3

I have a VPS in the cloud (Ubuntu server 16.04)

  • I SSH to the server (no problem there)
  • I update the software: apt upgrade+apt update
  • I reboot the server: shutdown -r now. SSH connection is closed
  • When I try to reconnect (20 seconds later), SSH says ECDSA host key for <server> has changed and you have requested strict checking.

This isn't the first time I update the server like this but this is the first time I see the key change. Is this normal?

The updates included new versions of libssl and openssl, could it be the cause?

1
  • did you check the SSH auth log /var/log/auth.log to see if someone was doing something nasty? Sep 29, 2018 at 21:34

3 Answers 3

3

find /etc -name '*ssh*' -ls shows that the only recent files are the various ssh keys (all changed at the end of the server reboot).

Looking at /var/log/syslog, I find these lines:

Sep 29 20:56:20 <server> cloud-init[1245]: Your identification has been saved in /etc/ssh/ssh_host_rsa_key.
Sep 29 20:56:20 <server> cloud-init[1245]: Your public key has been saved in /etc/ssh/ssh_host_rsa_key.pub.
Sep 29 20:56:20 <server> cloud-init[1245]: Your identification has been saved in /etc/ssh/ssh_host_dsa_key.
Sep 29 20:56:20 <server> cloud-init[1245]: Your public key has been saved in /etc/ssh/ssh_host_dsa_key.pub.
Sep 29 20:56:20 <server> cloud-init[1245]: Your identification has been saved in /etc/ssh/ssh_host_ecdsa_key.
Sep 29 20:56:20 <server> cloud-init[1245]: Your public key has been saved in /etc/ssh/ssh_host_ecdsa_key.pub.
Sep 29 20:56:20 <server> cloud-init[1245]: Your identification has been saved in /etc/ssh/ssh_host_ed25519_key.
Sep 29 20:56:20 <server> cloud-init[1245]: Your public key has been saved in /etc/ssh/ssh_host_ed25519_key.pub.

And from the contents of other messages, the cloud-init thing seems to be from my hosting service, so it's likely not due to the upgrade but to the reboot, and I'll have a chat with support.

3
1

If you did not change your SSH configurations or the host keys by your self, it's either one of those things:

  • Client changed his key (software reinstall or manually)
  • Server changed his key (software reinstall or manually)

So look at the modification date of the key in each OS and check who was modified

For this to not happen in the future make sure that preserve existing SSH host keys during a system upgrade, then use the old keys after the upgrade.

2
  • From their timestamp, the SSH keys on the server have been regenerated during the boot process, it seems. But I didn't reinstall openssl/libssl, I just upgraded them..
    – xenoid
    Sep 29, 2018 at 22:28
  • check if sshd daemon was modified /etc/init.d/sshd Sep 29, 2018 at 22:31
0

It's a bit strange that you never saw that before, at least when using protocol version 1, as

Forward security for protocol 1 is provided through an additional server key, normally 768 bits, generated when the server starts.

(cited from man sshd)

2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .