Re: Hostkeys for Interfaces?

Monani, Jignesh Vasantbhai (Jignesh Vasantbhai)** CTR ** wrote:

> I thought by default SSH uses rsa host keys irrespective of order of files
> in /etc/ssh/sshd_config file. We comment rsa key for sshd to use only dsa
> host key. Is there any way to change priority of type of keys ?
>
> - Jignesh
> [SNIP]
>  
Please check OpenSSH options
   HostKeyAlgorithms
            Specifies the protocol version 2 host key algorithms that the
            client wants to use in order of preference.  The default 
for this
            option is: ``ssh-rsa,ssh-dss''.

===================================================
Let .../sshd_config contain two rsa keys from type "ssh-rsa" and one 
from type "ssh-dss":
...
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_rsa_key2
HostKey /etc/ssh/ssh_host_dsa_key
...

try to connect with command
 ssh -o HostKeyAlgorithms ssh-rsa ...

Let later to change only order of rsa keys in sshd_config. i.e.:
...
HostKey /etc/ssh/ssh_host_rsa_key2
HostKey /etc/ssh/ssh_host_rsa_key
...
and to repeat test:
 ssh -o HostKeyAlgorithms ssh-rsa ...

The test show that sshd use first listed in sshd_config from type "ssh-rsa".

As example OpenSSH client can request dsa host key with command
 ssh -o HostKeyAlgorithms ssh-dss ...


Regards,
Roumen Petrov

--
Get X.509 certificates support in OpenSSH:
http://roumenpetrov.info/openssh/