reset-ssh-keys

This command deletes and recreates new SSH host keys.

Syntax

  • Delete all keys and recreate only RSA keys.

    reset-ssh-keys

  • Delete all keys and recreate both DSA and RSA keys.

    reset-ssh-keys include-dsa

Parameters

include-dsa
Indicates to include 1024-bit DSA keys.

Guidelines

The reset-ssh-keys command deletes and re-creates new SSH host keys. All previously created SSH host keys are removed and replaced with new keys.

Attention:

This operation removes all existing SSH host keys and might drop active SSH connection. Remote SSH clients must accept new host keys to establish a connection.

After you run the reset-ssh-keys command, each SSH client must delete their SSH client key to connect successfully to the appliance. When the fingerprint of SSH client key does not match the SSH host keys, you receive a warning similar to the following.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx.
Please contact your system administrator.
Add correct host key in /home/xxxxxx/.ssh/known_hosts to get rid of this message.
Offending RSA key in /home/xxxxxx/.ssh/known_hosts:nn
RSA host key for 'Midtownjojo has changed and you have requested strict checking.
Host key verification failed.
After you delete the known host from the file or registry, the next attempt to connect to the appliance displays a prompt similar to the following. When prompted, enter yes to continue.
The authenticity of host 'Midtownjojo (xxx.xxx.xxx.xxx)' cannot be established.
RSA key fingerprint is xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'Midtownjojo,xxx.xxx.xxx.xxx (RSA) to the list of known hosts.
(unknown)
Unauthorized access prohibited.
login:
Delete and re-create new SSH host keys for the SSH service on the appliance. When you run the command, you are presented with a prompt where you must enter y to continue.
# reset-ssh-keys
Resetting SSH keys will regenerate host keys but it may terminate active SSH sessions 
and will require authenticity verification next time a client connects over SSH.
Do you want to continue? Yes/No [y/n]: y

Querying the SSH server keys for an appliance

You can use the following commands on an SSH client machine to query the SSH host keys for an appliance:

  • ssh-keyscan -t dsa,rsa hostname > keyscan.txt
  • ssh-keygen -l -f keyscan.txt
The following example shows the output you might get where the appliance has only an RSA host key:
2048 SHA256:1P6AOL5QNL05814nmjTXs80RuanxIKUZOMZRUSxfBQU hostname (RSA)