I cloned a server and so they've the same RSA key fingerprint.
It seems to be defined in
What is the correct way to change that?
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
Or, remove keys and
-A: For each of the key types (rsa1, rsa, dsa, ecdsa and ed25519) for which host keys do not exist, generate the host keys with the default key file path, an empty passphrase, default bits for the key type, and default comment. This is used by /etc/rc to generate new host keys.
Follow these steps to regenerate OpenSSH Host Keys
For a generic method of doing this:
ssh-keygen -q -N "" -t dsa -f /etc/ssh/ssh_host_dsa_key
ssh-keygen -q -N "" -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key
ssh-keygen -q -N "" -t ecdsa -f /etc/ssh/ssh_host_ecdsa_key
ssh-keygen -q -N "" -t ed25519 -f /etc/ssh/ssh_host_ed25519_key
mix and match according to the keys your version of OpenSSH supports. Current implementations commonly generate only rsa, ecdsa & ed25519.
Do note that that the
-b argument can be used in (most) cases to specify key size.
You should pick a key-size appropriate for the intended lifetime of the key and the amount of time you find acceptable to open a connection as the impact will be more pronounced on slower hardware. For example, using the default RSA key size (2048 at the time of writing) is absolutely fine (again, as of the time of writing) if you're rolling the key over periodically.
Script (in case restarting the sshd daemon does not automatically regenerate the keys)
#!/bin/bash # Regenerate SSHD key materials, restart sshd if "-r" passed on command line set -o nounset WHERE=/etc/ssh # go to directory pushd $WHERE >/dev/null if [[ $? != 0 ]]; then echo "Could not cd to $WHERE -- exiting" >&2 exit 1 fi # create backup folder NOW=`date '+%Y%m%d.%H%M%S'` # default NOW string BAKDIR=bak_$NOW mkdir $BAKDIR if [[ $? != 0 ]]; then echo "Could not mkdir $BAKDIR -- exiting" >&2 exit 1 fi # move existing key material to backup folder mv ssh_host_* $BAKDIR if [[ $? != 0 ]]; then echo "Could not move old files to $BAKDIR -- exiting" >&2 exit 1 fi # generate new keys ssh-keygen -A if [[ $? != 0 ]]; then echo "Could not recreate keys -- exiting" >&2 exit 1 fi # ssh-keygen may create DSA keys but: # "Never use DSA or ECDSA" # http://security.stackexchange.com/questions/5096/rsa-vs-dsa-for-ssh-authentication-keys /bin/rm -f *_dsa_key *_dsa_key.pub /bin/rm -f *_ecdsa_key *_ecdsa_key.pub # on Fedora, one has to tune permissions a bit chmod 640 *_key chgrp ssh_keys *_key # make sure SELinux attributes are as they should be restorecon -R $WHERE # Done echo "New key material" ls -l *_key *_key.pub # Do the risky thing if [[ $1 == '-r' ]]; then echo "Restarting SSH daemon" systemctl restart sshd fi # go back to where you where popd >/dev/null
Debian 10.7 user here. Mixing the two best answer was the cleanest way to solde the problem :
( As root or sudo it yourself )
server A.B.C.D : Mooving old keys in a "backup" folder
mkdir -p ~/ssh_backup && mv /etc/ssh/ssh_host_* ~/ssh_backup/.
server A.B.C.D : Generate new keys :
CLIENT SIDE : forger about the previous key for server A.B.C.D
ssh-keygen -R A.B.C.D
Here you go, the fresh ssh keys can be used.