3

I have a new dedicated server, which I currently access with username and password over ssh. I have not yet set up an ssh key. I am just looking into it now.

So this is a new server with ubuntu freshly installed, is it normal that the /etc/ssh/ directory already has ssh_host_ecdsa_key and ssh_host_rsa_key files on it? I can also see.pub files for these as well.

Does this mean whoever set up the server can access it using those key files? I want to be the only person who can log in to my server.

I am not an experienced linux user, still trying to learn.

Thanks

5

The keys are generated automatically when you install the openssh-server.

To manually make a new set of keys,

First, delete the old ssh host keys. On the server,

sudo rm -f /etc/ssh/ssh_host_*

Then make new keys

sudo dpkg-reconfigure openssh-server

You will see

Creating SSH2 RSA key; this may take some time ... Creating SSH2 DSA key; this may take some time ... Restarting OpenBSD Secure Shell server: sshd.

Your clients may get an message when they log in:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that the RSA host key has just been changed.

...

If so, have the clients run

ssh-keygen -R hostname

where hostname is the name of the server.

|improve this answer|||||
  • Thanks. If I can ask one last thing, what is the purpose of these keys? Does it enable a user to login? Or something else – user230779 Jan 5 '14 at 16:16
  • ssh security, it eliminates a man in the middle attack. The keys (securely) identify the host.See also bodhizazen.net/Tutorials/SSH_security – Panther Jan 5 '14 at 16:51
1

As I understand it, you're renting the use of some hardware and associated utilities (power, network connectivity, perhaps backups). The hosting provider has physical access to your hardware. Therefore he can, at any time, read and even change your data. You have to trust them not to make use of that ability. The only alternative is doing the hosting yourself.

It is normal for hosting providers to provide a basic software installation including an SSH server (so you have a way to log in — depending on the service this may or may not be your only way to log in initially). The SSH server private key is generated automatically when the openssh-server package is installed, so it's normal that you find it already there when you look. The fact that the hosting provider triggered the key generation doesn't give them any extra access to your server. If you had some other way to log in and installed the openssh-server package manually, then you generated the key yourself even if you didn't realize it.

The SSH server key authenticates the server, not users. It doesn't allow users to log in. What allows users to log in is if their public key is listed in the file .ssh/authorized_keys in their home directory; it's always the party who has the private key who is authenticated, and the party who has the public key who does the authentication. The SSH server key pair allows you to be told if an attacker tries to make you log in to their server instead of yours, or tries to intercept the SSH connection between your client and your server. For more information, read up on public-key cryptography and how SSH uses it.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.