You're confusing verification of a server with its host key (done by the client) with authentication of a ssh user login (done by the server).
The authenticity of the host is verified on the client with the host key. This should prevent possible MITM attacks pretending to be your server. The host keys are saved on the server in /etc/ssh/ssh_host*key
and on the client in ~/.ssh/known_hosts
file.
Connecting to a server using ssh -vvv
shows this:
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:fYR10r/RKXIzOmJYbgbDi29E10oW7MLjto2plpALaBY
debug3: hostkeys_foreach: reading file "/home/xxxx/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /home/xxxx/.ssh/known_hosts:69
debug3: load_hostkeys: loaded 1 keys from xx.xx.xx.xx
debug1: Host 'xx.xx.xx.xx' is known and matches the ECDSA host key.
- Server sends host key
- Client searches the key in
known_hosts
- Client loads and verfies the key
You don't need to manually create the host key, this is done automatically. On the client side you don't need to add the host key manually as this is done on the first connection to a server (You have to type 'yes').
When the host key changes due to new installation of the server you need to remove that key from the known_hosts
file, otherwise ssh
refuses to connect unless you have the -o StrictHostKeyChecking=no
option set which I would not advise to do.
When you added the ssh key from your server to your clients authorized_keys
file, you authorize connections from your server to your user on the client which is probably not what you want. I advise you to remove the key on the client side.
Further reading: