4

Using ssh-keygen I was able to generate a public-private key pair one Machine#1 and then I copied the public key to Machine#2 using ssh-copy-id. On Machine#2, I noticed that there are 3 key-pairs already generated in the /etc/ssh folder and I was wondering what are these for? Is the purpose of them to simply allow copying the private key and use it?

Can I grant access to Machine#1 w/o generating a key-pair by simply copying one of the private keys already present in the /etc/ssh folder of Machine#2? If so how do I do it?

Improve this question

2 Answers 2

Reset to default
5

The keys in /etc/ssh are (probably) host keys: the keys which the client uses to verify the identify of the server to which it is connecting; not user keys which each user might generate to identify as an authorized user to connect to that server, and which are typically stored in ~/.ssh for each user. These keys are typically generated when the OpenSSH package is installed on the system, via ssh-keygen -A :

From the manual page for ssh-keygen:

-A

For each of the key types (rsa, dsa, ecdsa and ed25519) for which host keys do not exist, generate the host keys with the default key file path, an empty passphrase, default bits for the key type, and default comment. If -f has also been specified, its argument is used as a prefix to the default path for the resulting host key files. This is used by /etc/rc to generate new host keys.

Improve this answer
2
  • That explains it. A follow-up question: How do I, as a user, then validate if I am connecting to the right server using the server's host keys? Commented Oct 29, 2018 at 8:32
  • @Weezy, see unix.stackexchange.com/questions/42643/… Commented Oct 29, 2018 at 11:09
4

Those are host keys for the server to identify itself, as their filenames imply (ssh_host_xxx_key). Copying them will only allow some other system to identify themselves as the server, they won't allow you access to the server itself.

Can I grant access to Machine#1 w/o generating a key-pair by simply copying one of the private keys already present in the /etc/ssh folder of Machine#2? If so how do I do it?

Don't. Copying around private keys is massively insecure and should not be done.

Improve this answer
2
  • How are we supposed to identify the correct server using the host keys then? Commented Oct 29, 2018 at 8:33
  • 4
    @Weezy ssh-keygen -l -f /etc/ssh/ssh_host_xxx_key.pub will print the key fingerprint. When you first connect to an SSH server, ssh will print the server's fingerprint and ask you to confirm whether it is correct. Compare both. Commented Oct 29, 2018 at 8:38

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.