I cloned a server and so they've the same RSA key fingerprint.
It seems to be defined in
What is the correct way to change that?
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
Or, remove keys and
-A: For each of the key types (rsa1, rsa, dsa, ecdsa and ed25519) for which host keys do not exist, generate the host keys with the default key file path, an empty passphrase, default bits for the key type, and default comment. This is used by /etc/rc to generate new host keys.
Follow these steps to regenerate OpenSSH Host Keys
Script (in case restarting the sshd daemon does not automatically regenerate the keys)
#!/bin/bash # Regenerate SSHD key materials, restart sshd if "-r" passed on command line set -o nounset WHERE=/etc/ssh # go to directory pushd $WHERE >/dev/null if [[ $? != 0 ]]; then echo "Could not cd to $WHERE -- exiting" >&2 exit 1 fi # create backup folder NOW=`date '+%Y%m%d.%H%M%S'` # default NOW string BAKDIR=bak_$NOW mkdir $BAKDIR if [[ $? != 0 ]]; then echo "Could not mkdir $BAKDIR -- exiting" >&2 exit 1 fi # move existing key material to backup folder mv ssh_host_* $BAKDIR if [[ $? != 0 ]]; then echo "Could not move old files to $BAKDIR -- exiting" >&2 exit 1 fi # generate new keys ssh-keygen -A if [[ $? != 0 ]]; then echo "Could not recreate keys -- exiting" >&2 exit 1 fi # ssh-keygen may create DSA keys but: # "Never use DSA or ECDSA" # http://security.stackexchange.com/questions/5096/rsa-vs-dsa-for-ssh-authentication-keys /bin/rm -f *_dsa_key *_dsa_key.pub /bin/rm -f *_ecdsa_key *_ecdsa_key.pub # on Fedora, one has to tune permissions a bit chmod 640 *_key chgrp ssh_keys *_key # make sure SELinux attributes are as they should be restorecon -R $WHERE # Done echo "New key material" ls -l *_key *_key.pub # Do the risky thing if [[ $1 == '-r' ]]; then echo "Restarting SSH daemon" systemctl restart sshd fi # go back to where you where popd >/dev/null