27

I am trying to recreate the ssh-server host keys.

I have at least two ways to do this:

  • With dpkg-reconfigure

    dpkg-reconfigure openssh-server

    This works fine, but I cannot give the key length then. I want for example 4096 for the RSA key.

  • Manually with ssh-keygen

    sudo ssh-keygen -f /etc/ssh/ssh_host_rsa_key -N 'myverylongpasswordhere' -b 4096 -t rsa

    This recreates me the keys, but after restarting the server, I receive the following error message:

    could not load host key: /etc/ssh/ssh_host_rsa_key

    so I checked the sshd_config file whats in there:

    HostKey /etc/ssh/ssh_host_rsa_key

    matches perfectly. So, I checked the owner and rights to all my keys

    -rw------- 1 root root 3326 Mär 24 08:57 ssh_host_rsa_key

    When I remove all keys and recreate them with dpkg-reconfigure openssh-server, the keys are smaller and having the same file-rights like above.

Question: How can I use dpkg-reconfigure with keylengh 4096 for RSA?

Improve this question
5
  • Please run sshd in debug mode from the command line (sudo sshd -d) for more info on the issue and post the output.
    – David Foerster
    Mar 24 '15 at 9:44
  • @DavidFoerster That looks like a good suggestion. I tried recreating the issue by moving my keys temporarily, creating new keys with passwords, stopping and restarting... I don't get the error message of the OP. This is the result I get livewire@za20:/etc/ssh$ sudo sshd -d output sshd re-exec requires execution with an absolute path Otherwise I would have included an example in my answer :(
    – LiveWireBT
    Mar 24 '15 at 18:47
  • Sorry, that should have been sudo /usr/sbin/sshd -d. The error you got is meant literally (though not quite clear).
    – David Foerster
    Mar 24 '15 at 20:19
  • Even though the accepted answer solves the problem, I'm still wondering about the final question in the first post: How can I use dpkg-reconfigure with keylength 4096? Is there a config file somewhere that contains this info? I looked around in the debconf databases (in /var/cache/debconf/) but didn't find anything that looked like the keylength.
    – ph0t0nix
    Mar 21 '16 at 13:13
  • Docker way: RUN ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519
    – kenorb
    May 11 '20 at 17:13
48

None of the answers above worked for me. I fixed my ubuntu system by doing the following:

/usr/bin/ssh-keygen -A
Improve this answer
5
  • 4
    THIS. This is the real answer, as confirmed by the manpage for ssh-keygen about that "-A" flag: For each of the key types (rsa1, rsa, dsa, ecdsa and ed25519) for which host keys do not exist, generate the host keys with the default key file path, an empty passphrase, default bits for the key type, and default comment. This is used by system administration scripts to generate new host keys.
    – BoomShadow
    Apr 10 '19 at 20:39
  • 1
    This should be the accepted answer.
    – yms
    Jun 3 '20 at 14:49
  • 1
    Indeed, this is the simplest
    – ScotchAndSoda
    Jun 5 '20 at 8:24
  • 1
    Dude, just logged in to say thank you! My ssh keys could not be read. This regenerated my keys. Restarted my ssh server and all worked!
    – GTodorov
    Nov 30 '20 at 8:22
  • It DID work on my WSL2 Ubuntu 18.04.
    – furushchev
    Apr 5 at 14:21
11 
sudo ssh-keygen -f /etc/ssh/ssh_host_rsa_key -N 'myverylongpasswordhere' -b 4096 -t rsa

recreates me the keys. but, after restarting the server, i recieve

could not load host key: /etc/ssh/ssh_host_rsa_key

You create a hostkey with a password. Is there any customization to unlock that hostkey? If not, then I think that is what is to be expected: the script that manages the service starts up, tries to load the hostkey, and fails. As far as I know you shouldn't create hostkeys protected with passwords.

If you are interested in hardening your SSH server then I recommend reading https://stribika.github.io/2015/01/04/secure-secure-shell.html the command used to create the hostkey in that document is:

ssh-keygen -t rsa -b 4096 -f ssh_host_rsa_key

But you should read the entire document before making any changes.

Improve this answer
1
  • works. just removing the myverylongpasswordhere. by the way: really nice article to read. in fact openssh comes from ubuntu-repro in my case, and did not support KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
    – Emil Sommer
    Mar 24 '15 at 9:06
2

Simply run:

ssh-keygen -t rsa -b 4096

ssh-keygen generates an SSH key.

  • -t specifies the type of key to create
  • -b specifies the number of bits in the key.

See this page for more information.

Improve this answer
2
  • this is not the answer. please see my question, i allready did this, with the resulst that hostkey could not be loaded.
    – Emil Sommer
    Mar 24 '15 at 8:37
  • 3
    @EmilSommer No, that exactly is the answer, just missing an explanation (why you get the error message and what it means).
    – LiveWireBT
    Mar 24 '15 at 8:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.