linux - `ssh-keygen -A` 到底是做什么的？

Question

$ ssh-keygen --help
ssh-keygen: unrecognized option: -
usage: ssh-keygen [-q] [-b bits] [-t dsa | ecdsa | ed25519 | rsa]
              [-N new_passphrase] [-C comment] [-f output_keyfile]
   ssh-keygen -p [-P old_passphrase] [-N new_passphrase] [-f keyfile]
   ssh-keygen -i [-m key_format] [-f input_keyfile]
   ssh-keygen -e [-m key_format] [-f input_keyfile]
   ssh-keygen -y [-f input_keyfile]
   ssh-keygen -c [-P passphrase] [-C comment] [-f keyfile]
   ssh-keygen -l [-v] [-E fingerprint_hash] [-f input_keyfile]
   ssh-keygen -B [-f input_keyfile]
   ssh-keygen -D pkcs11
   ssh-keygen -F hostname [-f known_hosts_file] [-l]
   ssh-keygen -H [-f known_hosts_file]
   ssh-keygen -R hostname [-f known_hosts_file]
   ssh-keygen -r hostname [-f input_keyfile] [-g]
   ssh-keygen -G output_file [-v] [-b bits] [-M memory] [-S start_point]
   ssh-keygen -T output_file -f input_file [-v] [-a rounds] [-J num_lines]
              [-j start_line] [-K checkpt] [-W generator]
   ssh-keygen -s ca_key -I certificate_identity [-h] [-n principals]
              [-O option] [-V validity_interval] [-z serial_number] file ...
   ssh-keygen -L [-f input_keyfile]
   ssh-keygen -A
   ssh-keygen -k -f krl_file [-u] [-s ca_public] [-z version_number]
              file ...
   ssh-keygen -Q -f krl_file file ...

您可能会注意到 ssh-keygen -A 明显缺少文档。

$ ssh-keygen -A
ssh-keygen: generating new host keys: RSA DSA ECDSA ED25519 

它似乎正在生成 (A)all key 文件，但我在 /root/.ssh/ 中没有看到任何 key 。只是为了确认，我运行了 ssh-keygen，没有任何选项，通过所有提示输入，我得到了预期的 key 。

所以问题是，“到底发生了什么？”

Answer 1

这在 ssh-keygen 手册中有记录:

-A

For each of the key types (rsa1, rsa, dsa, ecdsa and ed25519) for which host keys do not exist, generate the host keys with the default key file path, an empty passphrase, default bits for the key type, and default comment. This is used by system administration scripts to generate new host keys.

因此，如果您的系统还没有主机 key ，ssh-keygen -A 会创建它们。 重新创建主机 key 将导致您的 SSH 客户端在您下次连接到机器时提示主机的 key 指纹已更改，并且...

Are you sure you want to continue connecting (yes/no)? 

(假设你之前已经通过SSH成功​​连接到 native )