如何更改SSH主机密钥?

我克隆了一台服务器,所以他们有相同的RSA密钥指纹。

它似乎是在/etc/ssh/ssh_host_rsa_key.pub定义的。

什么是正确的方式来改变呢?

谢谢。

按照以下步骤重新生成OpenSSH主机密钥

  1. 删除旧的SSH主机密钥: rm /etc/ssh/ssh_host_*
  2. 重新configurationOpenSSH服务器: dpkg-reconfigure openssh-server
  3. 更新所有ssh客户端~/.ssh/known_hosts文件

参考

或者,删除键和

 ssh-keygen -A 

说明:

-A :对于不存在主机密钥的每种密钥types(rsa1,rsa,dsa,ecdsa和ed25519),使用默认密钥文件path,空密码短语,密钥types的默认位生成主机密钥,和默认评论。 这由/ etc / rc用来生成新的主机密钥。

对于这样做的通用方法:

ssh-keygen -q -N "" -t dsa -f /etc/ssh/ssh_host_dsa_key

ssh-keygen -q -N "" -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key

ssh-keygen -q -N "" -t ecdsa -f /etc/ssh/ssh_host_ecdsa_key

根据你的OpenSSH版本支持的密钥进行混合和匹配。

删除它们并重新启动SSHd服务。 它们将被再生。

脚本(如果重新启动sshd守护程序不会自动重新生成密钥)

 #!/bin/bash # Regenerate SSHD key materials, restart sshd if "-r" passed on command line set -o nounset WHERE=/etc/ssh # go to directory pushd $WHERE >/dev/null if [[ $? != 0 ]]; then echo "Could not cd to $WHERE -- exiting" >&2 exit 1 fi # create backup folder NOW=`date '+%Y%m%d.%H%M%S'` # default NOW string BAKDIR=bak_$NOW mkdir $BAKDIR if [[ $? != 0 ]]; then echo "Could not mkdir $BAKDIR -- exiting" >&2 exit 1 fi # move existing key material to backup folder mv ssh_host_* $BAKDIR if [[ $? != 0 ]]; then echo "Could not move old files to $BAKDIR -- exiting" >&2 exit 1 fi # generate new keys ssh-keygen -A if [[ $? != 0 ]]; then echo "Could not recreate keys -- exiting" >&2 exit 1 fi # ssh-keygen may create DSA keys but: # "Never use DSA or ECDSA" # http://security.stackexchange.com/questions/5096/rsa-vs-dsa-for-ssh-authentication-keys /bin/rm -f *_dsa_key *_dsa_key.pub /bin/rm -f *_ecdsa_key *_ecdsa_key.pub # on Fedora, one has to tune permissions a bit chmod 640 *_key chgrp ssh_keys *_key # make sure SELinux attributes are as they should be restorecon -R $WHERE # Done echo "New key material" ls -l *_key *_key.pub # Do the risky thing if [[ $1 == '-r' ]]; then echo "Restarting SSH daemon" systemctl restart sshd fi # go back to where you where popd >/dev/null