[CentOS-virt] server host keys for kvm clones

[Karanbir Singh]

On 01/04/2012 08:14 PM, Ed Heron wrote:
>   Is there a process for pre-generating keys so these keys
> and .ssh/known_hosts can be pre-filled for all users/hosts?

yes there is..

look at the sshd initscript, and poke the do_*_keygen functions; they
will tell you exactly what happens when those keys are auto-build on
first boot, or when someone removes them.

I use config-management tools in the kickstart %post to drop in
pre-built keys, that also means my management infrastructure already
knows what key-signature to expect on a remote machine when it boots for
the first time and I can do some level of trust management based on
that. Keep in mind that you need to have your provisioning happen in a
fairly secure environment itself, if you are going to add trust points
on signatures like this - specially if they are 'generated' on demand.

-- 
Karanbir Singh
+44-207-0999389 | http://www.karan.org/ | twitter.com/kbsingh
ICQ: 2522219    | Yahoo IM: z00dax      | Gtalk: z00dax
GnuPG Key : http://www.karan.org/publickey.asc