I cloned a server and so they've the same RSA key fingerprint.

It seems to be defined in /etc/ssh/ssh_host_rsa_key.pub.

What is the correct way to change that?

Thanks.

up vote 16 down vote accepted

Follow these steps to regenerate OpenSSH Host Keys

  1. Delete old ssh host keys: rm /etc/ssh/ssh_host_*
  2. Reconfigure OpenSSH Server: dpkg-reconfigure openssh-server
  3. Update all ssh client(s) ~/.ssh/known_hosts files

Reference

Or, remove keys and

ssh-keygen -A

Explanation:

-A: For each of the key types (rsa1, rsa, dsa, ecdsa and ed25519) for which host keys do not exist, generate the host keys with the default key file path, an empty passphrase, default bits for the key type, and default comment. This is used by /etc/rc to generate new host keys.

  • The OP's tags specify debian, but being non platform specific, this answer seems like the better solution. – mc0e Oct 31 '14 at 14:00
  • Hmm, except it doesn't seem to work for older versions. Eg fails on debian squeeze, which has OpenSSH_5.5p1 – mc0e Oct 31 '14 at 14:39
  • 1
    For your information (from manpagez.com/man/1/ssh-keygen) ssh-keygen -Adoes the following: "For each of the key types (rsa1, rsa, dsa, ecdsa and ed25519) for which host keys do not exist, generate the host keys with the default key file path, an empty passphrase, default bits for the key type, and default comment. This is used by /etc/rc to generate new host keys." – Rabarberski Feb 10 '15 at 20:42

For a generic method of doing this:

ssh-keygen -q -N "" -t dsa -f /etc/ssh/ssh_host_dsa_key

ssh-keygen -q -N "" -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key

ssh-keygen -q -N "" -t ecdsa -f /etc/ssh/ssh_host_ecdsa_key

mix and match according to the keys your version of OpenSSH supports.

  • 1
    I think one way to improve this question would be to add the way to increase the number of bits. i.e. ssh-keygen -q -N "" -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key – Whitecat Apr 7 '16 at 17:18

Delete them and restart SSHd service. They will be regenerated.

  • 1
    No, it doesn't work. /etc/init.d/ssh restart<newline> Could not load host key: /etc/ssh/ssh_host_rsa_key<newline> Could not load host key: /etc/ssh/ssh_host_dsa_key<newline> [....] Restarting OpenBSD Secure Shell server: sshdCould not load host key: /etc/ssh/ssh_host_rsa_key<newline> Could not load host key: /etc/ssh/ssh_host_dsa_key – Pascal Polleunus Jan 22 '13 at 10:34
  • 1
    Indeed. Only works on RHEL based distribs. Sorry – Heis Spiter Jan 22 '13 at 10:45
  • Good advice, thanks. It worked for me on CentOS installation. – George Gaál Apr 25 '16 at 20:17
  • Definitely works on Fedora – David Tonhofer Aug 12 '16 at 8:46

Script (in case restarting the sshd daemon does not automatically regenerate the keys)

#!/bin/bash

# Regenerate SSHD key materials, restart sshd if "-r" passed on command line

set -o nounset

WHERE=/etc/ssh

# go to directory

pushd $WHERE >/dev/null

if [[ $? != 0 ]]; then
   echo "Could not cd to $WHERE -- exiting" >&2
   exit 1
fi

# create backup folder

NOW=`date '+%Y%m%d.%H%M%S'` # default NOW string
BAKDIR=bak_$NOW

mkdir $BAKDIR

if [[ $? != 0 ]]; then
   echo "Could not mkdir $BAKDIR -- exiting" >&2
   exit 1
fi

# move existing key material to backup folder

mv ssh_host_* $BAKDIR

if [[ $? != 0 ]]; then
   echo "Could not move old files to $BAKDIR -- exiting" >&2
   exit 1
fi

# generate new keys

ssh-keygen -A

if [[ $? != 0 ]]; then
   echo "Could not recreate keys -- exiting" >&2
   exit 1
fi

# ssh-keygen may create DSA keys but:
# "Never use DSA or ECDSA"
# http://security.stackexchange.com/questions/5096/rsa-vs-dsa-for-ssh-authentication-keys

/bin/rm -f *_dsa_key *_dsa_key.pub
/bin/rm -f *_ecdsa_key *_ecdsa_key.pub

# on Fedora, one has to tune permissions a bit

chmod 640 *_key
chgrp ssh_keys *_key

# make sure SELinux attributes are as they should be

restorecon -R $WHERE

# Done

echo "New key material"
ls -l *_key *_key.pub

# Do the risky thing

if [[ $1 == '-r' ]]; then
   echo "Restarting SSH daemon"
   systemctl restart sshd
fi

# go back to where you where

popd >/dev/null

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.