0

We are often dropping and re-creating machines on Google Compute Engine to tear up and down testing environments, perform failover tests, etc.

The problem is that GCE is always re-creating the SSH server keys on each new instance that is created from an image or a snapshot.

What is an easy way to have static SSH keys or SSH keys that are readily accept across machines when doing scp or ssh operations?

Improve this question
1
  • The solution I have in mind kind of reduce security: - use a static key that is copied by a startup script and shared across machines
    – Elmar Weber
    Oct 9, 2015 at 16:12

2 Answers 2

Reset to default
1

If you are using your machines only for testing (testing something elste then ssh itself of course) and the security is no issue (closed environment), you can make it part of your install script/kickstart/first boot to pull the keys from somewhere and not generate its own (the way what triggers key generation differ between distributions, but you will find out - RHEL creates them only if they are missing during first service start).

Improve this answer
1
  • Thanks. We're using ubuntu, it behaves the same AFAIK. Any tips on standards for this? Ideally i'm looking for a way to pull the key from a server that generates them in a secure manner, different per system and we can distribute them to all our users on the machines.
    – Elmar Weber
    Oct 10, 2015 at 18:18
1

If you already have a private key google_compute_engine file in your /home/<username>/.ssh/ directory, then using gcloud compute ssh <target instance> command should not generate a new key. However, if you'll be using a different username or trying to SSH from a newly created VM instance, the gcloud compute ssh command will generate a new private/public key to comply the security requirements.

You can copy the private key to a specific machine or your local computer and always SSH from there. This will eliminate generating new keys.

If this is about SSH Host Key, then you can use -o StrictHostKeyChecking=no option with your ssh command (OpenSSH) to bypass the checking of the host key's authenticity.

Improve this answer
3
  • Sorry, I was talking about the SSHD (server) keys, not user keys.
    – Elmar Weber
    Oct 10, 2015 at 18:16
  • If this is about SSH Host Key, then you can use -o StrictHostKeyChecking=no option with your ssh command (OpenSSH) to bypass the checking of the host key authenticity.
    – Kamran
    Oct 10, 2015 at 19:25
  • Thanks, that was also an idea, here I was considering it as a security issue, but probably is not much difference if using static keys that are generated versus just ignoring the checks.
    – Elmar Weber
    Oct 12, 2015 at 10:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .