1

I have just found out that on my Ubuntu machine I have more public keys to serve in /etc/ssh directory:

$ ll /etc/ssh
total 296K
-rw-r--r-- 1 root root 237K lip  3  2013 moduli
-rw-r--r-- 1 root root 1.7K kwi 17 12:43 ssh_config
-rw-r--r-- 1 root root 1.7K mar 25 23:06 ssh_config.dpkg-old
-rw-r--r-- 1 root root 1.7K kwi 17 12:43 ssh_config.lwidentity.bak
-rw-r--r-- 1 root root 1.7K mar 25 23:06 ssh_config.lwidentity.orig
-rw-r--r-- 1 root root 2.6K kwi 17 12:43 sshd_config
-rw-r--r-- 1 root root 2.6K kwi 17 12:43 sshd_config.lwidentity.bak
-rw-r--r-- 1 root root 2.5K mar 25 23:06 sshd_config.lwidentity.orig
-rw------- 1 root root  672 sty  4  2014 ssh_host_dsa_key
-rw-r--r-- 1 root root  605 sty  4  2014 ssh_host_dsa_key.pub
-rw------- 1 root root  227 sty  4  2014 ssh_host_ecdsa_key
-rw-r--r-- 1 root root  177 sty  4  2014 ssh_host_ecdsa_key.pub
-rw------- 1 root root 1.7K sty  4  2014 ssh_host_rsa_key
-rw-r--r-- 1 root root  397 sty  4  2014 ssh_host_rsa_key.pub
-rw-r--r-- 1 root root  338 kwi 17 12:36 ssh_import_id

Having this and :

$ find /etc/ssh  ~/.ssh -name "*.pub" -exec ssh-keygen -l -f {} \;
256 da:f0:03:79:68:f8:04:b1:07:d8:8f:fe:3d:91:0e:aa  root@icanseeyou (ECDSA)
2048 3f:d7:9f:68:1b:b3:1a:a9:47:5b:47:5b:27:88:8c:aa  root@icanseeyou (RSA)
1024 7f:24:ca:0f:e3:84:8e:f9:1c:b3:49:d1:f4:39:a1:aa  root@icanseeyou (DSA)
4096 ae:86:c9:88:36:36:37:2f:84:5b:83:b4:45:17:41:aa  USER@icanseeyou (RSA)

I always get the ECDSA key as the first one (the one that is served)

$ ssh -p 222 USER@localhost
The authenticity of host '[localhost]:222 ([127.0.0.1]:222)' can't be established.
ECDSA key fingerprint is da:f0:03:79:68:f8:04:b1:07:d8:8f:fe:3d:91:0e:aa.
Are you sure you want to continue connecting (yes/no)? 

/etc/ssh/sshd_config

 11 HostKey /etc/ssh/ssh_host_rsa_key
 12 HostKey /etc/ssh/ssh_host_dsa_key
 13 HostKey /etc/ssh/ssh_host_ecdsa_key

How does this work ? Why is the ECDSA key the first one to be served ?

2

Haven't looked at the code, but:

ECDSA host keys are preferred when learning a host's keys for the first time, or can be learned using ssh-keyscan(1).

Source: http://openbsd.das.ufsc.br/openssh/txt/release-5.7

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.