up vote 2 down vote favorite
share [g+] share [fb]

Going to be moving a server to new hardware in a new datacenter soon, and of course this means a new IP.

What is the correct process (if at all) to move the SSH keys from the original server to the new one so that connecting clients don't get any warnings or have to accept anything again?

Is it even possible, considering the IP is changing?

What files do I have to move? I'm assuming all of the ssh_host_* files.

Moving from RHEL 5 to Ubuntu 10.04.

link|improve this question
88% accept rate
feedback

2 Answers

up vote 4 down vote accepted

You can move the keys from your current serer to the new server without much hassle. You just need to make sure they go into the same location and have the same permission.

Ideally though, you should take the opportunity to create new keys and update the client keys in the interest of security.

link|improve this answer
2  
I forgot to add that your users may get a warning when they connect to the new host that they already have a host in their knownhosts file which matches the key they are authenticating against. This means they will have to remove the entry in their known hosts file. You can't get around this. – Mike Mar 23 '11 at 16:00
So if users might get a warning anyway, is there much of a point in moving the keys? – Daniel Huckstep Mar 23 '11 at 16:16
1  
users will get a waring. It will be a man in the middle attack message. It looks scary but if you delete know_hosts from the client they will get a less scary message. I don't know away around a prompt of some sort. – egorgry Mar 23 '11 at 16:29
feedback
up vote 0 down vote

You didn't mention your OS. I can tell you for certain that a RHEL host has the server keys stored in /etc/ssh. Just copy that directory over in its entirety. You'll then need to bounce sshd/restart the box.

I believe that as long as you are connecting via the same DNS name, you shouldn't get warnings. Even with the new IP.


--Christopher Karel

link|improve this answer
Added note about what the OS's are – Daniel Huckstep Mar 23 '11 at 16:14
Then yeah, /etc/ssh is the directory you want. I'd recommend just the ssh_host* keys. Don't move the config files. And you'll want to back up the destination side of things, just to be safe. – Christopher Karel Mar 23 '11 at 19:28
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.