Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Secure FTP (FTPS) server that my remote sites to upload files to daily via scripted routines that run. I have had issues in the past when upgrading hardware and deploying new servers causing the RSA Fingerprint to change for that server. Then all my remote sites can't connect until I have the old key removed (usually via ssh_keygen -r myserver.com).

I now have to change the IP address for myserver.com and I wondered if there is anyway to proactively generate new host keys so that when the server address changes all my FTPS client remote sites don't break?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

(I think you mean sftp, not ftps. Ftps has nothing to do with SSH.)

The answer is "no." Think about it from a client's perspective: how can a client trust that they are actually communicating with the correct server rather than a rogue server? If the server was allowed to change IPs (or keys) at will with no complaint from the client then the client would happily connect to a rogue server.

It's inconvenient, but you should coordinate the change in IPs out of band. E.g., a secure email stating "At X time the server's IP will change to Y; you will need to update your client's key store." In reality, that may be too inconvenient so ssh clients offer some configuration options to reduce security. For example, OpenSSH has the option CheckHostIP which, when set to no disables IP checking. Still, it is in the client's hands, not the server's, to decide whether to trust the server or not.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.