0

Using ssh-keygen I was able to generate a public-private key pair one Machine#1 and then I copied the public key to Machine#2 using ssh-copy-id. On Machine#2, I noticed that there are 3 key-pairs already generated in the /etc/ssh folder and I was wondering what are these for? Is the purpose of them to simply allow copying the private key and use it?

Can I grant access to Machine#1 w/o generating a key-pair by simply copying one of the private keys already present in the /etc/ssh folder of Machine#2? If so how do I do it?

3

The keys in /etc/ssh are (probably) host keys: the keys which the client uses to verify the identify of the server to which it is connecting; not user keys which each user might generate to identify as an authorized user to connect to that server, and which are typically stored in ~/.ssh for each user. These keys are typically generated when the OpenSSH package is installed on the system, via ssh-keygen -A :

From the manual page for ssh-keygen:

-A

For each of the key types (rsa, dsa, ecdsa and ed25519) for which host keys do not exist, generate the host keys with the default key file path, an empty passphrase, default bits for the key type, and default comment. If -f has also been specified, its argument is used as a prefix to the default path for the resulting host key files. This is used by /etc/rc to generate new host keys.

2

Those are host keys for the server to identify itself, as their filenames imply (ssh_host_xxx_key). Copying them will only allow some other system to identify themselves as the server, they won't allow you access to the server itself.

Can I grant access to Machine#1 w/o generating a key-pair by simply copying one of the private keys already present in the /etc/ssh folder of Machine#2? If so how do I do it?

Don't. Copying around private keys is massively insecure and should not be done.

  • How are we supposed to identify the correct server using the host keys then? – Weezy Oct 29 '18 at 8:33
  • 3
    @Weezy ssh-keygen -l -f /etc/ssh/ssh_host_xxx_key.pub will print the key fingerprint. When you first connect to an SSH server, ssh will print the server's fingerprint and ask you to confirm whether it is correct. Compare both. – muru Oct 29 '18 at 8:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.