cloudzilla Issues #214

SSH host key rotation breaks existing client fingerprints #214

Open

yumi opened this issue · 2 comments

yumi opened

I rotated the host key on our staging Cloudzilla node yesterday. Now every existing SSH client is throwing REMOTE HOST IDENTIFICATION HAS CHANGED warnings — which is technically correct, but breaks unattended deploy jobs that can't accept the new key interactively.

Two things would help:

  • Document the rotation procedure (include the ~/.ssh/known_hosts remediation step).
  • Optionally support publishing the new fingerprint via an HTTPS endpoint so CI can auto-update.
  1. malith commented

    Thanks Yumi. There's a draft of the rotation runbook in the wiki already — I'll promote it to the main SSH section today.

    The auto-publish endpoint is a good follow-up. Worth doing as a separate issue so we can ship the docs first.

  2. daisy commented

    +1 on splitting it. Filed #218 for the auto-publish endpoint.

Add a comment

Markdown supported · drop files to attach

Close this issue?

Close issue #214 — SSH host key rotation breaks existing client fingerprints. You can reopen it later if needed.