Auto-generated ssh key and authorized_keys

[Kuakski]

Hi everyone!

I just noticed that on a freshly installed Proxmox node the root user already comes with the .ssh folder. Into /root/.ssh there is the pair id_rsa/id_rsa.pub, a config file and the authorized_keys, that is a symlink to /etc/pve/priv/authorized_keys.

Within this file, the root's public key is pre-loaded. If I delete it, it reappears upon reboot. If I delete the root's ssh key, it's generated again and the public one is stored inside /etc/pve/priv/authorized_keys.

What's the purpose of this mechanism? Is it a good idea to disable it? If so, how?

 

[dietmar]

We use this to connect to other nodes via ssh (for example when you migrate a VM to another cluster node).

 

[Kuakski]

Ok, so there's no point for me in using it.
How can I disable the feature, making both key removal and the change to authorized_keys permanent?

 

[Kuakski]

So, is it really impossible to disable this mechanism?

 

[fabian]

So, is it really impossible to disable this mechanism?

it is needed for cluster functionality. it makes more sense to disable SSH access from the public or from non-cluster nodes on the firewall level

 

[apmuthu]

What is the standard way to regenerate these keys from the GUI / CLI?
When the root password is changed from the Web UI, SSH, Web Access works. All SFTP to host and containers fail.
PVE 3.4.

 

[apmuthu]

Increasing the FileZilla timeout from default 20 secs to 40 secs just cleared the issue.

Made sure the /etc/resolv.conf had a local nameserver.
Other means that may be used to troubleshoot SFTP issues and SSH login delays are at:

How to fix a slow SSH login issue on Linux

The attachment too will be useful in mitigating this issue.

Looks like the PVE 3.4 is okay after all.