Ssh key pair - supposed to prevent root access

Originally Posted by ttpp Thanks. I don't want to edit it. I wanted to look at it as I thought someone said that it contained IP addresses, so I am curious to see what the file looks like. "sudo more .ssh/host_rsa_key" or "sudo more .ssh/host_rsa" ----- I'll try them. Tried it in terminal, didn't work.

According to your last post, the name of the file is ssh_host_dsa_key.text — or, if that was just a copy, ssh_host_dsa_key

Originally Posted by ttpp "sudo more .ssh/host_rsa_key" or "sudo more .ssh/host_rsa" ----- I'll try them. Tried it in terminal, didn't work.

You can just use cat, they're not all that long.
That said, the "private" key just is a stream of seemingly random characters between the -----BEGIN and -----END lines, there is no user meaningful info there.
The public key is a bit more informational as it's meant to be shared:
it starts with the cipher (ssh-rsa, ssh-dsa or so), then the actual key and at the end the user@host of the system it's supposed to be used against.

Originally Posted by ttpp Thanks. I'm trying to open, in terminal, the file: "ssh_host_dsa_key" using "sudo xdg-open ssh_host_dsa_key" and keep getting ""Unable to detect the URI-scheme of "ssh_host_dsa_key"" My guess is that it needs a file extension.....? Thx.

Linux does not, in general, use file extensions. Ever, really, except for certain things it needs the sysadm to pick out at a glance (like .conf). Some programs recognize certain file extensions, but they are really only used by humans to recognize file types. People very familiar with the Linux way use the 'file' command to determine a file type, but even that is not needed here. The file type is TEXT and it is human readable. The command line

cat ssh_host_dsa_key

will dump it to the terminal so that you can read it.

Originally Posted by wpeckham Linux does not, in general, use file extensions. Ever, really, except for certain things it needs the sysadm to pick out at a glance (like .conf). Some programs recognize certain file extensions, but they are really only used by humans to recognize file types. People very familiar with the Linux way use the 'file' command to determine a file type, but even that is not needed here. The file type is TEXT and it is human readable. The command line cat ssh_host_dsa_key will dump it to the terminal so that you can read it.

Thank you. Is there an article or something you could point me to for creating new (4) host files? I think I was told that one or all of the host files are used to identify my computer on the web, regardless, I know that someone said that with the private host keys that they could launch MITM attacks.

Since someone may have been on my computer when I was in root, I would like to replace them with new host files. If not all of the host files can be used to identify me on the web, private host files, please let me know as there may not be a good reason to replace them. Thanks.

Originally Posted by ttpp Thank you. Is there an article or something you could point me to for creating new (4) host files? I think I was told that one or all of the host files are used to identify my computer on the web, regardless, I know that someone said that with the private host keys that they could launch MITM attacks. Since someone may have been on my computer when I was in root, I would like to replace them with new host files. If not all of the host files can be used to identify me on the web, private host files, please let me know as there may not be a good reason to replace them. Thanks.

Well, host files do not identify the person, only the host machine originating the connection. That said, if you want to understand using, creating, and identifying the files I would start with the info or man pages for sshd (and, to some extent, ssh).

While not intended to be instructive, the documentation provided by the maintainers as info or man pages is almost always a good place to look first. Answering such questions about the product and using it is why those pages are built and maintained. If they do not answer all of your questions, they do provide you with enough information to prompt your search terms for google, duckduckgo, or other search engines to find tutorials or other online discussion of the topics of interest to you.

Originally Posted by wpeckham Well, host files do not identify the person, only the host machine originating the connection. That said, if you want to understand using, creating, and identifying the files I would start with the info or man pages for sshd (and, to some extent, ssh). While not intended to be instructive, the documentation provided by the maintainers as info or man pages is almost always a good place to look first. Answering such questions about the product and using it is why those pages are built and maintained. If they do not answer all of your questions, they do provide you with enough information to prompt your search terms for google, duckduckgo, or other search engines to find tutorials or other online discussion of the topics of interest to you.

Thanks. I'll give the man pages a look.

Originally Posted by ttpp Thanks. I don't want to edit it. I wanted to look at it as I thought someone said that it contained IP addresses, so I am curious to see what the file looks like. "sudo more .ssh/host_rsa_key" or "sudo more .ssh/host_rsa" ----- I'll try them. Tried it in terminal, didn't work.

It would not be in them files anyways, they only contain the key where you will find an ip if it puts it there is in the known_hosts file. On my Debian system it does not put them in there on my Mac it does put the IP associated with the login.

