Linux Networking Cookbook

7.4. Generating and Copying SSH Keys

Problem

Your OpenSSH installation did not automatically create host keys, or you want to generate new replacement host keys. Additionally, you don't trust the usual automatic transfer of the host's public key, so you want to manually copy host keys to the clients.

Solution

Should you create RSA or DSA keys? Short answer: it doesn't matter. Both are cryptographically strong.

The main difference to the end user is RSA keys can be up to 2,048 bits in length, while DSA is limited to 1,024 bits, so theoretically, RSA keys are more future-proof. The default for either type of key is 1,024 bits.

This example generates a new key pair, using the default host key name from /etc/ssh/sshd_config. Never create a passphrase on host keys—just hit the return key when it asks for one:

	# cd /etc/ssh/
	# ssh-keygen -t dsa -f ssh_host_dsa_key
	Generating public/private dsa key pair.
	Enter passphrase (empty for no passphrase):
	Enter same passphrase again:
	Your identification has been saved in /etc/ssh/ssh_host_dsa_key.
	Your public key has been saved in /etc/ssh/ssh_host_dsa_key.pub.
	The key fingerprint is:
	26:f6:5b:24:49:e6:71:6f:12:76:1c:2b:a5:ee:fe:fe root@windbag

You may wish to be extra cautious and copy the public key manually via floppy disk, USB key, or scp over an existing OpenSSH connection to avoid any possible hijacking in transit. You need to modify the key if you're going to copy it manually. Here is the original public host key:

 ssh-dss AAAAB3NzaC1kc3MAAACBALeIrq77k20kUAh8u3RYG1p0iZKAxLQZQzxJ8422d+uPRwvVAARFnriNajoJaB9L7 ...