Changing the output directory when recreating SSH host keys with ssh-keygen (the -f switch doesn't prevent ssh-keygen from writing to /etc/ssh/)

Question

I've been trying to start an additional sshd process on a remote machine. I've created a working directory with the new sshd config file I'd like to use.

When I try to run sshd using the config file in this directory, it complains it can't find any host keys. I've tried to create missing host keys by running ssh-keygen -A with the -f switch to specify the location of my working directory but ssh-keygen continues trying to place the keys in /etc/ssh/ instead of the directory I specified. I don't have access to /etc/ssh, so it fails.

How can I generate these keys without access to this path?

Answer 1

The -A option tells ssh-keygen to generate host keys. According to the manual page, the intended use of ssh-keygen is

Normally each user wishing to use SSH with public key authentication runs
this once to create the authentication key in ~/.ssh/identity,
~/.ssh/id_ecdsa, ~/.ssh/id_dsa or ~/.ssh/id_rsa. Additionally, the system administrator may use this to generate host keys.

The synopsis lists the -A on a line by itself, with no other options:

SYNOPSIS
     ssh-keygen [-q] [-b bits] -t type [-N new_passphrase] [-C comment]
                [-f output_keyfile]
     ssh-keygen -p [-P old_passphrase] [-N new_passphrase] [-f keyfile]
     ssh-keygen -i [-m key_format] [-f input_keyfile]
     ssh-keygen -e [-m key_format] [-f input_keyfile]
     ssh-keygen -y [-f input_keyfile]
     ssh-keygen -c [-P passphrase] [-C comment] [-f keyfile]
     ssh-keygen -l [-f input_keyfile]
     ssh-keygen -B [-f input_keyfile]
     ssh-keygen -D pkcs11
     ssh-keygen -F hostname [-f known_hosts_file] [-l]
     ssh-keygen -H [-f known_hosts_file]
     ssh-keygen -R hostname [-f known_hosts_file]
     ssh-keygen -r hostname [-f input_keyfile] [-g]
     ssh-keygen -G output_file [-v] [-b bits] [-M memory] [-S start_point]
     ssh-keygen -T output_file -f input_file [-v] [-a num_trials] [-K checkpt]
                [-W generator]
     ssh-keygen -s ca_key -I certificate_identity [-h] [-n principals]
                [-O option] [-V validity_interval] [-z serial_number] file ...
     ssh-keygen -L [-f input_keyfile]
     ssh-keygen -A

So (aside from modifying the source and compiling it yourself), what you are asking is not its intended use.

Further reading:

• ssh-keygen — authentication key generation, management and conversion

Answer 2

According to the man page Thomas linked to, -f is now supported for ssh-keygen -A and specifies a prefix for the files, so it looks like this feature was added in.

-A

Generate host keys of all default key types (rsa, ecdsa, and ed25519) if they do not already exist. The host keys are generated with the default key file path, an empty passphrase, default bits for the key type, and default comment. If -f has also been specified, its argument is used as a prefix to the default path for the resulting host key files. This is used by /etc/rc to generate new host keys.

Note that the etc/ssh folders must exist under the output folder prior to running ssh-keygen

$ mkdir -p output/etc/ssh

$ ssh-keygen -A -f output
ssh-keygen: generating new host keys: RSA ECDSA ED25519

$ ls output/etc/ssh/
ssh_host_ecdsa_key  ssh_host_ecdsa_key.pub  ssh_host_ed25519_key  ssh_host_ed25519_key.pub  ssh_host_rsa_key  ssh_host_rsa_key.pub

Answer 3

If you have access to docker, which is why I wanted to do this, to create a new, persistent host-key that would be outside container, I used the following:

docker run -d --name get_host_keys lscr.io/linuxserver/openssh-server:latest
sleep 5
docker cp get_host_keys:/etc/ssh/. .
rm *config*
docker stop get_host_keys
docker rm get_host_keys