Re: [SECURITY] [DSA 1571-1] New openssl packages fix predictable random number generator

[Steve Suehring <debiansec@braingia.org>]

On Tue, May 13, 2008 at 06:35:25PM -0300, dererk wrote:
> On Tue, May 13, 2008 at 10:53:25PM +0200, Jan Luehr wrote:
> > rm /etc/ssh/ssh_host_*
> > ssh-keygen -t dsa -f /etc/ssh/ssh_host_dsa_key -N ''
> > ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key -N ''
> > /etc/init.d/ssh restart
> > 
> > -> job done.
> > 
> > Keep smiling
> > yanosz
> 
> Shorter one:
> 
> rm /etc/ssh/ssh_host_*
> dpkg-reconfigure openssh-server

Note that doing either of these will result in host key failures and 
warnings for any clients attempting to connect to you.  This is 
especially bad if you have things like rsync over ssh in a cron job.  
Moral of the story is to remember to update your known_hosts and let 
your users know that their ssh client of choice may bark at them.

Steve
http://www.braingia.org