2

I have 3 OpenSSH servers and I want to have only one.

I have created a new server, and migrated all the accounts/data from the other 3 onto the new server.

I now intend to update the DNS records for the 3 existing servers so that they point to the ip address of the new server.

However, when clients who connected to any of the older servers now connect to the new server, they are going to get an error, as the server key in their known hosts file is going to differ from the server key issued by the new server.

I can move the server key from one server to the new server, so that there are no issues with one of the three, but there are still going to be problems with the other two.

I had thought about attached 2 extra ip addresses to the new server, and running 3 separate SSH daemons on it, with different server keys, but I'd really like to avoid this.

Has any one got any other suggestions.

1 Answer 1

2

You can move all the keys from all the servers to the one and modify sshd_config to list all of them (options HostKey). Then the server should offer all the keys.

Also depending on the openssh version (if you are above 6.8), the clients will pick up all the keys when connecting and after some time you might remove the old ones.

3
  • This doesn't appear to work. My local known_hosts file contains references to both the hostname and ip address for a particular server key, so when the connection sees that the ip address has changed for a particular host, it gives a DNS spoofing error. May 26, 2016 at 11:39
  • That was just a guess that it might work. If you have possibility to run three daemons on the server on different interfaces, it will be probably way to go, but with no view of future improvement ( I guess you don't want to run it forever on three IPs). You would better be with generating known host and distributing them to your users.
    – Jakuje
    May 26, 2016 at 11:50
  • I think the issue may be that Version 6.8 is required on both the server and the client. I am bound to Version 6.6 in Amazon Linux blog.djm.net.au/2015/02/key-rotation-in-openssh-68.html May 26, 2016 at 12:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .