openssh unix dev - Feb 2023 - ssh host keys on cloned virtual machines

One solution I used was simply scripting the deletion of the host key after
cloning it.
Another solution is to delete them in the golden image you create (which could
be a different scenario from cloning whatever machine you need)
Both approaches worked well enough except when they didn?t.

It would be great to be able to specify path to hostkey including some sort of
$hostname variable, so it would be regenerated if hostname changes, but that is
probably better solved in a startup script. Maybe modifying it to create a
symlink from the hostkey to a filename including hostname? I wonder how fragile
that would be and if something like that already exists. Not sure if MAC or
hostname are the right distinguishing parameters, though, maybe something like
dmidecode UUID?

Jan

> On 24. 2. 2023, at 12:58, Keine Eile <keine-eile at e-mail.de> wrote:
> 
> Hi list members,
> 
> does any one of you have a best practice on renewing ssh host keys on
cloned machines?
> I have a customer who never thought about that, while cloning all VMs from
one template. Now all machines have the exact same host key.
> My approach would be to store a machines MAC address(es). Then when
starting the sshd.service, check if this MAC has changed. If so, remove all host
keys, let sshd create new ones.
> 
> Thanks for any thoughts and comments about that.
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
>
https://www.google.com/url?q=https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev&source=gmail-imap&ust=1677844875000000&usg=AOvVaw1wDCGYuQ4a5KUjpWj0GLtO

Am 24.02.23 um 13:11 schrieb Jan Schermer:
> One solution I used was simply scripting the deletion of the host key after
cloning it.
> Another solution is to delete them in the golden image you create (which
could be a different scenario from cloning whatever machine you need)
The golden image can not have a hard wired magic which generates new host keys,
as it is maintained from time to time using ssh.
> Both approaches worked well enough except when they didn?t.
I think, I have seen this, too.
  
> It would be great to be able to specify path to hostkey including some sort
of $hostname variable, so it would be regenerated if hostname changes, but that
is probably better solved in a startup script. Maybe modifying it to create a
symlink from the hostkey to a filename including hostname? I wonder how fragile
that would be and if something like that already exists. Not sure if MAC or
hostname are the right distinguishing parameters, though, maybe something like
dmidecode UUID?
The MAC is my weapon of choice, because no matter what virtualization you have,
this will (in a sense, it hast to) change. Changing the hostname comes with the
Ansible stuff, but this is already too late.
> Jan
Thanks Jan.