1

I need to configure a raspberry pi in a way that I know its ssh fingerprints before the first boot, so the only way is to generate the keys in the SD card on my computer and get the fingerprints. I did this, but when the raspberry boots, it creates new keys on top of the ones I generated. How to prevent the ssh daemon from doing it? It certainly reads somewhere if its the first boot, that's gotta be a way to change it.

EDIT:

My script places the generated ssh files in /etc/ssh. In the first boot, this is the log of /var/log/daemon.log for the sh service:

Sep  7 16:12:31 raspberrypi sh[297]: removed '/etc/ssh/ssh_host_dsa_key'
Sep  7 16:12:31 raspberrypi sh[297]: removed '/etc/ssh/ssh_host_dsa_key.pub'
Sep  7 16:12:31 raspberrypi sh[297]: removed '/etc/ssh/ssh_host_ecdsa_key'
Sep  7 16:12:31 raspberrypi sh[297]: removed '/etc/ssh/ssh_host_ecdsa_key.pub'
Sep  7 16:12:31 raspberrypi sh[297]: removed '/etc/ssh/ssh_host_rsa_key'
Sep  7 16:12:31 raspberrypi sh[297]: removed '/etc/ssh/ssh_host_rsa_key.pub'

It somehow knows that these keys weren't generated by the SSH service. Note that I didn't generate the ssh_host_ed25519_key. Could it be the reason? But I commented out its line in sshd_config:

# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
#HostKey /etc/ssh/ssh_host_ed25519_key

Could it be the reason it detected and removed the keys?

EDIT 2:

I added the ed25519 key from a previous booted sd card and it still removed all the keys:

Sep  7 16:12:32 raspberrypi sh[311]: removed '/etc/ssh/ssh_host_dsa_key'
Sep  7 16:12:33 raspberrypi sh[311]: removed '/etc/ssh/ssh_host_dsa_key.pub'
Sep  7 16:12:33 raspberrypi sh[311]: removed '/etc/ssh/ssh_host_ecdsa_key'
Sep  7 16:12:33 raspberrypi sh[311]: removed '/etc/ssh/ssh_host_ecdsa_key.pub'
Sep  7 16:12:33 raspberrypi sh[311]: removed '/etc/ssh/ssh_host_ed25519_key'
Sep  7 16:12:33 raspberrypi sh[311]: removed '/etc/ssh/ssh_host_ed25519_key.pub'
Sep  7 16:12:33 raspberrypi sh[311]: removed '/etc/ssh/ssh_host_rsa_key'
Sep  7 16:12:33 raspberrypi sh[311]: removed '/etc/ssh/ssh_host_rsa_key.pub'

I also saw that I forgot to add the proper permissions for each file, but I did in this last try and still nothing. I did 600 for private keys, and 644 for public keys, just like the sshd does when it generates new ones

EDIT 3:

I tried to search for "removed" on the github source to see if I could find the piece of code that triggered the key removal but couldn't find it: https://github.com/openssh/openssh-portable/search?utf8=%E2%9C%93&q=removed&type=

  • Is the issue wanting to avoid trust on first use, or is there another reason you want to know the keys? – jrtapsell Oct 3 '17 at 14:29
  • @jrtapsell yes, avoid trust in first use. I must have the fingerprints before the first boot – Guerlando OCs Oct 3 '17 at 15:19
  • Did you play with the directory's permissions as well? I think 700 is the right thing here. – dessert Oct 5 '17 at 6:58
  • @dessert tried 700 and the exact same thing happens: it removes all keys and generate new ones – Guerlando OCs Oct 5 '17 at 22:38
  • 1
    @BowlOfRed I'd never notice this. It's Raspbian Pixel Desktop. Which service is it? – Guerlando OCs Oct 6 '17 at 2:01
1
+50

Raspbian has a service in the image called regenerate_ssh_host_keys.

[Unit]
Description=Regenerate SSH host keys
Before=ssh.service

[Service]
Type=oneshot
ExecStartPre=-/bin/dd if=/dev/hwrng of=/dev/urandom count=1 bs=4096
ExecStartPre=-/bin/sh -c "/bin/rm -f -v /etc/ssh/ssh_host_*_key*"
ExecStart=/usr/bin/ssh-keygen -A -v
ExecStartPost=/bin/systemctl disable regenerate_ssh_host_keys

[Install]
WantedBy=multi-user.target

This removes any keys already present, then regenerates the keys, then disables the service so it doesn't run again. You can disable that service (by removing the /etc/systemd/system/multi-user.target.wants/regenerate_ssh_host_keys.service file) at the same time you install the keys.

  • Is this service present in debian, for example? Wouldn't it be easier for SSH to generate its own keys in the first run if none were present? By the way, thanks, it worked – Guerlando OCs Oct 6 '17 at 3:19

Not the answer you're looking for? Browse other questions tagged or ask your own question.