3

How can I generate a new HOST SSH key for my Raspberry Pi using a 4096-bit key (on Raspian Stretch)? I've read any number of tutorials that explain how to regenerate the host SSH key, like this one:

https://www.cyberciti.biz/faq/howto-regenerate-openssh-host-keys/

But using this method leaves me with a 2048-bit host key, as far as I can tell. I also found this question:

https://unix.stackexchange.com/questions/127926/generate-own-stronger-rsa-host-key-for-openssh

Which comes maddeningly close to answering my question, but never actually specifies how to generate the host key. If this is something I can't do (or shouldn't be doing), I'd like to understand why as well.

Improve this question
1

1 Answer 1

Reset to default
4

sudo ssh-keygen -b 4096 -h -f /etc/ssh/ssh_host_rsa_key

This will generate a 4096 bit host rsa key in the default location

In general host keys are generated with the ssh-keygen -h option.

Host keys needs to be copied to /etc/ssh, permissions changed to 644 for public key, 600 for the private key, and owner changed to root:root.

Keep in mind, other authentication methods like dsa have their own host keys and will not be affected by the key change

sudo ssh-keygen -A

will generate (missing) keys using default options, I haven't found if it is possible to change the default options.

If you break something you can delete the key and run the command. This is what dpkg does during install.

ref linked question from serverfault

Improve this answer
5
  • Is there any reason why I shouldn't just use a full pathname in the command instead of running/moving? In other words, just use the command sudo ssh-keygen -b 4096 -h -f /etc/ssh/ssh_host_rsa_key and then attend to the owner & permissions?
    – madman
    Sep 29, 2017 at 0:20
  • @madman Nope, no reason at all why you can't do that. In fact the permissions will likely be correct and the owner already root, I left that info in because SSH is very picky about permissions so if you are having problems its the first thing to check
    – crasic
    Sep 29, 2017 at 1:46
  • Okay, I ran the single-line command that I referenced in my comment and everything has worked as advertised -- thanks so much for this! I was very close, even managing to get the -h option, but I couldn't quite connect the dots by putting the output in the global ssh space (/etc/ssh). One thing I noticed though: the owner is root, the private key has permissions 600, but the public key has permissions 644 instead of the 640 that you suggested. Should I change this manually to 640, or trust that ssh-keygen knows what it's doing and leave it at 644?
    – madman
    Sep 29, 2017 at 5:13
  • That is my mistake, 644 is the right permission - R/W by user root, readable by all , 640 readable only by members of group "root". Since it is a public key it is safe to be readable, and since it may need to be read by other users, it is reasonable to give read permissions. However, there may be cases were you would choose to lock it down. Commonly, personal ssh keys under $HOME/.ssh are not publically readable.
    – crasic
    Sep 29, 2017 at 5:29
  • Thanks for the clear, concise, and informative answer(s). I tried to upvote your answer, but apparently I'm not trustworthy enough to do this :-)
    – madman
    Sep 29, 2017 at 6:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.