Re:Tinyssh
by nine_k on Thursday December 23, 2021 @11:55AM
(#29663661)
Existing keys matter little. I always generate a new key for a new host anyway. Makes revocation much easier.
[ Parent
| on HN ]
For a new server, sure.
I meant your personal identity key in ~/.ssh/id_*. The one that you might have on a bunch of servers, or give to github, or whatever. It's a good practice to periodically regenerate those, but I don't think it happens quite as often.
> The one that you might have on a bunch of servers, or give to github, or whatever
Exactly what I avoid. Each of them gets their own separate key. Never the same key to a bunch of machines (except maybe transient VMs).
But I agree, if a server changes its SSH implementation to one that does not support your existing key, it's a hassle, to say the least. In reasonable circumstances this does not happen without a plenty of warning well ahead of time, to allow you to regenerate your key in a new format.