ssh - known_hosts handling 1

[TSch]

Hi folks,

I understand that whenever we connect to another machine using ssh the first time an entry is being created in the known_hosts file ...

Now the problem is that after certain changes in the ssh installation the entries won't work anymore so that we have to erase them and reconnect to the machine and manually confirm with "yes".

Having about 40 machines with several users using ssh connections on each machine this means an enormous effort to build up a new known_hosts file on every machine so that every user on every machine (and especially all the scripts we run under crontab as well !!!) will be able to connect to every other machine ...

Any suggestions how we could solve that problem ?

Regards
Thomas

 

[khalidaaa]

Well, as you said the users will have to confirm with "yes" each time they connect but going with this option will save you the time of going and recreating this known_hosts by yourself!

Have a look at this document for more info:

http://www.gsp.com/cgi-bin/man.cgi?section=8&topic=sshd#7

Regards,
Khalid

 

[khalidaaa]

I've never used this before but through my searching i found this => Try using the MAKE-SSH-KNOWN-HOSTS

http://www.employees.org/~satch/ssh/faq/manpages/make-ssh-known-hosts_man.html

Regards,
Khalid

 

[TSch]

The information of the first link brings me to an interesting thought:

Let's say I have to uninstall an old ssh version and want to do a completely new installation of a new ssh version. Is it possible to save the /etc/ssh/ssh_host_key.pub before and just restore it after the new installation or isn't that going to work ?

Regards
Thomas

 

[khalidaaa]

I had few annoying moments when i had to install from a mksysb! There was some conflict among the ssh keys! So I'm not sure if it would be straight forward for your case!

Regards,
Khalid

 

[ogniemi]

I guess when you uninstalling or upgrading openssh the existing host keys are not touched (ii "works" in that way with Darren Tucker's openssh distriutions for AIX:

http://dtucker.freeshell.org/openssh/).

Of course it is possible / you can save current host keys and restore them locally or copy them on any host you wish (eg. if you have clustered environent it is good idea to have the same host keys on all cluster nodes).

The host key pairs usually reside in openssh config directory and files are called "ssh_host_*" eg.:

-rw------- 1 root system 668 Mar 11 2003 ssh_host_dsa_key
-rw-r--r-- 1 root system 598 Mar 11 2003 ssh_host_dsa_key.pub
-rw------- 1 root system 523 Mar 11 2003 ssh_host_key
-rw-r--r-- 1 root system 327 Mar 11 2003 ssh_host_key.pub
-rw------- 1 root system 883 Mar 11 2003 ssh_host_rsa_key
-rw-r--r-- 1 root system 218 Mar 11 2003 ssh_host_rsa_key.pub


btw. regarding known host file. you as an administrator can maintain global known_host file which is called usually ssh_known_hosts and resides in openssh config directory (when a host key is found in that file, it will be used and not be added to the user's ~/.ssh/known_host).

when you set in ssh_config "StrictHostKeyChecking no", then new host keys will automatically be added to ~/.ssh/known_hosts - no prompt for confirmation.