MacUser2525:~$ haswell
Linux haswell 4.9.0-9-amd64 #1 SMP Debian 4.9.168-1+deb9u3 (2019-06-16) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Wed Jul 10 22:50:30 2019 from 192.168.0.3
seeder1@haswell:~$ cat .ssh/known_hosts 
|1|fE4QtF7r64JOdqo6iTKctlpZ7+I=|o2ZnrFx0aW3mA/a4oEh58BeUKbE= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBAWqgf65MjC7kXwbvAR7kzg1CJjLVg2IF7j5IIOi6bZHP6pe2zKzwM6df//d6Gdl8uwni2ZMFn7MLp+J6ED8hDA=
|1|i0NhLgqxOE7wlqiYLpD41zOXi5w=|8OEKCuV2ZiapE9z/U6SIdnnO7F4= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBM6OpjR8XZfsY+Woc1tT/tPhmx7PaqucFXVAE+njccOvh4J9VUz0JUFOCj+5zwdmzxMqJ9dh+dWUCq+ghLYDFUw=

From my Mac.

MacUser2525:~$ cat .ssh/known_hosts 
192.168.0.102 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCvDHkR0b4mcFhdH0On/vlJmoDnyiij4IGcPzlr5pto9AhG+9vRTI1iZHKfrMmGGD78Ws0y2AGGEJ0BX4Qq3DbuKeOL1m2Afh4p6EpPQ1ZX7f/NiV5ZfYHM8tHJn+SDExEAG4h5LYaV0QA/LK/c9kv2hTmUukwbhrnkW/6GuP6WNzh61dY/TCsyaCd2z4+j20XHvCjdUgAghoOC3m1KlVnkhnTK9HC6A1oI8DNP40BB2ba/Ens1iPFfcYXSPMaPxE5xEVblWU9JHRVvJThFPS/N5w6Y8nk6GQitH3BaXCgyczyiysQUw0Y/FVU6gdCAruH59+qGZa7FH94nMyRaIN/p
192.168.0.106 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCVuzZcsg2pcsh1/kO+tKP5IsFgUcHs9wmnDhyv1U9KUACmPWEzH8tiNs1ulUMroHyWOVpINfXYxg49CWmsnNwTAAlvEUW7gRYVxgmkGaP3N3iVVGblco24sEZKmwLOZXU6CHhqkzyhNC3d5O0pkbtISumk3x4z9+/GhCx7FjxgwMQ4JTjPmkAkaiPUcjjHHm+slC69gKRsYps75WiSstRJzaRJ/yMkWkOo03duIDy2ANNftMr7op+dD6xNhYVHrlPYgQZ1LsLGJyc0kyVxmzBE24SToJ0qCjj0XkuueqN8HOmv+5nmzgh3d/EqpC9qWfyn3fKBFbtJqU7ph0XzG4Dn

Oh and if you use the proper name for the file in terminal then it shows you no problem the contents of the file no sudo is needed you as the user who generated the file have all the permissions necessary to do anything you wish with it..

seeder1@haswell:~$ more .ssh/id_rsa
-----BEGIN RSA PRIVATE KEY-----
MIIEogIBAAKCAQEA6j7GTSXaSXUGRtO/4yRAh7WVGBWyFOwH+UJNXGodpG+OM3VU
M3XaSCZfCcuP/WiokrJ/dr04p1D2BPl2EzU9c030mMBid23bkBWk6HkT9fRibxW0
ntvmviVmWc6R2vqDITr0SfW1vmla51Tp2ZDV9/n+SnilLkQhesWU9Bdn5p7Cc2yf
im3ESgRAcYT0pnsVoC/E5/W+SmyI2iYOa/fRFcnccfx4KiTLjZJWtB2dE+lyuHVq
7mDiajSdnxu5aVkAxEIf2eoyByQJ4KN92Wj5z2litwJtBwx1w9ozsRc8UyK5CQGr
mjarOOTbDynpQmdi/vwuu6Byd3SGWUxneXS/AQIBIwKCAQEAtLQVUXT42ZTKU+Ut
oJhPCZq02BC8k8wGJq99gc40H8PFeCdPlWmLIbczX1PkG0IbpF3QCyRBpaTbCybX
bec+CH33NAIgEvz51Y0KL63cMsPW5/rNKhdaOummuk7li6tPNuRWDStDDztUwRWe

[snip ...]

