Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I cloned a server and so they've the same RSA key fingerprint.

It seems to be defined in /etc/ssh/

What is the correct way to change that?


share|improve this question
up vote 12 down vote accepted

OK found it there:

  1. Delete old ssh host keys: rm /etc/ssh/ssh_host_*
  2. Reconfigure OpenSSH Server: dpkg-reconfigure openssh-server
  3. Update all ssh client(s) ~/.ssh/known_hosts files
share|improve this answer

Or, remove keys and

ssh-keygen -A
share|improve this answer
The OP's tags specify debian, but being non platform specific, this answer seems like the better solution. – mc0e Oct 31 '14 at 14:00
Hmm, except it doesn't seem to work for older versions. Eg fails on debian squeeze, which has OpenSSH_5.5p1 – mc0e Oct 31 '14 at 14:39
For your information (from ssh-keygen -Adoes the following: "For each of the key types (rsa1, rsa, dsa, ecdsa and ed25519) for which host keys do not exist, generate the host keys with the default key file path, an empty passphrase, default bits for the key type, and default comment. This is used by /etc/rc to generate new host keys." – Rabarberski Feb 10 '15 at 20:42

For a generic method of doing this:

ssh-keygen -q -N "" -t dsa -f /etc/ssh/ssh_host_dsa_key

ssh-keygen -q -N "" -t rsa -f /etc/ssh/ssh_host_rsa_key

ssh-keygen -q -N "" -t ecdsa -f /etc/ssh/ssh_host_ecdsa_key

mix and match according to the keys your version of OpenSSH supports.

share|improve this answer
I think one way to improve this question would be to add the way to increase the number of bits. i.e. ssh-keygen -q -N "" -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key – Whitecat Apr 7 at 17:18

Delete them and restart SSHd service. They will be regenerated.

share|improve this answer
No, it doesn't work. /etc/init.d/ssh restart<newline> Could not load host key: /etc/ssh/ssh_host_rsa_key<newline> Could not load host key: /etc/ssh/ssh_host_dsa_key<newline> [....] Restarting OpenBSD Secure Shell server: sshdCould not load host key: /etc/ssh/ssh_host_rsa_key<newline> Could not load host key: /etc/ssh/ssh_host_dsa_key – Pascal Polleunus Jan 22 '13 at 10:34
Indeed. Only works on RHEL based distribs. Sorry – Heis Spiter Jan 22 '13 at 10:45
Good advice, thanks. It worked for me on CentOS installation. – George Gaál Apr 25 at 20:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.