Post #2160671

2026-05-06 21:41 UTC

To my #SSH folks: Is there some documented process of moving SSH from one machine to another transparently? I get that I can copy the server-keys from $OLDSERVER to $NEWSERVER, but my understanding is that SSH will still notice the IP address (they connect via name, and DNS will point to the new IP address) changing and still raise alarms. Short of also migrating the IP address too (not an option here since they&#39;re owned by different orgs), is there a least-painful route? The current/painful option is just &quot;sorry, suckas, IP changed, host-key &amp; its fingerprints changed, and all your automated SFTP tasks break until you accept the new host key&quot; which I&#39;m trying to avoid ☺ Thanks for any recommendations!

Replies (5)

@mwl@io.mwl.io 2026-05-06 21:53

@gumnos@mastodon.bsd.cafe host keys in dns. Or certificates.

Open ##2483847
@a@852360996.91268476.xyz 2026-05-06 22:04

@gumnos@mastodon.bsd.cafe i would be surprised if that is possible, it would lead to risks

Open ##2483849
@narthur@hachyderm.io 2026-05-06 22:17

@gumnos@mastodon.bsd.cafe tell clients to pre-stage the known-hosts change? Just an idea.

Open ##2483850
@pertho@mastodon.bsd.cafe 2026-05-06 22:22

@gumnos@mastodon.bsd.cafe ssh certificates for the win. Just sign all your hosts ssh keys with it and you can have a single line in known_hosts to validate it. So even if you reinstall, so long as you sign the ssh server keys with that one key it all works. You can also do the same for user ssh keys. I've been using this system for about 2 years on my servers and it's great. I store the private key in a safe place of course.

Open ##2483851
@viq@social.hackerspace.pl 2026-05-06 22:31

@gumnos@mastodon.bsd.cafe @pertho@mastodon.bsd.cafe from my experience "same DNS name and same key" will not generate complaints on an IP change, or at most will emit "hey, other things match, so I updated IP on record"

Open ##2483852