[CentOS-virt] server host keys for kvm clones
mail-lists at karan.org
Thu Jan 5 10:09:23 EST 2012
On 01/04/2012 08:14 PM, Ed Heron wrote:
> Is there a process for pre-generating keys so these keys
> and .ssh/known_hosts can be pre-filled for all users/hosts?
yes there is..
look at the sshd initscript, and poke the do_*_keygen functions; they
will tell you exactly what happens when those keys are auto-build on
first boot, or when someone removes them.
I use config-management tools in the kickstart %post to drop in
pre-built keys, that also means my management infrastructure already
knows what key-signature to expect on a remote machine when it boots for
the first time and I can do some level of trust management based on
that. Keep in mind that you need to have your provisioning happen in a
fairly secure environment itself, if you are going to add trust points
on signatures like this - specially if they are 'generated' on demand.
+44-207-0999389 | http://www.karan.org/ | twitter.com/kbsingh
ICQ: 2522219 | Yahoo IM: z00dax | Gtalk: z00dax
GnuPG Key : http://www.karan.org/publickey.asc
More information about the CentOS-virt