In a word yes that is insecure having all hosts with an identical key.
You do not know who is who so to speak. See the man of ssh-keygen
This cut and paste...
Normally each user wishing to use SSH with RSA or DSA authentication
runs this once to create the authentication key in $HOME/.ssh/identity,
$HOME/.ssh/id_dsa or $HOME/.ssh/id_rsa. Additionally, the system
admin-istrator may use this to generate host keys, as seen in /etc/rc.
Normally this program generates the key and asks for a file in
which to store the private key. The public key is stored in a file with
the same name but ``.pub'' appended. The program also asks for a
passphrase. The passphrase may be empty to indicate no passphrase (host
keys must have an empty passphrase), or it may be a string of arbitrary
length. A passphrase is similar to a password, except it can be a
phrase with a series of words, punctuation, numbers, whitespace, or any
string of characters you want. Good passphrases are 10-30 characters
long, are not simple sentences or otherwise easily guessable (English
prose has only 1-2 bits of entropy per character, and provides very bad
passphrases), and contain a mix of upper and lowercase letters, numbers,
and non-alphanumeric characters. The passphrase can be changed later by
using the -p option.
See also this Linux /etc/init.d/sshd startup script snip:
do_rsa1_keygen() {
echo -n $"Generating SSH1 RSA host key: "
success $"RSA1 key generation"
failure $"RSA1 key generation"
do_rsa_keygen() {
echo -n $"Generating SSH2 RSA host key: "
success $"RSA key generation"
failure $"RSA key generation"
do_dsa_keygen() {
echo -n $"Generating SSH2 DSA host key: "
success $"DSA key generation"
failure $"DSA key generation"
failure $"Configuration file or keys are invalid"
# Create keys if necessary
do_rsa1_keygen
do_rsa_keygen
do_dsa_keygen
Do as you wish, they aer your servers. I want mine to each have their
own key. I am sure there can be arguments for why you would want the
same key on multiple servers.
--Leif
Ugo Bellavance wrote:
Hi,
I just cloned a server to save install time, but now I realize that
the ssh host key is the same for every server. That makes sense since I
cloned them, but I was wondering if that was insecure, and how to
regenerate them.
Thanks,
Ugo
