Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Going to be moving a server to new hardware in a new datacenter soon, and of course this means a new IP.

What is the correct process (if at all) to move the SSH keys from the original server to the new one so that connecting clients don't get any warnings or have to accept anything again?

Is it even possible, considering the IP is changing?

What files do I have to move? I'm assuming all of the ssh_host_* files.

Moving from RHEL 5 to Ubuntu 10.04.

share|improve this question

3 Answers 3

up vote 4 down vote accepted

You can move the keys from your current serer to the new server without much hassle. You just need to make sure they go into the same location and have the same permission.

Ideally though, you should take the opportunity to create new keys and update the client keys in the interest of security.

share|improve this answer
2  
I forgot to add that your users may get a warning when they connect to the new host that they already have a host in their knownhosts file which matches the key they are authenticating against. This means they will have to remove the entry in their known hosts file. You can't get around this. –  Mike Mar 23 '11 at 16:00
1  
So if users might get a warning anyway, is there much of a point in moving the keys? –  Daniel Huckstep Mar 23 '11 at 16:16
1  
users will get a waring. It will be a man in the middle attack message. It looks scary but if you delete know_hosts from the client they will get a less scary message. I don't know away around a prompt of some sort. –  egorgry Mar 23 '11 at 16:29

1) If your sshd config files are stored under /etc/ssh/, you'll need to copy all of those. You'll find the sshd config there, as well as the host-keypair.

Make sure you correctly copy the permissions too! The sshd will simply ignore keys that are not properly protected. (Good as well, as an unprotected private key is a very bad idea.)

2) If you have already added public keys of remote hosts that are trusted and don't require a password to log in anymore, you'll also have to copy that info in order for the auto-login to work again now. This info is stored normally in /home/-account-/.ssh/ (under authorized_keys). Again, don't forget the permissions here.


Regarding the IP address change, assuming the remote clients actually see a change in IP (you're not behind some reverse proxy or anything), then no, they will require the user the accept the certificate again. (since in the known_hosts file of the remote client, the server's IP & server's certificate were stored together) Worse, if you assign that IP address to another ssh server, they might even be warned of a man-in-the-middle attack.

So just using the same (external) IP address on the new server makes sense.

share|improve this answer

You didn't mention your OS. I can tell you for certain that a RHEL host has the server keys stored in /etc/ssh. Just copy that directory over in its entirety. You'll then need to bounce sshd/restart the box.

I believe that as long as you are connecting via the same DNS name, you shouldn't get warnings. Even with the new IP.


--Christopher Karel

share|improve this answer
    
Added note about what the OS's are –  Daniel Huckstep Mar 23 '11 at 16:14
    
Then yeah, /etc/ssh is the directory you want. I'd recommend just the ssh_host* keys. Don't move the config files. And you'll want to back up the destination side of things, just to be safe. –  Christopher Karel Mar 23 '11 at 19:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.