This server hardening guide suggests re-generating the RSA and ED25519 host keys. What is the advantage of re-generating the default key?

1 Answer 1


Who created the original keys?

If they were created by the post-inst when you installed the openssh package (or you first booted the server), that should be fine.

On the other hand, if this is a server image which come with the host keys, other users would have the same host key (including the private part).

So, in doubt, it's better to regenerate them, particularly if you are setting up a new server.

It also protects against the scenario where someone might have been able to grab a copy of the previous host keys.

  • Interesting & makes sense. Do you know of an example of a modern system that would use the same host key? I'm assuming all server installs on AWS, GCP, a fresh Ubuntu Server instance, etc. would all generate the key right there during install and I can't think of a modern system that would reuse naively. Oct 9, 2022 at 21:58
  • 2
    @angryserver A naive "Configure a machine → Make snapshot → Use as template" would have this problem. It's not an issue of where you deploy it (AWS, GCP...) but of the image used.
    – Ángel
    Oct 9, 2022 at 22:16
  • 2
    @angryserver It's supposed to work that way, but cloud providers have occasionally had bugs and accidentally reused keys. Oct 10, 2022 at 0:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .