Proxmox Host SSH keys - Revision history

Maeve at 18:46, 13 December 2024

2024-12-13T18:46:12Z

@@ Line 1: / Line 1: @@
-Follow these steps to regenerate OpenSSH Host Keys after cloning a Proxmox host.
+Then update certs and keys ''on each machine'':
-    Delete old ssh host keys: rm /etc/ssh/ssh_host_*
+== Manual method<ref>https://forum.proxmox.com/threads/pvecm-updatecert-f-not-working.135812/page-3#post-660500</ref>: ==
-    Reconfigure OpenSSH Server: dpkg-reconfigure openssh-server
+If this fails (which it might), log into each troublesome node through SSHd and copy the public key from
-    Update all ssh client(s) ~/.ssh/known_hosts files
+  /etc/ssh/ssh_host_rsa_key.pub.
+Copy this to
+  /etc/pve/nodes/<node>/ssh_known_hosts
-    pvecm updatecerts -f
+and prepend it with that machine's hostname. Assuming a hostname of pve1, this line should appear as
+  pve1 ssh-rsa <key>
-    ufear said:
+Then restart the SSH daemon:
-    So, if anybody runs into this. I couldn't get updatecerts to add keys for reinstalled nodes to the global /etc/pve/priv/ssh_known_hosts; however the folder /etc/pve/nodes/<nodename> contains a ssh_known_hosts file which contains the content you need; copy it over and the world is good again.
+  systemctl restart sshd

Julian at 00:06, 4 December 2024

2024-12-04T00:06:39Z

← Older revision		Revision as of 00:06, 4 December 2024
Line 1:		Line 1:

	Follow these steps to regenerate OpenSSH Host Keys		Follow these steps to regenerate OpenSSH Host Keys after cloning a Proxmox host.

	Delete old ssh host keys: rm /etc/ssh/ssh_host_*		Delete old ssh host keys: rm /etc/ssh/ssh_host_*

Julian at 00:06, 4 December 2024

2024-12-04T00:06:02Z

← Older revision		Revision as of 00:06, 4 December 2024
Line 1:		Line 1:

			Follow these steps to regenerate OpenSSH Host Keys

			Delete old ssh host keys: rm /etc/ssh/ssh_host_*
			Reconfigure OpenSSH Server: dpkg-reconfigure openssh-server
			Update all ssh client(s) ~/.ssh/known_hosts files


	pvecm updatecerts -f		pvecm updatecerts -f

Julian at 23:52, 3 December 2024

2024-12-03T23:52:20Z

← Older revision		Revision as of 23:52, 3 December 2024
Line 1:		Line 1:

			pvecm updatecerts -f
	~~May 3, 2024~~

	~~Add bookmark~~
	~~#59~~

	ufear said:		ufear said:

Julian: Created page with " May 3, 2024 Add bookmark #59 ufear said: So, if anybody runs into this. I couldn't get updatecerts to add keys for reinstalled nodes to the global /etc/pve/priv/ssh_known_hosts; however the folder /etc/pve/nodes/ contains a ssh_known_hosts file which contains the content you need; copy it over and the world is good again. Your post put me in the right track and it seems I'm able to connect by WebGUI shell from any host to any host in..."

2024-12-03T23:49:06Z

Created page with " May 3, 2024 Add bookmark #59 ufear said: So, if anybody runs into this. I couldn't get updatecerts to add keys for reinstalled nodes to the global /etc/pve/priv/ssh_known_hosts; however the folder /etc/pve/nodes/<nodename> contains a ssh_known_hosts file which contains the content you need; copy it over and the world is good again. Your post put me in the right track and it seems I'm able to connect by WebGUI shell from any host to any host in..."

New page

May 3, 2024

Add bookmark
#59

ufear said:
So, if anybody runs into this. I couldn't get updatecerts to add keys for reinstalled nodes to the global /etc/pve/priv/ssh_known_hosts; however the folder /etc/pve/nodes/<nodename> contains a ssh_known_hosts file which contains the content you need; copy it over and the world is good again.

Your post put me in the right track and it seems I'm able to connect by WebGUI shell from any host to any host in the cluster now.

The problem was that two of my nodes were missing ssh_known_hosts file in
Code:

/etc/pve/nodes/<node>/

(The hosts that gave me KEY CHANGED warning in WebGUI Shell)

I logged in to both troublesome nodes via ssh terminal and copied SSH public key from
Code:

/etc/ssh/ssh_host_rsa_key.pub

to
Code:

/etc/pve/nodes/<node>/ssh_known_hosts

file and added the node hostname in the beginning of the line before RSA public key like so:

Code:

NodeHostname ssh-rsa <the_rsa_pub_key>

after that I restarted SSH service systemctl restart sshd on both nodes (not sure if necessary)

This seems to have worked.