- /usr/local/bin/sshd-keygen
#!/bin/bash # Create the host keys for the OpenSSH server. KEYTYPE=$1 case $KEYTYPE in "dsa") ;& # disabled in FIPS "ed25519") FIPS=/proc/sys/crypto/fips_enabled if [[ -r "$FIPS" && $(cat $FIPS) == "1" ]]; then exit 0 fi ;; "rsa") ;; # always ok "ecdsa") ;; *) # wrong argument exit 12 ;; esac KEY=/etc/ssh/ssh_host_${KEYTYPE}_key KEYGEN=/usr/bin/ssh-keygen if [[ ! -x $KEYGEN ]]; then exit 13 fi # remove old keys rm -f $KEY{,.pub} # create new keys if ! $KEYGEN -q -t $KEYTYPE -f $KEY -C '' -N '' >&/dev/null; then exit 1 fi # sanitize permissions chgrp ssh_keys $KEY chmod 640 $KEY chmod 644 $KEY.pub if [[ -x /usr/sbin/restorecon ]]; then /usr/sbin/restorecon $KEY{,.pub} fi exit 0
chmod +x /usr/local/bin/sshd-keygen
systemctl edit --full --force sshd-keygen@.service
- /etc/systemd/system/sshd-keygen@.service
[Unit] Description=OpenSSH %i Server Key Generation ConditionFileNotEmpty=|!/etc/ssh/ssh_host_%i_key [Service] Type=oneshot EnvironmentFile=-/etc/sysconfig/sshd ExecStart=/usr/local/bin/sshd-keygen %i [Install] WantedBy=sshd-keygen.target
systemctl edit --full --force sshd-keygen.target
- /etc/systemd/system/sshd-keygen.target
[Unit] Wants=sshd-keygen@rsa.service Wants=sshd-keygen@ecdsa.service Wants=sshd-keygen@ed25519.service PartOf=sshd.service
systemctl edit ssh.service
- /etc/systemd/system/ssh.service.d/override.conf
[Unit] … After=network.target sshd-keygen.target Wants=sshd-keygen.target