18.4. OpenSSH Configuration Files
OpenSSH has two different sets of configuration files: one for
client programs (ssh, scp, and
sftp) and one for the server daemon
(sshd).
System-wide SSH configuration information is stored in the
/etc/ssh/ directory:
moduli — Contains Diffie-Hellman
groups used for the Diffie-Hellman key exchange which is critical
for constructing a secure transport layer. When keys are exchanged
at the beginning of an SSH session, a shared, secret value is created
which cannot be determined by either party alone. This value is then
used to provide host authentication.
ssh_config — The system-wide default
SSH client configuration file. It is overridden if one is also
present in the user's home directory
(~/.ssh/config).
sshd_config — The configuration file
for the sshd daemon.
ssh_host_dsa_key — The DSA private key
used by the sshd daemon.
ssh_host_dsa_key.pub — The DSA public key
used by the sshd daemon.
ssh_host_key — The RSA private key
used by the sshd daemon for version 1 of the SSH
protocol.
ssh_host_key.pub — The RSA public key
used by the sshd daemon for version 1 of the SSH
protocol.
ssh_host_rsa_key — The RSA private
key used by the sshd daemon for version 2 of the
SSH protocol.
ssh_host_rsa_key.pub — The RSA public
key used by the sshd for version 2 of the SSH
protocol.
User-specific SSH configuration information is stored in the user's home
directory within the ~/.ssh/ directory:
authorized_keys — This file holds a
list of authorized public keys for servers. When the client connects
to a server, the server authenticates the client by checking its
signed public key stored within this file.
id_dsa — Contains the DSA private key
of the user.
id_dsa.pub — The DSA public key of the
user.
id_rsa — The RSA private key used by
ssh for version 2 of the SSH protocol.
id_rsa.pub — The RSA public key used by
ssh for version 2 of the SSH protocol
identity — The RSA private key used by
ssh for version 1 of the SSH protocol.
identity.pub — The RSA public key
used by ssh for version 1 of the SSH protocol.
known_hosts — This file
contains DSA host keys of SSH servers accessed by the user. This
file is very important for ensuring that the SSH client is
connecting the correct SSH server.
 | Important |
|---|
| | If a SSH server's host key has changed, the client will notify the
user that the connection cannot proceed until the server's host
key is deleted from the known_hosts file
using a text editor. Before doing this, however, contact the
system administrator of the SSH server to verify the server is not
compromised.
|
See the man pages for ssh and sshd
for information concerning the various directives available in the SSH
configuration files.
