2

I have a VPS in the cloud (Ubuntu server 16.04)

  • I SSH to the server (no problem there)
  • I update the software: apt upgrade+apt update
  • I reboot the server: shutdown -r now. SSH connection is closed
  • When I try to reconnect (20 seconds later), SSH says ECDSA host key for <server> has changed and you have requested strict checking.

This isn't the first time I update the server like this but this is the first time I see the key change. Is this normal?

The updates included new versions of libssl and openssl, could it be the cause?

  • did you check the SSH auth log /var/log/auth.log to see if someone was doing something nasty? – Yousef Al-Hadhrami Sep 29 '18 at 21:34
1

If you did not change your SSH configurations or the host keys by your self, it's either one of those things:

  • Client changed his key (software reinstall or manually)
  • Server changed his key (software reinstall or manually)

So look at the modification date of the key in each OS and check who was modified

For this to not happen in the future make sure that preserve existing SSH host keys during a system upgrade, then use the old keys after the upgrade.

  • From their timestamp, the SSH keys on the server have been regenerated during the boot process, it seems. But I didn't reinstall openssl/libssl, I just upgraded them.. – xenoid Sep 29 '18 at 22:28
  • check if sshd daemon was modified /etc/init.d/sshd – Yousef Al-Hadhrami Sep 29 '18 at 22:31
1

find /etc -name '*ssh*' -ls shows that the only recent files are the various ssh keys (all changed at the end of the server reboot).

Looking at /var/log/syslog, I find these lines:

Sep 29 20:56:20 <server> cloud-init[1245]: Your identification has been saved in /etc/ssh/ssh_host_rsa_key.
Sep 29 20:56:20 <server> cloud-init[1245]: Your public key has been saved in /etc/ssh/ssh_host_rsa_key.pub.
Sep 29 20:56:20 <server> cloud-init[1245]: Your identification has been saved in /etc/ssh/ssh_host_dsa_key.
Sep 29 20:56:20 <server> cloud-init[1245]: Your public key has been saved in /etc/ssh/ssh_host_dsa_key.pub.
Sep 29 20:56:20 <server> cloud-init[1245]: Your identification has been saved in /etc/ssh/ssh_host_ecdsa_key.
Sep 29 20:56:20 <server> cloud-init[1245]: Your public key has been saved in /etc/ssh/ssh_host_ecdsa_key.pub.
Sep 29 20:56:20 <server> cloud-init[1245]: Your identification has been saved in /etc/ssh/ssh_host_ed25519_key.
Sep 29 20:56:20 <server> cloud-init[1245]: Your public key has been saved in /etc/ssh/ssh_host_ed25519_key.pub.

And from the contents of other messages, the cloud-init thing seems to be from my hosting service, so it's likely not due to the upgrade but to the reboot, and I'll have a chat with support.

0

It's a bit strange that you never saw that before, at least when using protocol version 1, as

Forward security for protocol 1 is provided through an additional server key, normally 768 bits, generated when the server starts.

(cited from man sshd)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.