On 01/04/2012 08:14 PM, Ed Heron wrote:
Is there a process for pre-generating keys so these keys and .ssh/known_hosts can be pre-filled for all users/hosts?
yes there is..
look at the sshd initscript, and poke the do_*_keygen functions; they will tell you exactly what happens when those keys are auto-build on first boot, or when someone removes them.
I use config-management tools in the kickstart %post to drop in pre-built keys, that also means my management infrastructure already knows what key-signature to expect on a remote machine when it boots for the first time and I can do some level of trust management based on that. Keep in mind that you need to have your provisioning happen in a fairly secure environment itself, if you are going to add trust points on signatures like this - specially if they are 'generated' on demand.