Re: keying a fresh sshd

That is kinda what I am looking for, just a little less hackish and bit more... 
defined?  for instance, I don't want to replace the new .conf file.  and in 
general, I want to understand what I am doing in a bit more detail.

It is probably as simple as one file.  another thing I took a quick crack at and 
failed, which made me realize I didn't really know what each of the key files did.

Jackson, David M (GE Infra, Energy) wrote:
> You could try and restore the original directory over the new install.
> 
> -----Original Message-----
> From: [email protected] [mailto:[email protected]] On Behalf Of Carl
> Karsten
> Sent: Wednesday, October 11, 2006 4:21 PM
> To: [email protected]
> Subject: Re: keying a fresh sshd
> 
> 
> 
> Chris Rapier wrote:
>> You could do make install-nokeys on your linux box.
> 
> um... huh?  i have 2 linux boxes:
> 
> BoxA is my main box that I use for day to day work.  I run ssh on it to
> connect to BoxB (and other boxes)
> 
> BoxB is the test box that gets wiped every few days.
> 
>> This will maintain your current set of keys. If part of your test is 
>> to actually test the keygen and installation then you want to look at 
>> the CheckHostIP ssh client option. Try setting it to 'no'. I wouldn't 
>> set it that way in the config file though.
> 
> I would rather not dumb down BoxA (my normal box) or BoxA' (my laptop) -
> I also connect to real remote boxes (over the Net) so checking keys
> seems like a good idea.  If I could turn it off for a particular host,
> that would be fine, but I 
> don't think that is an option.   Unless... is there a ssh command line
> switch? 
> I looked at man ssh when this first started bugging me and couldn't find
> anything that helped.
> 
> Looking for just something I can do to BoxB.  I have a post install
> script that runs, which can wget files from a local web server.  my
> thought is to put a set of key files on there and just whack the ones
> that the "apt-get install openssh-server" generate.
> 
>>
>> Carl Karsten wrote:
>>> I have an automated Ubuntu install that I run on a test box every few
> 
>>> days.  it also installs openssh-server (sshd) and that creates new 
>>> keys, which conflict with the keys stored on my client machines.  I 
>>> keep editing my client files to get around this, but that is getting 
>>> old.  What would be a recommended way to deal with this?  I also 
>>> wouldn't mind dropping a private key on it.  I have 0.0 concern for 
>>> security of that box - it is only on about 1/4 the time, and I am the
> 
>>> only one with any sort of access to it.  But I do have visitors to my
> 
>>> lan, and in general like to practice safe computing, and figure if I 
>>> am going to put any effort into this I should learn something 
>>> useful.   below is the error I get when I try to connect an "old" 
>>> client to a "new" install.
>>>
>>> Carl K
>>>
>>>
>>>
>>> carl@amd15:~$ ssh yate2
>>> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
>>> @       WARNING: POSSIBLE DNS SPOOFING DETECTED!          @
>>> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
>>> The RSA host key for yate2 has changed,
>>> and the key for the according IP address 192.168.1.18
>>> has a different value. This could either mean that
>>> DNS SPOOFING is happening or the IP address for the host
>>> and its host key have changed at the same time.
>>> Offending key for IP in /home/carl/.ssh/known_hosts:27
>>> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
>>> @    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
>>> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
>>> IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
>>> Someone could be eavesdropping on you right now (man-in-the-middle 
>>> attack)!
>>> It is also possible that the RSA host key has just been changed.
>>> The fingerprint for the RSA key sent by the remote host is
>>> 4b:9a:7d:6b:a5:bd:1f:7f:30:a5:b6:10:d7:7a:f6:29.
>>> Please contact your system administrator.
>>> Add correct host key in /home/carl/.ssh/known_hosts to get rid of
> this 
>>> message.
>>> Offending key in /home/carl/.ssh/known_hosts:29
>>> RSA host key for yate2 has changed and you have requested strict 
>>> checking.
>>> Host key verification failed.
>>>
>>> -- 
>>> List Info:      http://erdelynet.com/ssh-l/
>>> List Archives:  http://erdelynet.com/archive/ssh-l/
>>> To Unsubscribe: Mail mailto:[email protected]
>>>
>> -- 
>> List Info:      http://erdelynet.com/ssh-l/
>> List Archives:  http://erdelynet.com/archive/ssh-l/
>> To Unsubscribe: Mail mailto:[email protected]
>>
>>
>>
> 
> --
> List Info:      http://erdelynet.com/ssh-l/
> List Archives:  http://erdelynet.com/archive/ssh-l/
> To Unsubscribe: Mail mailto:[email protected]
> 
> 
> 
> 
> --
> List Info:      http://erdelynet.com/ssh-l/
> List Archives:  http://erdelynet.com/archive/ssh-l/
> To Unsubscribe: Mail mailto:[email protected]
> 
> 
> 

--
List Info:      http://erdelynet.com/ssh-l/
List Archives:  http://erdelynet.com/archive/ssh-l/
To Unsubscribe: Mail mailto:[email protected]