Home / server / Questions / 424363
Accepted
David George
Asked: 2012-09-05 15:29:33 +0800 CST

FTPS SSH Host Key after IP Address Change

  • 772

I have a Secure FTP (FTPS) server that my remote sites to upload files to daily via scripted routines that run. I have had issues in the past when upgrading hardware and deploying new servers causing the RSA Fingerprint to change for that server. Then all my remote sites can't connect until I have the old key removed (usually via ssh_keygen -r myserver.com).

I now have to change the IP address for myserver.com and I wondered if there is anyway to proactively generate new host keys so that when the server address changes all my FTPS client remote sites don't break?

linux

1 Answers

  1. Best Answer

    (I think you mean sftp, not ftps. Ftps has nothing to do with SSH.)

    The answer is "no." Think about it from a client's perspective: how can a client trust that they are actually communicating with the correct server rather than a rogue server? If the server was allowed to change IPs (or keys) at will with no complaint from the client then the client would happily connect to a rogue server.

    It's inconvenient, but you should coordinate the change in IPs out of band. E.g., a secure email stating "At X time the server's IP will change to Y; you will need to update your client's key store." In reality, that may be too inconvenient so ssh clients offer some configuration options to reduce security. For example, OpenSSH has the option CheckHostIP which, when set to no disables IP checking. Still, it is in the client's hands, not the server's, to decide whether to trust the server or not.

    • 1