0

We are often dropping and re-creating machines on Google Compute Engine to tear up and down testing environments, perform failover tests, etc.

The problem is that GCE is always re-creating the SSH server keys on each new instance that is created from an image or a snapshot.

What is an easy way to have static SSH keys or SSH keys that are readily accept across machines when doing scp or ssh operations?

  • The solution I have in mind kind of reduce security: - use a static key that is copied by a startup script and shared across machines – Elmar Weber Oct 9 '15 at 16:12
1

If you are using your machines only for testing (testing something elste then ssh itself of course) and the security is no issue (closed environment), you can make it part of your install script/kickstart/first boot to pull the keys from somewhere and not generate its own (the way what triggers key generation differ between distributions, but you will find out - RHEL creates them only if they are missing during first service start).

  • Thanks. We're using ubuntu, it behaves the same AFAIK. Any tips on standards for this? Ideally i'm looking for a way to pull the key from a server that generates them in a secure manner, different per system and we can distribute them to all our users on the machines. – Elmar Weber Oct 10 '15 at 18:18
1

If you already have a private key google_compute_engine file in your /home/<username>/.ssh/ directory, then using gcloud compute ssh <target instance> command should not generate a new key. However, if you'll be using a different username or trying to SSH from a newly created VM instance, the gcloud compute ssh command will generate a new private/public key to comply the security requirements.

You can copy the private key to a specific machine or your local computer and always SSH from there. This will eliminate generating new keys.

If this is about SSH Host Key, then you can use -o StrictHostKeyChecking=no option with your ssh command (OpenSSH) to bypass the checking of the host key's authenticity.

  • Sorry, I was talking about the SSHD (server) keys, not user keys. – Elmar Weber Oct 10 '15 at 18:16
  • If this is about SSH Host Key, then you can use -o StrictHostKeyChecking=no option with your ssh command (OpenSSH) to bypass the checking of the host key authenticity. – Kamran Oct 10 '15 at 19:25
  • Thanks, that was also an idea, here I was considering it as a security issue, but probably is not much difference if using static keys that are generated versus just ignoring the checks. – Elmar Weber Oct 12 '15 at 10:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.