3

I'm following the best security practices of SSH, via this link and the link states:

We should remove the unused keys and only generate a large RSA key and an Ed25519 key. Your init scripts may recreate the unused keys. If you don’t want that, remove any ssh-keygen commands from the init script.

However I can't find where this init script is located to remove the ssh-keygen command. I don't want my OS to recreate DSA and EDCSA keys at boot. I tried many places I thought it might be located, like /etc/rc.d and similar. My OS is OpenBSD 5.7

7
  • +1 for a good guide on SSH security practices. Want to know that too!
    – Freedo
    Jul 18, 2015 at 19:20
  • 2
    Don't remove the keys or modify the init scripts. Instead disable the keys in sshd_config. Jul 18, 2015 at 21:06
  • In a very secure server nobody would use this keys anyway...there's no reason to even let them exist
    – Freedo
    Jul 18, 2015 at 23:55
  • 1
    Yes, but if you modify any init script you're going to mess up the updates. The sshd_config method is the cleaner one to disable obsolete algorithms. The output of sysmerge during the updates will be more simple. Jul 19, 2015 at 1:23
  • By updates you mean like upgrading to 5.8 ? I would just download 5.8 iso and format it anyway. But if i knew that before i would just create a copy .backup but now is too late lol
    – Freedo
    Jul 19, 2015 at 3:01

1 Answer 1

0

On /etc/rc search for : ssh-keygen -A then delete this line. You should not recreate any keys at startup. I did this and i got no error warning on boot, but if anyone knows a "cleaner" way to do this, please answer! Also this work for OpenBSD only(i think) but should only be a matter of finding the right init script to remove this line on other unix variants.

Edit : If you want to preserve your init script if you ever need it to update your system do cd /etc then cp rc rc.backup . If you ever need your original script just remove rc and rename rc.backup to rc

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .