I've been trying to start an additional sshd process on a remote machine. I've created a working directory with the new sshd config file I'd like to use.

When I try to run sshd using the config file in this directory, it complains it can't find any host keys. I've tried to create missing host keys by running ssh-keygen -A with the -f switch to specify the location of my working directory but ssh-keygen continues trying to place the keys in /etc/ssh/ instead of the directory I specified. I don't have access to /etc/ssh, so it fails.

How can I generate these keys without access to this path?

2 Answers 2


The -A option tells ssh-keygen to generate host keys. According to the manual page, the intended use of ssh-keygen is

Normally each user wishing to use SSH with public key authentication runs
this once to create the authentication key in ~/.ssh/identity,
~/.ssh/id_ecdsa, ~/.ssh/id_dsa or ~/.ssh/id_rsa. Additionally, the system administrator may use this to generate host keys.

The synopsis lists the -A on a line by itself, with no other options:

     ssh-keygen [-q] [-b bits] -t type [-N new_passphrase] [-C comment]
                [-f output_keyfile]
     ssh-keygen -p [-P old_passphrase] [-N new_passphrase] [-f keyfile]
     ssh-keygen -i [-m key_format] [-f input_keyfile]
     ssh-keygen -e [-m key_format] [-f input_keyfile]
     ssh-keygen -y [-f input_keyfile]
     ssh-keygen -c [-P passphrase] [-C comment] [-f keyfile]
     ssh-keygen -l [-f input_keyfile]
     ssh-keygen -B [-f input_keyfile]
     ssh-keygen -D pkcs11
     ssh-keygen -F hostname [-f known_hosts_file] [-l]
     ssh-keygen -H [-f known_hosts_file]
     ssh-keygen -R hostname [-f known_hosts_file]
     ssh-keygen -r hostname [-f input_keyfile] [-g]
     ssh-keygen -G output_file [-v] [-b bits] [-M memory] [-S start_point]
     ssh-keygen -T output_file -f input_file [-v] [-a num_trials] [-K checkpt]
                [-W generator]
     ssh-keygen -s ca_key -I certificate_identity [-h] [-n principals]
                [-O option] [-V validity_interval] [-z serial_number] file ...
     ssh-keygen -L [-f input_keyfile]
     ssh-keygen -A

So (aside from modifying the source and compiling it yourself), what you are asking is not its intended use.

Further reading:


If you have access to docker, which is why I wanted to do this, to create a new, persistent host-key that would be outside container, I used the following:

docker run -d --name get_host_keys lscr.io/linuxserver/openssh-server:latest
sleep 5
docker cp get_host_keys:/etc/ssh/. .
rm *config*
docker stop get_host_keys
docker rm get_host_keys

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .