SSH Host Key Management - Revision history

DrEdWilliams at 23:45, 30 November 2020

2020-11-30T23:45:45Z

← Older revision		Revision as of 23:45, 30 November 2020
Line 49:		Line 49:
	curl -s http://config/config/hosts -o /etc/hosts		curl -s http://config/config/hosts -o /etc/hosts
	fi</pre>		fi</pre>

			== Usage ==
			With the '''host_update''' script in place in a central host (aslan currently) and the '''host_check''' script installed in each host, any change to the master '''hosts''' file will get propagated within two hours (depending on the synchronization between the hourly cron jobs on each host). For the two use cases, these procedures must be followed for this propagation to occur:

			; New Host
			: Simply add a new line to the master '''hosts''' file and either wait for the updates to occur or manually regenerate the '''known_hosts''' file by issuing the command:
			: <pre>sudo ./host_update.sh -f</pre>
			; Reinstall host with new host keys
			: Since the automated update is triggered on the modified date of the master '''hosts''' file, you can '''touch''' the file to update the modification date and the update will be triggered. You can also force the update as above.

			There is no way to manually trigger the propagation to all the other hosts; but if one particular host is needed, log into the host from ''another'' system and issue the command:
			sudo /etc/cron.hourly/host_check

			That will force the update for the host that is needed immediately; the other will catch up when the cron job runs.

DrEdWilliams at 23:32, 30 November 2020

2020-11-30T23:32:21Z

@@ Line 1: / Line 1: @@
 Aside from the SSH authentication keys for users and root which must be distributed to a new system, the one item that is key to providing a unified operating environment is the '''known_hosts''' file located in each user's .ssh directory.  This must be maintained with the host keys for all current hosts -- both by hostname and by IP address -- in order that automated access between hosts is possible.
-Currently, aslan runs a job that uses the master '''hosts''' file located at http://config/config/hosts as input to the '''ssh-keyscan''' program to retrieve the host keys for all systems and put them in http://config/config/ssh/known_hosts.
+== Updating 'known_hosts' ==
 Whenever a new system is added to the environment, its hostname and all its IP addresses must be added to the master '''hosts''' file.  Each system should (either automatically or on-demand) retrieve the '''hosts''' and '''known_hosts''' file using commands such as:
@@ Line 10: / Line 36: @@
 When a system is rebuilt with new keys, that system will have issues until the new host keys propagate:  all systems will see that it has a new host key and SSH will not allow connections to be made.  Until the update job runs, individual '''known_hosts''' files can be updated, but the automated process will overwrite any changes the next time it runs.

DrEdWilliams: Created page with "Aside from the SSH authentication keys for users and root which must be distributed to a new system, the one item that is key to providing a unified operating environment is t..."

2020-11-30T02:20:44Z

Created page with "Aside from the SSH authentication keys for users and root which must be distributed to a new system, the one item that is key to providing a unified operating environment is t..."

New page

Aside from the SSH authentication keys for users and root which must be distributed to a new system, the one item that is key to providing a unified operating environment is the '''known_hosts''' file located in each user's .ssh directory. This must be maintained with the host keys for all current hosts -- both by hostname and by IP address -- in order that automated access between hosts is possible.

Currently, aslan runs a job that uses the master '''hosts''' file located at http://config/config/hosts as input to the '''ssh-keyscan''' program to retrieve the host keys for all systems and put them in http://config/config/ssh/known_hosts.

Whenever a new system is added to the environment, its hostname and all its IP addresses must be added to the master '''hosts''' file. Each system should (either automatically or on-demand) retrieve the '''hosts''' and '''known_hosts''' file using commands such as:

curl -s http://config/config/ssh/known_hosts -o $HOME/.ssh/known_hosts
sudo curl -s http://config/config/ssh/known_hosts -o /root/.ssh/known_hosts
sudo curl -s http://config/config/hosts -o /etc/hosts

When a system is rebuilt with new keys, that system will have issues until the new host keys propagate: all systems will see that it has a new host key and SSH will not allow connections to be made. Until the update job runs, individual '''known_hosts''' files can be updated, but the automated process will overwrite any changes the next time it runs.