seeder1@haswell:~$ ls -l .ssh/
total 16
-rw-r--r-- 1 seeder1 seeder1 1203 Apr 27  2018 authorized_keys
-rw------- 1 seeder1 seeder1 1675 Apr 27  2018 id_rsa
-rw-r--r-- 1 seeder1 seeder1  381 Apr 27  2018 id_rsa.pub
-rw-r--r-- 1 seeder1 seeder1  444 Jul  8 21:24 known_hosts

Originally Posted by wpeckham Well, host files do not identify the person, only the host machine originating the connection. That said, if you want to understand using, creating, and identifying the files I would start with the info or man pages for sshd (and, to some extent, ssh). While not intended to be instructive, the documentation provided by the maintainers as info or man pages is almost always a good place to look first. Answering such questions about the product and using it is why those pages are built and maintained. If they do not answer all of your questions, they do provide you with enough information to prompt your search terms for google, duckduckgo, or other search engines to find tutorials or other online discussion of the topics of interest to you.

Thanks. "Well, host files do not identify the person, only the host machine originating the connection.

If none of the 4 "host files" have an ip for my computer, do the host files (still) identify my host machine originating the connection?

Originally Posted by ttpp Thanks. "Well, host files do not identify the person, only the host machine originating the connection. If none of the 4 "host files" have an ip for my computer, do the host files (still) identify my host machine originating the connection?

Understand, those host files, specifically the keys within them, are far more unique to your host than the IP address of your host. Your IP address can, and in an environment where DHCP is used probably will, change on a regular or semi-random basis. The host keys will change only when you change them or they expire and are regenerated. In a NAT environment the external IP address will differ from your host IP address anyway, but the host keys will uniquely identify your host. (That is, in fact, EXACTLY what they are FOR! Identification of a trusted host, so that you can detect when a connection is from a new or 'untrusted' host.)

Originally Posted by HappyTux seeder1@haswell:~$ ls -l .ssh/ total 16 -rw-r--r-- 1 seeder1 seeder1 1203 Apr 27 2018 authorized_keys -rw------- 1 seeder1 seeder1 1675 Apr 27 2018 id_rsa -rw-r--r-- 1 seeder1 seeder1 381 Apr 27 2018 id_rsa.pub -rw-r--r-- 1 seeder1 seeder1 444 Jul 8 21:24 known_hosts

I normally change authorized_keys and known_hosts to restrict the permission to 400 too, as not to make it too easy for "other users" to find out which systems are authorized cq known to me.

And in my version of known_hosts it is both the hostNAME and the hostIP that is included, but more modern versions of ssh obfuscate them when they add new entries. Old entries, like this

tepper,192.168.178.3 ssh-rsa AAAAB(etc)

are not changed, though.

Originally Posted by ehartman I normally change authorized_keys and known_hosts to restrict the permission to 400 too, as not to make it too easy for "other users" to find out which systems are authorized cq known to me. And in my version of known_hosts it is both the hostNAME and the hostIP that is included, but more modern versions of ssh obfuscate them when they add new entries. Old entries, like this tepper,192.168.178.3 ssh-rsa AAAAB(etc) are not changed, though.

Just one comment: Those mentioned in your post are the USER ssh files, not the host files. Thank you.

Originally Posted by wpeckham Those mentioned in your post are the USER ssh files, not the host files.

I know, but in the message I reacted TO (from HappyTux) they were user files too, he listed the .ssh subdirectory.
The host itself only has key files, no "known_hosts" nor "authorized_keys", in fact the host doesn't have a .ssh subdirectory where those files would be located.
But, as I said, I extra protect the /root/.ssh contents by changing all files in it except the public key to permission 400, so other users can only get the public key (which is public anyway).

Originally Posted by ttpp If none of the 4 "host files" have an ip for my computer, do the host files (still) identify my host machine originating the connection?

The public keys are meant to be put onto remote machines, so yes, they DO identify either IP or hostname from the system which they are from, in a root@hostname or root@ip_address form as they should be used for secure connections to THAT machine only.

BTW: the "host files" are pairs (private and public key) and there can be at least 5 pair of them (of which 1 is only for ssh protocol level 1, so if you got that disabled, those may nog have been generated on your system):

ssh_host_key ssh_host_key.pub                   Protocol level 1 keypair
ssh_host_dsa_key ssh_host_dsa_key.pub and
ssh_host_rsa_key ssh_host_rsa_key.pub           The "original" level 2 dsa and rsa files
ssh_host_ecdsa_key ssh_host_ecdsa_key.pub       Newer ecdsa keys
ssh_host_ec25519_key ssh_host_ec25519_key.pub   Still newer implementation of the ecdsa cipher

At least, those are the type of "host files" I got on my system.