Re: Host Key Activation Timing Difference - OpenSSH 8.7 vs 9.9

[Darren Tucker]

Hi.

On Fri, 18 Sept 2026 at 06:46, UDIYANA Ramya via openssh-unix-dev
<openssh-unix-dev at mindrot.org> wrote:
> I'm a developer working on OXE (Alcatel-Lucent telecommunication platform) and discovered
> a timing difference in host key activation between OpenSSH 8.7 and 9.9 when deploying new SSH host keys.
> We would appreciate your guidance on whether this is intentional and the recommended approach for automation.

The original behaviour was that sshd would load the keys once at
startup, then use those keys until the server was explicitly
restarted.  This is the intended behaviour.

When we changed sshd such that the forked copy handling each
connection re-exec'ed itself (in order to make exploit mitigations
such as address space layout randomization unique per connection) we
unintentionally changed that behaviour, since the re-execed sshd would
re-read the key files.  Once this was reported, we changed it back to
the intended behaviour.

-- 
Darren Tucker (dtucker at dtucker.net)
GPG key 11EAA6FA / A86E 3E07 5B19 5880 E860  37F4 9357 ECEF 11EA A6FA
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.