ssh host keys self update

[4554551n]

Hi,

I tried to log into my unraid (6.9.2) via ssh today and discovered that the host keys had changed, which freaked me out a bit.
I took a look and it looks like they were recreated 4 days ago, which coincides with a reboot.
However, rebooting again, they keys didn't change. I've also had the server for coming on 4 years and this is the first time this has happened.

 

I am a little concerned there may have been a breach or something, but the fact that it coincides with a reboot is helping me chill a little.

Could someone please let me know why they keys would have updated and how I can stop it happening in the future.

[4554551n]

Does anyone have any insight into this?

[ChatNoir]

Maybe @ljm42 have some insight on this ?

[trurl]

Is your server accessible from outside your LAN? If so, how?

[4554551n]

Not easily.
I've got the swag container reverse proxy pointing to a nextcloud container, and ssh through a jumphost which hasn't been on for a couple of months.
The timing coincides with a reboot, so maybe it did something funky and recreated the keys? Though rebooting since doesn't cause a problem.

I did find this:?
```

root@[unraid]:~# cat /etc/rc.d/rc.sshd
#!/bin/sh
# Start/stop/restart the secure shell server:

sshd_start() {
  # make sure ssh dir exists on flash
  mkdir -p /boot/config/ssh

  # restore saved keys, config file, etc. (but not subdirs)
  cp /boot/config/ssh/* /etc/ssh &>/dev/null
  chmod 600 /etc/ssh/* &>/dev/null

  # Create host keys if needed and copy any newly generated key(s) back to flash
  ssh-keygen -A
  cp -n /etc/ssh/ssh_host*_key* /boot/config/ssh/

  /usr/sbin/sshd
}
```
So... things didn't copy from boot properly maybe?

Edited September 27, 2021 by 4554551n

[4554551n]

Sad self bump?

[Squid]

You might want to look at this https://wiki.unraid.net/Manual/Release_Notes/Unraid_OS_6.9.0#SSH_Improvements

[ken-ji]

On 9/27/2021 at 9:50 PM, 4554551n said:

Not easily.
I've got the swag container reverse proxy pointing to a nextcloud container, and ssh through a jumphost which hasn't been on for a couple of months.
The timing coincides with a reboot, so maybe it did something funky and recreated the keys? Though rebooting since doesn't cause a problem.

I did find this:?
```

root@[unraid]:~# cat /etc/rc.d/rc.sshd
#!/bin/sh
# Start/stop/restart the secure shell server:

sshd_start() {
  # make sure ssh dir exists on flash
  mkdir -p /boot/config/ssh

  # restore saved keys, config file, etc. (but not subdirs)
  cp /boot/config/ssh/* /etc/ssh &>/dev/null
  chmod 600 /etc/ssh/* &>/dev/null

  # Create host keys if needed and copy any newly generated key(s) back to flash
  ssh-keygen -A
  cp -n /etc/ssh/ssh_host*_key* /boot/config/ssh/

  /usr/sbin/sshd
}
```
So... things didn't copy from boot properly maybe?

Could also be some file corruption on your USB stick, where the SSH host keys became 0-byte files or were deleted

not copying from /boot during boot is usually an indicator of possible issues with the USB though