4 ms·
Part of the problem is also that ssh has host key rotation support but openssh client has it turned off by default
by SuperSandro2000 4y ago
Part of the problem is also that ssh has host key rotation support but openssh client has it turned off by default
- lxgr 4y agoAt least on macOS and Debian it is on by default: > UpdateHostKeys is enabled by default if the user has not overridden the default UserKnownHostsFile setting and has not enabled VerifyHostKeyDNS, otherwise UpdateHostKeys will be set to no. It's not that useful for actual key rotations, though; the use case seems to be more geared towards switching to newer key types (e.g. adding an Ed25529 key seamlessly) than replacing a potentially compromised key. At least I couldn't find a straightforward way for the OpenSSH sshd to actually provide two keys of the same type to my client. All in all, I‘m not a fan of the feature – it seems to complicate key security for pretty marginal benefits. That said, it did auto-upgrade the Github key for me as far as I can tell!