Ssh – Changing the output directory when recreating SSH host keys with ssh-keygen (the -f switch doesn’t prevent ssh-keygen from writing to /etc/ssh/)

key-authenticationssh

I've been trying to start an additional sshd process on a remote machine. I've created a working directory with the new sshd config file I'd like to use.

When I try to run sshd using the config file in this directory, it complains it can't find any host keys. I've tried to create missing host keys by running ssh-keygen -A with the -f switch to specify the location of my working directory but ssh-keygen continues trying to place the keys in /etc/ssh/ instead of the directory I specified. I don't have access to /etc/ssh, so it fails.

How can I generate these keys without access to this path?

Best Answer

The -A option tells ssh-keygen to generate host keys. According to the manual page, the intended use of ssh-keygen is

Normally each user wishing to use SSH with public key authentication runs
this once to create the authentication key in ~/.ssh/identity,
~/.ssh/id_ecdsa, ~/.ssh/id_dsa or ~/.ssh/id_rsa. Additionally, the system administrator may use this to generate host keys.

The synopsis lists the -A on a line by itself, with no other options:

SYNOPSIS
     ssh-keygen [-q] [-b bits] -t type [-N new_passphrase] [-C comment]
                [-f output_keyfile]
     ssh-keygen -p [-P old_passphrase] [-N new_passphrase] [-f keyfile]
     ssh-keygen -i [-m key_format] [-f input_keyfile]
     ssh-keygen -e [-m key_format] [-f input_keyfile]
     ssh-keygen -y [-f input_keyfile]
     ssh-keygen -c [-P passphrase] [-C comment] [-f keyfile]
     ssh-keygen -l [-f input_keyfile]
     ssh-keygen -B [-f input_keyfile]
     ssh-keygen -D pkcs11
     ssh-keygen -F hostname [-f known_hosts_file] [-l]
     ssh-keygen -H [-f known_hosts_file]
     ssh-keygen -R hostname [-f known_hosts_file]
     ssh-keygen -r hostname [-f input_keyfile] [-g]
     ssh-keygen -G output_file [-v] [-b bits] [-M memory] [-S start_point]
     ssh-keygen -T output_file -f input_file [-v] [-a num_trials] [-K checkpt]
                [-W generator]
     ssh-keygen -s ca_key -I certificate_identity [-h] [-n principals]
                [-O option] [-V validity_interval] [-z serial_number] file ...
     ssh-keygen -L [-f input_keyfile]
     ssh-keygen -A

So (aside from modifying the source and compiling it yourself), what you are asking is not its intended use.

Further reading:

Related Question