When setting up an sshd daemon and generating a host key with ssh-keygen -A what options are best practice to add?

How do I remove keys which may have already been auto-generated with sub-optimal options?

  • why do you think they were generated with sub-optimal options?
    – Jakuje
    Dec 8, 2016 at 9:40
  • 1
    This site has a very detailed, thorough explaination of configuring OpenSSH clients and server daemons with optimal keys. Your current keys are stored in '~/.ssh/'. The default keys are usually named 'id_rsa' and 'id_rsa.pub'. The public keys allowed to access the server is stored in each users '~/.ssh/authorized_keys' files. stribika.github.io/2015/01/04/secure-secure-shell.html
    – Aidan
    Dec 8, 2016 at 16:56
  • @Jakuje If best practice says to create keys with non-standard options, I want to know how to remove any that may have already been generated (I'm setting up a sshd server now).
    – Tom Hale
    Dec 10, 2016 at 4:03

1 Answer 1


You can safely remove the keys stored in /etc/ssh, generate new keys and restart sshd. There is nothing more to it than that.

But please note that every client that have the old key stored in their known_hosts file will complain. You will need to remove that record from your clients. This can be done using ssh-keygen -R <hostname>

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .