh yate2 >> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ >> @ WARNING: POSSIBLE DNS SPOOFING DETECTED! @ >> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ >> The RSA host key for yate2 has changed, >> and the key for the according IP address 192.168.1.18 >> has a different value. This could either mean that >> DNS SPOOFING is happening or the IP address for the host >> and its host key have changed at the same time. >> Offending key for IP in /home/carl/.ssh/known_hosts:27 >> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ >> @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ >> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ >> IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! >> Someone could be eavesdropping on you right now (man-in-the-middle >> attack)! >> It is also possible that the RSA host key has just been changed. >> The fingerprint for the RSA key sent by the remote host is >> 4b:9a:7d:6b:a5:bd:1f:7f:30:a5:b6:10:d7:7a:f6:29. >> Please contact your system administrator. >> Add correct host key in /home/carl/.ssh/known_hosts to get rid of this >> message. >> Offending key in /home/carl/.ssh/known_hosts:29 >> RSA host key for yate2 has changed and you have requested strict >> checking. >> Host key verification failed. >> >> -- >> List Info: http://erdelynet.com/ssh-l/ >> List Archives: http://erdelynet.com/archive/ssh-l/ >> To Unsubscribe: Mail mailto:[email protected] >> > > -- > List Info: http://erdelynet.com/ssh-l/ > List Archives: http://erdelynet.com/archive/ssh-l/ > To Unsubscribe: Mail mailto:[email protected] > > > -- List Info: http://erdelynet.com/ssh-l/ List Archives: http://erdelynet.com/archive/ssh-l/ To Unsubscribe: Mail mailto:[email protected] -- List Info: http://erdelynet.com/ssh-l/ List Archives: http://erdelynet.com/archive/ssh-l/ To Unsubscribe: Mail mailto:[email protected]