| Summary: | Set UpdateHostKeys for interactive sessions to 'ask' (or consider defaulting to 'yes') | ||
|---|---|---|---|
| Product: | Portable OpenSSH | Reporter: | db+mindrot |
| Component: | ssh | Assignee: | Assigned to nobody <unassigned-bugs> |
| Status: | CLOSED FIXED | ||
| Severity: | enhancement | CC: | cjwatson, djm, jjelen |
| Priority: | P5 | ||
| Version: | 7.7p1 | ||
| Hardware: | Other | ||
| OS: | Other | ||
| Bug Depends on: | 2738 | ||
| Bug Blocks: | 3302 | ||
|
Description
db+mindrot
2018-08-11 22:08:05 AEST
I ran into this recently when trying to work out how we might do host key rotation on a large SSH server. This is a code hosting site to which you can push code over SSH, usable by anyone who's given us a public key rather than limited to a single organisation, so we can't mandate any particular client setup and the host key certificate mechanisms don't really work all that well for us either. Life would be a lot easier in this kind of environment if UpdateHostKeys were on in some way by default. (We'd actually probably need it to have been on by default for a few years, and something similar to be in some other popular clients too, but you have to start somewhere.) (Sorry, I submitted the last comment by accident before I'd finished writing it ...) Is there an explanation somewhere for why UpdateHostKeys is off? The best I could find was a git commit from 2015 saying "turn UpdateHostkeys off by default until I figure out mlarkin@'s warning message". And I wonder if https://bugzilla.mindrot.org/show_bug.cgi?id=2631 would also need to be fixed in order to use this in practice? IIRC there might be some corner cases wrt multiple keys files. It was a bit fiddly IIRC Committed; will be in openssh-8.2 I've had to revert this change. It doesn't play well with certificate host keys and I'm unsure of the interaction with @revoked lines in known_hosts. Both these need to be fixed before it gets enabled again. I plan to do this early in the 8.3 release cycle to give it as long as possible to bake. Prepare for 8.2 release; retarget bugs Retarget bugs to 8.4 release retarget to 8.6 AFAIK this was addressed in OpenSSH 8.5p1 https://www.openssh.com/txt/release-8.5 retarget after 8.6p1 release The last release enabled UpdateHostkeys by default under most circumstances closing bugs resolved before openssh-8.9 |