2

I understand that ssh-keygen is used to generate private and public keys. But what is the use of sshd-keygen?

I don't find a man page or doc, hence there is no documentation about the use of sshd-keygen.

[root@intel-chiefriver-02 ~]# whereis sshd-keygen
sshd-keygen: /usr/sbin/sshd-keygen
[root@intel-chiefriver-02 ~]# cat /etc/redhat-release 
CentOS Linux release 7.6.1810 (Core) 
3
  • 1
    Where do you find sshd-keygen? It isn't part of the ordinary OpenSSH distribution.
    – Kusalananda
    Sep 18, 2019 at 18:46
  • @Kusalananda it is there by-default in CentOS 7. Added more info about the host info in question section.
    – smc
    Sep 18, 2019 at 18:55
  • @smc, what's your version of the openssh-server rpm?
    – ilkkachu
    Sep 18, 2019 at 19:06

2 Answers 2

3

There's /usr/libexec/openssh/sshd-keygen in Fedora's openssh-server-7.9p1-5.fc30.x86_64.rpm. It's a script to create the host keys. There's a systemd service that goes with it, [email protected].

The service checks if a particular host key doesn't exist, and runs the script which just calls ssh-keygen to create them. So, if the host keys don't exist or get deleted, they're regenerated the next time they're needed.

There's also mentions of sshd-keygen in the Fedora wiki, in Changes/Remove slogin and sshd-keygen.

It mentions removing "sshd-keygen, a legacy Fedora init script" (and replace it with a proper systemd service) and mentions "Applications/services that needs to make sure that ssh host keys are available".

Yours might be a different implementation, but I suppose it's safe to say that it's for the same purpose.

1

The SSH server itself has a key that it uses to identify itself to clients. This is to prevent man-in-the-middle attacks, etc. Also why you'll see something like

The authenticity of host '[foo.example.com]:22 ([10.0.2.15]:22)' can't be established.
ECDSA key fingerprint is SHA256:QOCUzNedwfepPHZ8JOn7xfGc1zQ8MmIohNCAE93jMEQ.
Are you sure you want to continue connecting (yes/no)?

The first time you connect to a remote host using ssh/scp/sftp

Actual files on the server for these keys should be under /etc/ssh -

ssh_host_dsa_key
ssh_host_dsa_key.pub
ssh_host_ecdsa_key
ssh_host_ecdsa_key.pub
ssh_host_ed25519_key
ssh_host_ed25519_key.pub
ssh_host_rsa_key
ssh_host_rsa_key.pub

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .