AWS transfer documentation change
Summary
Expanded documentation about server host keys, including support for multiple key types (RSA/ECDSA/ED25519), scenarios for importing keys (migration, disaster recovery, algorithm control), and clearer guidance on key rotation.
Security assessment
The changes emphasize security best practices like key rotation and algorithm selection, but there is no evidence of addressing a specific vulnerability. The additions focus on operational security improvements (e.g., 'rotate host keys for enhanced security') and compatibility with secure algorithms, which are proactive measures rather than reactive fixes.
Diff
diff --git a/transfer/latest/userguide/configuring-servers-change-host-key.md b/transfer/latest/userguide/configuring-servers-change-host-key.md index eab56c819..9aa48a8e2 100644 --- a//transfer/latest/userguide/configuring-servers-change-host-key.md +++ b//transfer/latest/userguide/configuring-servers-change-host-key.md @@ -4,0 +5,2 @@ +When to import host keys + @@ -7 +9 @@ -The server host key is a private key used by the Transfer Family server to provide a unique identity to the caller, and to guarantee that it is the correct server. That guarantee is enforced by the presence of the correct public key in the caller's `known_hosts` file. (The `known_hosts` file is a standard feature used by most SSH clients to store the public keys for the servers that you've connected to.) You can retrieve the public key that corresponds to your server host key by running `ssh-keyscan` for your server. +Server host keys are private keys used by the Transfer Family server to provide a unique identity to the caller, and to guarantee that it is the correct server. That guarantee is enforced by the presence of the correct public key in the caller's `known_hosts` file. (The `known_hosts` file is a standard feature used by most SSH clients to store the public keys for the servers that you've connected to.) You can retrieve the public key that corresponds to your server host key by running `ssh-keyscan` for your server. @@ -11,2 +12,0 @@ The server host key is a private key used by the Transfer Family server to provi -If you aren't planning to migrate existing users from an existing SFTP-enabled server to a new SFTP-enabled server, ignore this section. - @@ -15 +15,3 @@ Accidentally changing a server's host key can be disruptive. Depending on how yo -By default, AWS Transfer Family provides a host key for your SFTP-enabled server. You can replace the default host key with a host key from another server. Do so only if you plan to move existing users from an existing SFTP-enabled server to your new SFTP-enabled server. +By default, AWS Transfer Family generates host keys for your SFTP-enabled server. You can import server host keys to preserve host identity and avoid updating client trust stores. When to import host keys lists a few reasons you might want to do this. If you do not provide host keys, new ones will be generated for you. + +AWS Transfer Family supports multiple host keys of different types (RSA, ECDSA, and ED25519) to provide compatibility with a broader range of client host signature algorithms. Different key types enable specific algorithms: RSA keys enable **rsa-*** algorithms, ECDSA keys enable **ecdsa-*** algorithms, and ED25519 keys enable **ed25519** algorithms. Plan your key types at server creation time, as introducing additional key types after clients have started interacting with the server can be disruptive for some clients and may be as problematic as replacing existing host keys. @@ -19 +21 @@ To prevent your users from being prompted to verify the authenticity of your SFT -You can also rotate host keys periodically, as an additional security measure. +You can also rotate host keys periodically, as an additional security measure. For details, see [Rotate the server host keys](./server-host-key-rotate.html). @@ -23 +25,16 @@ You can also rotate host keys periodically, as an additional security measure. -Although the Transfer Family console allows you to specify and add server host keys for all servers, these keys are only useful for servers that use the SFTP protocol. +Server host keys are used by servers that support the SFTP protocol. + +## When to import host keys + +While AWS Transfer Family can generate host keys automatically, there are several scenarios where importing your own host keys provides operational benefits: + + * _Server migration_ \- You're migrating from an existing server to AWS Transfer Family and want to avoid updating client trust stores (`known_hosts` files) for existing clients. + + * _Disaster recovery and failover_ \- You have multiple AWS Transfer Family servers (for example, one in US East (Ohio) and one in US West (Oregon)) that share the same public DNS name. Using the same host keys on both servers ensures seamless failover without client authentication failures. + + * _Operational continuity_ \- You want the host key material available for use with other servers (AWS Transfer Family or otherwise) in the future to maintain consistent server identity across your infrastructure. + + * _Algorithm control_ \- You want greater client compatibility by providing more Host Key Algorithms, or you want to control which algorithms clients can use by only offering keys compatible with specific algorithms. + + + @@ -25 +42 @@ Although the Transfer Family console allows you to specify and add server host k -###### Topics +The following topics provide detailed procedures for managing server host keys: @@ -27 +44 @@ Although the Transfer Family console allows you to specify and add server host k - * [Add an additional server host key](./server-host-key-add.html) + * [Add an additional server host key](./server-host-key-add.html) \- Add additional host keys to your server @@ -29 +46 @@ Although the Transfer Family console allows you to specify and add server host k - * [Delete a server host key](./server-host-key-delete.html) + * [Delete a server host key](./server-host-key-delete.html) \- Remove host keys from your server @@ -31 +48 @@ Although the Transfer Family console allows you to specify and add server host k - * [Rotate the server host keys](./server-host-key-rotate.html) + * [Rotate the server host keys](./server-host-key-rotate.html) \- Rotate host keys for enhanced security @@ -33 +50 @@ Although the Transfer Family console allows you to specify and add server host k - * [Additional server host key information](./server-host-key-other.html) + * [Additional server host key information](./server-host-key-other.html) \- View and manage host key details