When setting up an sshd daemon and generating a host key with ssh-keygen -A what options are best practice to add?
How do I remove keys which may have already been auto-generated with sub-optimal options?
-
why do you think they were generated with sub-optimal options? – Jakuje Dec 8 '16 at 9:40
-
1This site has a very detailed, thorough explaination of configuring OpenSSH clients and server daemons with optimal keys. Your current keys are stored in '~/.ssh/'. The default keys are usually named 'id_rsa' and 'id_rsa.pub'. The public keys allowed to access the server is stored in each users '~/.ssh/authorized_keys' files. stribika.github.io/2015/01/04/secure-secure-shell.html – aidanh010 Dec 8 '16 at 16:56
-
@Jakuje If best practice says to create keys with non-standard options, I want to know how to remove any that may have already been generated (I'm setting up a sshd server now). – Tom Hale Dec 10 '16 at 4:03
You can safely remove the keys stored in /etc/ssh, generate new keys and restart sshd. There is nothing more to it than that.
But please note that every client that have the old key stored in their known_hosts file will complain. You will need to remove that record from your clients. This can be done using ssh-keygen -R <hostname>
