10

Going to be moving a server to new hardware in a new datacenter soon, and of course this means a new IP.

What is the correct process (if at all) to move the SSH keys from the original server to the new one so that connecting clients don't get any warnings or have to accept anything again?

Is it even possible, considering the IP is changing?

What files do I have to move? I'm assuming all of the ssh_host_* files.

Moving from RHEL 5 to Ubuntu 10.04.

3 Answers 3

8

You can move the keys from your current serer to the new server without much hassle. You just need to make sure they go into the same location and have the same permission.

Ideally though, you should take the opportunity to create new keys and update the client keys in the interest of security.

3
  • 2
    I forgot to add that your users may get a warning when they connect to the new host that they already have a host in their knownhosts file which matches the key they are authenticating against. This means they will have to remove the entry in their known hosts file. You can't get around this.
    – Mike
    Commented Mar 23, 2011 at 16:00
  • 1
    So if users might get a warning anyway, is there much of a point in moving the keys? Commented Mar 23, 2011 at 16:16
  • 1
    users will get a waring. It will be a man in the middle attack message. It looks scary but if you delete know_hosts from the client they will get a less scary message. I don't know away around a prompt of some sort.
    – egorgry
    Commented Mar 23, 2011 at 16:29
5

1) If your sshd config files are stored under /etc/ssh/, you'll need to copy all of those. You'll find the sshd config there, as well as the host-keypair.

Make sure you correctly copy the permissions too! The sshd will simply ignore keys that are not properly protected. (Good as well, as an unprotected private key is a very bad idea.)

2) If you have already added public keys of remote hosts that are trusted and don't require a password to log in anymore, you'll also have to copy that info in order for the auto-login to work again now. This info is stored normally in /home/-account-/.ssh/ (under authorized_keys). Again, don't forget the permissions here.


Regarding the IP address change, assuming the remote clients actually see a change in IP (you're not behind some reverse proxy or anything), then no, they will require the user the accept the certificate again. (since in the known_hosts file of the remote client, the server's IP & server's certificate were stored together) Worse, if you assign that IP address to another ssh server, they might even be warned of a man-in-the-middle attack.

So just using the same (external) IP address on the new server makes sense.

0

You didn't mention your OS. I can tell you for certain that a RHEL host has the server keys stored in /etc/ssh. Just copy that directory over in its entirety. You'll then need to bounce sshd/restart the box.

I believe that as long as you are connecting via the same DNS name, you shouldn't get warnings. Even with the new IP.


--Christopher Karel

2
  • Added note about what the OS's are Commented Mar 23, 2011 at 16:14
  • 1
    Then yeah, /etc/ssh is the directory you want. I'd recommend just the ssh_host* keys. Don't move the config files. And you'll want to back up the destination side of things, just to be safe. Commented Mar 23, 2011 at 19:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .