SSH host keys

SSH host keys are cryptographic keys used by the SSH (Secure Shell) protocol to verify the identity of a server to a client. These keys play a crucial role in securing SSH connections by preventing man-in-the-middle attacks and ensuring that the client is connecting to the correct server.

Key Concepts of SSH Host Keys

Purpose of SSH Host Keys

1. Server Authentication: SSH host keys allow clients to verify that they are connecting to the correct server. When a client connects to a server for the first time, the server presents its host key, which the client can then store for future reference.

2. Security: By ensuring that the server’s identity can be verified, SSH host keys help protect against man-in-the-middle attacks.

3. Encryption: Host keys are part of the initial key exchange process that sets up encrypted communication between the client and server.

Types of SSH Host Keys

SSH supports several types of host keys, each using a different cryptographic algorithm:

1. RSA: One of the oldest and most widely used algorithms. Suitable for most use cases.

2. ECDSA: Based on elliptic curve cryptography, offering strong security with smaller key sizes.

3. ED25519: A newer elliptic curve algorithm that provides high security and performance.

4. DSA: An older algorithm that is less commonly used today due to security concerns.

Location of SSH Host Keys

SSH host keys are typically stored in the /etc/ssh/ directory on the server:

• RSA: /etc/ssh/ssh_host_rsa_key and /etc/ssh/ssh_host_rsa_key.pub

• ECDSA: /etc/ssh/ssh_host_ecdsa_key and /etc/ssh/ssh_host_ecdsa_key.pub

• ED25519: /etc/ssh/ssh_host_ed25519_key and /etc/ssh/ssh_host_ed25519_key.pub

• DSA: /etc/ssh/ssh_host_dsa_key and /etc/ssh/ssh_host_dsa_key.pub

Managing SSH Host Keys

Viewing Existing Host Keys

You can view the public part of the SSH host keys using the following command:

sudo cat /etc/ssh/ssh_host_rsa_key.pub
sudo cat /etc/ssh/ssh_host_ecdsa_key.pub
sudo cat /etc/ssh/ssh_host_ed25519_key.pub
sudo cat /etc/ssh/ssh_host_dsa_key.pub

Generating New Host Keys

To generate new SSH host keys, you can use the ssh-keygen command. This might be necessary if the keys have been compromised or if you want to upgrade to a more secure key type.

Example for generating an RSA key:

sudo ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key -N ''

Replace rsa with ecdsa, ed25519, or dsa to generate keys of other types. The -N '' part ensures that the key has no passphrase.

Configuring SSH to Use Host Keys

Ensure that your sshd_config file (typically located at /etc/ssh/sshd_config) includes the correct paths to the host keys:

HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
HostKey /etc/ssh/ssh_host_dsa_key

After making changes to the sshd_config file, restart the SSH service to apply the changes:

sudo systemctl restart sshd

Verifying SSH Host Keys on the Client Side

When a client connects to an SSH server for the first time, it stores the server’s host key in the ~/.ssh/known_hosts file. The next time the client connects to the server, it verifies the server’s identity using this stored key.

You can manually add a server’s host key to the known_hosts file to avoid the prompt during the first connection:

ssh-keyscan -H <server-ip-or-hostname> >> ~/.ssh/known_hosts

Example: SSH Host Key Management

Viewing the Current Host Key Fingerprints

sudo ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key.pub
sudo ssh-keygen -l -f /etc/ssh/ssh_host_ecdsa_key.pub
sudo ssh-keygen -l -f /etc/ssh/ssh_host_ed25519_key.pub

Generating a New ED25519 Host Key

sudo ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ''

Ensuring SSHD Uses the Correct Host Keys

Edit /etc/ssh/sshd_config:

sudo nano /etc/ssh/sshd_config

Add or verify the following lines:

HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key

Restart the SSH service:

sudo systemctl restart sshd

Conclusion

SSH host keys are fundamental to the security and integrity of SSH connections. Proper management of these keys ensures that clients can reliably verify the identity of servers and establish secure communication channels. Understanding how to view, generate, and configure SSH host keys is crucial for maintaining a secure SSH environment.