2

I wrote the following systemd unit, in /etc/systemd/system/regen-ssh-keys.service:

[Unit]
Description=OpenSSH Server Key Generation

# Do not run if keys already exist
ConditionPathExistsGlob=!/etc/ssh/ssh_host_*_key

# This service requires rng-tools to feed the random number generator,
# otherwise we may generate predictable keys without noticing it.
Requires=rng-tools.service
After=rng-tools.service

# sshd needs this service to be run and finished before starting
PartOf=sshd.service sshd.socket
Before=sshd.service sshd.socket

[Install]
# sshd needs this service to be run and finished before starting
WantedBy=sshd.service sshd.socket

[Service]
EnvironmentFile=-/etc/sysconfig/sshd
ExecStart=/usr/bin/ssh-keygen -A
Type=oneshot
RemainAfterExit=yes

and I enabled it with systemctl enable regen-ssh-keys.

It is not started at boot or when ssh starts, although service regen-ssh-keys status tells me it is loaded and enabled, and “inactive (dead)”. Also, it is not listed by systemctl -a.

However, when I start it manually with service regen-ssh-keys start, it starts as expected.

Did I do something wrong when writing the unit?

  • What Linux distribution is this? CentOS already has a systemd unit which generates ssh keys, for instance, and it actually works. Try to avoid reinventing the wheel. – Michael Hampton Mar 18 '17 at 22:56
  • Debian Stretch. If you know of an (easier) alternative to this, I would be happy to use it. – Valentin Lorentz Mar 18 '17 at 23:01
  • Eh? Even Debian ought to have such a unit already present. – Michael Hampton Mar 18 '17 at 23:04
  • That's what I thought, but I can't find any doc mentioning it – Valentin Lorentz Mar 18 '17 at 23:05
  • I suggest that you go looking for it. The openssh server would not come up at all if the keys had not already been generated, which means something already on the system must have done so. – Michael Hampton Mar 18 '17 at 23:07
1

The mistake was simply that I did not use the right names for the SSH service. Replacing sshd.service sshd.socket by ssh.service ssh.socket fixed the issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.