2 Loadbalanced SSH / SFTP Servers sharing same private public key pair

[ksmi...@gmail.com]

Hello All,

I have 2 SSH / SFTP Servers. They are sitting behind firewall and loadbalancer. They both run RHEL. When the loadbalancer switches to second server the end users get warning message that the key has changed. Thet is SSH assumes that man in middle attack has occurred. This is off course because the second servers is now answering the SFTP requests and name / ip address has indeed changed.

So have
Loodbalanced name / ip address
Server RHEL1 name / ip address (prefered by load balancer)
Server RHEL2 name / ip address (loadbalancer will point to this first server is down)

Is it possible to make both servers have the same private / public pair. This would remove the warning message when loadbalancing event occurs. Technically I think I just need to copy all private key files (ssh_host_rsa_key, ssh_host_dsa_key, ssh_host_key) and public keys (ssh_host_dsa_key.pub, ssh_host_key.pub, ssh_host_rsa_key.pub) from 1 server to the other.

Is this dangerous? Or reasonable considering I have just 2 servers and they are behind firewall etc.

Any input much appreciated.

Kevin.

[Burkhard Ott]

On Mon, 07 Jan 2013 02:36:20 -0800, ksmith169 wrote:

> Hello All,
>
> I have 2 SSH / SFTP Servers. They are sitting behind firewall and
> loadbalancer. They both run RHEL. When the loadbalancer switches to
> second server the end users get warning message that the key has
> changed. Thet is SSH assumes that man in middle attack has occurred.
> This is off course because the second servers is now answering the SFTP
> requests and name / ip address has indeed changed.
>
> So have
> Loodbalanced name / ip address
> Server RHEL1 name / ip address (prefered by load balancer) Server RHEL2
> name / ip address (loadbalancer will point to this first server is down)
>
> Is it possible to make both servers have the same private / public pair.

Yes, place your key within /etc/ssh/.

> This would remove the warning message when loadbalancing event occurs.
> Technically I think I just need to copy all private key files
> (ssh_host_rsa_key, ssh_host_dsa_key, ssh_host_key) and public keys
> (ssh_host_dsa_key.pub, ssh_host_key.pub, ssh_host_rsa_key.pub) from 1
> server to the other.

Yes.

> Is this dangerous? Or reasonable considering I have just 2 servers and
> they are behind firewall etc.

It depends. As soon as somebody has a key login, he/she is able to access
the 2nd server via ssh as well, assuming there are no ip filters involved.


cheers

[r...@qoxp.net]

If by "key login" you're referring to publickey client authentication,
then this is false. The host key is used by the client to authenticate
the server; it has nothing to do with the server authenticating the
client (except with hostbased authentication).

The tradeoff here has to do with compromise of the server: if the
servers share a hostkey, then an attacker who compromises one can spoof
the other as well.

The best thing to do from a security perspective is to configure the
client to accept either key for the load-balanced server name and/or
address. You can do this in OpenSSH by simply listing both keys for the
same server in the known_hosts file. Whether that's worth the hassle in
this particular case depends on your security requirements and exactly
how much hassle it will be. :)

- Richard