I'm following the best security practices of SSH, via this link and the link states:

We should remove the unused keys and only generate a large RSA key and an Ed25519 key. Your init scripts may recreate the unused keys. If you don’t want that, remove any ssh-keygen commands from the init script.

However I can't find where this init script is located to remove the ssh-keygen command. I don't want my OS to recreate DSA and EDCSA keys at boot. I tried many places I thought it might be located, like /etc/rc.d and similar. My OS is OpenBSD 5.7

  • +1 for a good guide on SSH security practices. Want to know that too! – Freedo Jul 18 '15 at 19:20
  • 2
    Don't remove the keys or modify the init scripts. Instead disable the keys in sshd_config. – Rufo El Magufo Jul 18 '15 at 21:06
  • In a very secure server nobody would use this keys anyway...there's no reason to even let them exist – Freedo Jul 18 '15 at 23:55
  • 1
    Yes, but if you modify any init script you're going to mess up the updates. The sshd_config method is the cleaner one to disable obsolete algorithms. The output of sysmerge during the updates will be more simple. – Rufo El Magufo Jul 19 '15 at 1:23
  • By updates you mean like upgrading to 5.8 ? I would just download 5.8 iso and format it anyway. But if i knew that before i would just create a copy .backup but now is too late lol – Freedo Jul 19 '15 at 3:01

On /etc/rc search for : ssh-keygen -A then delete this line. You should not recreate any keys at startup. I did this and i got no error warning on boot, but if anyone knows a "cleaner" way to do this, please answer! Also this work for OpenBSD only(i think) but should only be a matter of finding the right init script to remove this line on other unix variants.

Edit : If you want to preserve your init script if you ever need it to update your system do cd /etc then cp rc rc.backup . If you ever need your original script just remove rc and rename rc.backup to rc

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.