I cloned a server and so they've the same RSA key fingerprint.
It seems to be defined in
What is the correct way to change that?
Or, remove keys and
-A: For each of the key types (rsa1, rsa, dsa, ecdsa and ed25519) for which host keys do not exist, generate the host keys with the default key file path, an empty passphrase, default bits for the key type, and default comment. This is used by /etc/rc to generate new host keys.
For a generic method of doing this:
ssh-keygen -q -N "" -t dsa -f /etc/ssh/ssh_host_dsa_key
ssh-keygen -q -N "" -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key
ssh-keygen -q -N "" -t ecdsa -f /etc/ssh/ssh_host_ecdsa_key
mix and match according to the keys your version of OpenSSH supports.
Script (in case restarting the sshd daemon does not automatically regenerate the keys)
#!/bin/bash # Regenerate SSHD key materials, restart sshd if "-r" passed on command line set -o nounset WHERE=/etc/ssh # go to directory pushd $WHERE >/dev/null if [[ $? != 0 ]]; then echo "Could not cd to $WHERE -- exiting" >&2 exit 1 fi # create backup folder NOW=`date '+%Y%m%d.%H%M%S'` # default NOW string BAKDIR=bak_$NOW mkdir $BAKDIR if [[ $? != 0 ]]; then echo "Could not mkdir $BAKDIR -- exiting" >&2 exit 1 fi # move existing key material to backup folder mv ssh_host_* $BAKDIR if [[ $? != 0 ]]; then echo "Could not move old files to $BAKDIR -- exiting" >&2 exit 1 fi # generate new keys ssh-keygen -A if [[ $? != 0 ]]; then echo "Could not recreate keys -- exiting" >&2 exit 1 fi # ssh-keygen may create DSA keys but: # "Never use DSA or ECDSA" # http://security.stackexchange.com/questions/5096/rsa-vs-dsa-for-ssh-authentication-keys /bin/rm -f *_dsa_key *_dsa_key.pub /bin/rm -f *_ecdsa_key *_ecdsa_key.pub # on Fedora, one has to tune permissions a bit chmod 640 *_key chgrp ssh_keys *_key # make sure SELinux attributes are as they should be restorecon -R $WHERE # Done echo "New key material" ls -l *_key *_key.pub # Do the risky thing if [[ $1 == '-r' ]]; then echo "Restarting SSH daemon" systemctl restart sshd fi # go back to where you where popd >/dev/null