I'm new to SSH after a decade of dabbling with Ubuntu and other Linux builds. Today I successfully setup SSH, but I had a few hangups and headaches along the way. Although the system is now running properly, I'm not entirely sure how it's working, and that's driving me mad.
The main headache I was running into for awhile was this:
- I'd SSH into my Ubuntu machine via OS X and the "ssh" command. When I did that, I would get the warning that this was a new host I was connecting to, and I was given an RSA fingerprint.
- I'd then access my Ubuntu machine (via VNC) and run ssh-keygen -lf [public key], and the fingerprint was different.
- Frustration.
After poking around for awhile, I discovered the /etc/ssh/ssh_host_rsa_key.pub. Long story short, I checked the fingerprint, and voila, that's where OS X was getting the fingerprint. Inside of the same folder, I see what appears to be a matching private key (verified by checking fingerprint) Excellent.
So now my assumption is that these are pre-made default keys that you can use without having to generate your own keys or any of that. Because I have generated my own (password protected) keys, I wanted to replace them. So then I went into the SSHD_config file and changed the directory for the RSA key to my home directory (~/.ssh/[public key inside of authorized_keys file]). And then I deleted the ssh_host_rsa_key.pub. That didn't work. I rebuilt the host keys, undid the configuration change, left my generated public key in the home directory, and moved the generated private key to the client. The connection works great, and the fingerprint OS X (my client) prompts me with matches the ssh_host_rsa_key.pub.
Moreover, I know the security is working, because if I remove the authorized_keys file from my home/.ssh/, my client can no longer connect.
My questions:
If OS X, my client, is telling me that the fingerprint is that of the ssh_host_rsa_key.pub, why am I able to connect without a matching private key?
Put differently, what role does the ssh_host key play (without a matching private key being on the client), when I'm also needing the generated private and public key to be properly in place?
Is it accurate to say that ssh requires two public keys and one private key to connect properly? Or should I overwrite the contents of /etc/ssh/ssh_host_rsa_key.pub with the contents of my generated public key (which is also in authorized users)? [Edit: I tried replacing the ssh_host_rsa_key.pub and ssh_host_rsa_key with my generated private and public keys (renamed, of course). When I tried restarting SSH service, I get "End must be KEY=VALUE pairs"). So I broke the SSH service.]
Thanks in advance for the help. I've been Googling for hours, and even called my more-tech-savvy friend, who happens to work at Google. And I haven't gotten an answer.