Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to replace the default 2048 bit host key generated when installing OpenSSH or starting it the first time with one of 4096 bit length.

This leads to two questions:

  • Does OpenSSH allow running with a 4096 bit RSA host key (for SSH2 obviously)?
  • How can ssh-keygen be convinced not to prompt for a passphrase?

The version of OpenSSH I am running is 6.6p1.

share|improve this question
up vote 5 down vote accepted

Whatever key-length is supported in ssh-keygen most likely would work with sshd as well. Besides that, you should generate your host-keys with ssh-keygen -h anyways, so if ssh-keygen isn't totally dumb, it should inform you if the desired key-length is not supported for host keys.

The passphrase could be specified with -N; if you don't want the key to be encrypted, just specify an empty one (thus just hitting Enter if it prompts you would have the same effect).

share|improve this answer
Thanks for the swift and succinct answer! – 0xC0000022L May 5 '14 at 12:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.