Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

In my automated backups, I'm not sure if I should be doing this. If the hard drive fails or if I wipe the hard disk and start over, what will be the effect of starting with a new SSH host key to my clients? Will I have to do anything special other than remove the host's name from each client's known_hosts file? What is the best thing to do in this case? I'm planning on wiping my computer and starting from scratch in the next few days.

share|improve this question
add comment

2 Answers

up vote 9 down vote accepted

If you're reinstalling the OS on your computer, but you consider that it's still the “same” computer, then you must back up the SSH private key and restore it after the installation. If you're reusing the same hardware to make a different system, then you must generate a new key for the new system. Deciding whether it's still the same computer is a semantic decision, so it's up to you; restoring or regenerating the SSH key is the implementation of this decision.

If you're the only person accessing that computer, it doesn't matter much. If you have other users, changing the SSH key will cause trouble:

  • The few users who are both security-conscious and knowledgeable will worry that something bad is happening and try to contact you out of band to warn you that they may be under attack.
  • The few users who are knowledgeable but not that paranoid will remove the old SSH key to get rid of the error message, and grumble about the sysadmin changing the key.
  • The majority of users who ignore messages are just going to see that they can't connect and may contact you for help.
share|improve this answer
add comment

Unless a world of people connect to your system besides you and you want the change in their service to be as uninterrupted as possible, it is probably just as well that you create new host keys. If you wipe a system and start from scratch it really isn't the same system as it was before and your ssh clients will be right in wanting to notify you that the system has changed. If you don't have any crazy lock-downs in affect were you cannot connect to new hosts, this should be an easy matter of updating the known hosts file.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.