When setting up an sshd daemon and generating a host key with ssh-keygen -A what options are best practice to add?

How do I remove keys which may have already been auto-generated with sub-optimal options?

  • why do you think they were generated with sub-optimal options?
    – Jakuje
    Dec 8, 2016 at 9:40
  • 1
    This site has a very detailed, thorough explaination of configuring OpenSSH clients and server daemons with optimal keys. Your current keys are stored in '~/.ssh/'. The default keys are usually named 'id_rsa' and 'id_rsa.pub'. The public keys allowed to access the server is stored in each users '~/.ssh/authorized_keys' files. stribika.github.io/2015/01/04/secure-secure-shell.html
    – aidanh010
    Dec 8, 2016 at 16:56
  • @Jakuje If best practice says to create keys with non-standard options, I want to know how to remove any that may have already been generated (I'm setting up a sshd server now).
    – Tom Hale
    Dec 10, 2016 at 4:03

1 Answer 1


You can safely remove the keys stored in /etc/ssh, generate new keys and restart sshd. There is nothing more to it than that.

But please note that every client that have the old key stored in their known_hosts file will complain. You will need to remove that record from your clients. This can be done using ssh-keygen -R <hostname>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.