How to migrate ssh key to new CentOS server?

Question

We have lots of scripts that run over ssh through saved (passwordless) key pairs. Both clients and servers are CentOS 6.x.I know that if you get a new client computer (where the scripts are run from), you can just copy the ~/.ssh/known_hosts from the old computer to the new one.

But if I am replacing the server that that workstation connects to, what do I copy to preserve the key pair? I tried copying the contents of /etc/ssh. After I did this, I no longer got the "the key has changed" refusal to connect on the client, but I still had to enter the password.

I've googled this and can't find much. What am I doing wrong?

Answer 1

When you create a private key it also creates a matching public key.

The idea behind the private/public key-pair is that you keep your private key secure (don't send it over the network, Internet, or even allow other users to read it).

The public key is what you store on the server you want to connect to.

So when you connect to a sever via ssh you provide your private key and a user on the server to log in as, like so: ssh -i ~/.ssh/path/to/your/private/key user@server

On the server you store your public key(s), here: /home/user/.ssh/authorized_keys

You can copy the contents of the servers authorized_keys file to another server, it's just a file with text in it (each line corresponds to one public key).

Answer 2

The SSH keys are stored in ~/.ssh/authorized_keys

You should be able to transfer this file from the old server to the new server to resolve your problem.

Answer 3

ssh-copy-id -i .ssh/key.pub user@server should do the trick.

Answer 4

Ensure your key.pub exists in .ssh/authorized_keys for the user that you're trying to Authenticate as.

You can do this by running this:

key=$(cat ~/.ssh/key.pub)
ssh user@host "cat ~/.ssh/authorized_keys" |grep $key

If you see any Grep Usage errors make sure your key.pub path is correct and that it exists. If it doesn't you can create one:

ssh-keygen -b 4096 -t rsa -f ~/.ssh/key

If you see No such file or directory for your authorized keys file then it does not exist and you will want to create it.

If it is not there you can copy it there by running this command:

cat ~/.ssh/key.pub | ssh user@host "cat >> ~/.ssh/authorized_keys"

Once you have this working it is good practice to disable password authentication in /etc/ssh/sshd_conf

Example parameter changes /etc/ssh/sshd_config:

RSAAuthentication yes
PubkeyAuthentication yes
PasswordAuthentication no
ChallengeResponseAuthentication no

For more information on securing SSH on CentOS please see Securing OpenSSH on the CentOS wiki.