Skip to main content
Information Security

Return to Answer

replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
Source Link
Community Bot
Community Bot
  • 1

Rekey is handled by configuration option RekeyLimit in both client and server config (even though a bit brokenbroken until openssh-7.2). If you set up low value it should rekey more often, but there is no point in doing that.

Rekey is handled by configuration option RekeyLimit in both client and server config (even though a bit broken until openssh-7.2). If you set up low value it should rekey more often, but there is no point in doing that.

Rekey is handled by configuration option RekeyLimit in both client and server config (even though a bit broken until openssh-7.2). If you set up low value it should rekey more often, but there is no point in doing that.

added 304 characters in body
Source Link
Jakuje
Jakuje
  • 6k
  • 1
  • 23
  • 34

As already pointed outRekey is handled by configuration option RekeyLimit in both client and server config (even though a bit broken until openssh-7.2). If you set up low value it should rekey more often, but there is no point in doing that.

By hand in session, you can trigger one, by escape sequence ~R. After that (in at least DEBUG log level or -v, you will see a lot of debug messages:

As already pointed out, by escape sequence ~R. After that (in at least DEBUG log level or -v, you will see a lot of debug messages:

Rekey is handled by configuration option RekeyLimit in both client and server config (even though a bit broken until openssh-7.2). If you set up low value it should rekey more often, but there is no point in doing that.

By hand in session, you can trigger one, by escape sequence ~R. After that (in at least DEBUG log level or -v, you will see a lot of debug messages:

Source Link
Jakuje
Jakuje
  • 6k
  • 1
  • 23
  • 34

How do I know when a rekey has happened? Should I check any logs, or any specific output? Running sshd in debug more (-d) does not show me anything related to rekeying.

It is printed only in debug mode, because it should not be a think you should care about. It should work out of the box as it is. But anyway, you can increase log level from your client using:

  • -vvv switch to your ssh command (DEBUG3)
  • LogLevel DEBUG3 config option in your ~/.ssh/config
  • ~v escape sequence during your session

How can I trigger a rekey?

As already pointed out, by escape sequence ~R. After that (in at least DEBUG log level or -v, you will see a lot of debug messages:

[root@f24 ~]# ~?
Supported escape sequences:
 ~.   - terminate connection (and any multiplexed sessions)
 ~B   - send a BREAK to the remote system
 ~C   - open a command line
 ~R   - request rekey
 ~V/v - decrease/increase verbosity (LogLevel)
 ~^Z  - suspend ssh
 ~#   - list forwarded connections
 ~&   - background ssh (when waiting for connections to terminate)
 ~?   - this message
 ~~   - send the escape character by typing it twice
(Note that escapes are only recognized immediately after newline.)

[root@f24 ~]# ~v [LogLevel VERBOSE]
~v [LogLevel DEBUG]
[root@f24 ~]# ~R
debug1: SSH2_MSG_KEXINIT sent
debug1: rekeying in progress
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: [email protected]
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: [email protected] need=64 dh_need=64
debug1: kex: [email protected] need=64 dh_need=64
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: rekeying in progress
debug1: rekeying in progress
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:E9HuzpVQJ/5DavNIZhWzJrADNj5Ntw69RJ1obXJtlGo
debug1: set_newkeys: rekeying, input 5156 bytes 167 blocks, output 5864 bytes 0 blocks
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: set_newkeys: rekeying, input 5168 bytes 0 blocks, output 5864 bytes 0 blocks
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS received