How to update ssh keys?

Preferred:

• ssh keymaster.freebsd.org and follow the instructions.
  • This allows you to do most simple updates yourself.
  • Complex cases (eg: custom from= restrictions) will not work, see alternatives below.
  • Wait at least 10 minutes for updates to propagate from ldap to sshd.
  • Use ssh keycheck.freebsd.org to confirm that you are not depending on legacy protocols or legacy keys.

Alternatives:

• Send an email message to accounts@FreeBSD.org that:
  • is signed with the private key corresponding to the public key in the document;
  • has your new key(s) attached;
  • clearly states your intent (e.g., whether this is a complete key replacement, a partial one, or an addition);
  • contains a hash (sha256 or md5) of each key that you intended to send.
• Fallback: Put your new keys in a file (eg: ~/new-ssh-keys) on freefall, then send a message to accounts@ (as above, but without the attached key(s).
• In desperation: Do the same sort of routine that new committers do: identify a committer who is willing to send the keys, and who is willing to vouch that the keys do actually correspond to you.
• Please be clear - if you want an additional key added, rather than deleting your old ones, be sure to say so.

NOTE:

• The ssh-dss key support is disabled by default on newer openssh (and FreeBSD) in both the client and the server.
• To log in with a modern client you will need to enable dsa keys before it will even try.
  • … even if you specify a dsa key with -i explicitly. It just won't even try it.
• To enable ssh-dss/DSA keys on the client: ssh -oHostKeyAlgorithms=+ssh-dss user@host.
• You may also require -oKexAlgorithms=+diffie-hellman-group1-sha1.
• Use ssh -v to debug your connection attempts before calling for help.
• See the openssh legacy protocol documentation.