1

I understand that ssh-keygen is used to generate private and public keys. But what is the use of sshd-keygen?

I don't find a man page or doc, hence there is no documentation about the use of sshd-keygen.

[root@intel-chiefriver-02 ~]# whereis sshd-keygen
sshd-keygen: /usr/sbin/sshd-keygen
[root@intel-chiefriver-02 ~]# cat /etc/redhat-release 
CentOS Linux release 7.6.1810 (Core) 
  • 1
    Where do you find sshd-keygen? It isn't part of the ordinary OpenSSH distribution. – Kusalananda Sep 18 at 18:46
  • @Kusalananda it is there by-default in CentOS 7. Added more info about the host info in question section. – smc Sep 18 at 18:55
  • @smc, what's your version of the openssh-server rpm? – ilkkachu Sep 18 at 19:06
2

There's /usr/libexec/openssh/sshd-keygen in Fedora's openssh-server-7.9p1-5.fc30.x86_64.rpm. It's a script to create the host keys. There's a systemd service that goes with it, sshd-keygen@.service.

The service checks if a particular host key doesn't exist, and runs the script which just calls ssh-keygen to create them. So, if the host keys don't exist or get deleted, they're regenerated the next time they're needed.

There's also mentions of sshd-keygen in the Fedora wiki, in Changes/Remove slogin and sshd-keygen.

It mentions removing "sshd-keygen, a legacy Fedora init script" (and replace it with a proper systemd service) and mentions "Applications/services that needs to make sure that ssh host keys are available".

Yours might be a different implementation, but I suppose it's safe to say that it's for the same purpose.

0

The SSH server itself has a key that it uses to identify itself to clients. This is to prevent man-in-the-middle attacks, etc. Also why you'll see something like

The authenticity of host '[foo.example.com]:22 ([10.0.2.15]:22)' can't be established.
ECDSA key fingerprint is SHA256:QOCUzNedwfepPHZ8JOn7xfGc1zQ8MmIohNCAE93jMEQ.
Are you sure you want to continue connecting (yes/no)?

The first time you connect to a remote host using ssh/scp/sftp

Actual files on the server for these keys should be under /etc/ssh -

ssh_host_dsa_key
ssh_host_dsa_key.pub
ssh_host_ecdsa_key
ssh_host_ecdsa_key.pub
ssh_host_ed25519_key
ssh_host_ed25519_key.pub
ssh_host_rsa_key
ssh_host_rsa_key.pub

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.