2

I have a RHEL 8.3 server and this is the content in the /etc/ssh folder:

[root@192 ssh]# pwd
/etc/ssh
[root@192 ssh]# tree -a
.
├── moduli
├── ssh_config
├── ssh_config.d
│   └── 05-redhat.conf
├── sshd_config
├── ssh_host_ecdsa_key
├── ssh_host_ecdsa_key.pub
├── ssh_host_ed25519_key
├── ssh_host_ed25519_key.pub
├── ssh_host_rsa_key
└── ssh_host_rsa_key.pub

1 directory, 10 files
[root@192 ssh]#

I found that when I ssh to this server from server1, the RSA public key (ssh_host_rsa_key.pub) was added in server 1's ~/.ssh/known_hosts file. But when I try another server server2, the ECDSA public key (ssh_host_ecdsa_key.pub) was added to ~/.ssh/known_hosts. Why the difference? What determines which public key will be used?

2 Answers 2

2

In the SSH protocol, the algorithms used for the cipher, MAC, key exchange, host key, and public key can be independently negotiated. In most cases, the algorithm selected is the first of the client algorithms that the server also supports.

Typically, a server has multiple host keys, and the choice of host key used is dependent on the algorithm negotiated. The latest versions of OpenSSH prefer Ed25519 keys, and before that, preferred ECDSA keys. However, OpenSSH has a special rule that if no special configuration of the host key is used and at least one host key is known in the known hosts file, then it will rewrite the preferred client algorithms to prefer the host keys that it knows about. This means that users won't see host key warnings if the server adds a new host key.

As mentioned, typically Ed25519 and ECDSA keys are preferred. However, OpenSSH recently dropped support for automatically using RSA with SHA-1 (the ssh-rsa signature algorithm, which is insecure), while it still supports RSA with SHA-2 (rsa-sha2-256 and rsa-sha2-512). Sometimes people choose to re-enable the ssh-rsa algorithm in the configuration despite the known security risks, and the typical pattern that people use for that puts the algorithm at the front of the list. Hence, it is possible that on that system, such a configuration was enabled in ~/.ssh/config or /etc/ssh/ssh_config, leading to preferring the RSA key.

1

You can choose the ciphers in sshd_config. On a busy or old server, an admin might offer up for a less CPU-intensive cipher suite. Something similar happens with websites and the negotiation to secure a connection with each individual client browser in that the server and client must eventually agree on a technology that they both support. So the user does have some influence as well (ssh_config).

On a server it's in /etc/ssh/sshd_config if you want to take a look.

You can probe a server with ssh-keyscan. See here: https://serverfault.com/questions/934072/how-to-view-ecdsa-host-key-of-a-server

1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .