I'm trying to understand the difference bw these two files:

  1. /etc/ssh/ssh_host_rsa_key
  2. ~/.ssh/id_rsa_key

Which one's on the server side? which one on the client, connecting via ssh to a remote host?

I ask this, following this question that popped up in a quiz for the LPIC1 exam 102:

Wade’s OpenSSH private key was compromised, so he needs to create himself a new public/ private key pair. Using super user privileges, what command should he use?

  1. ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key
  2. ssh-keygen -t rsa -f /etc/ssh/ssh_host_ecdsa_key
  3. ssh-keygen -t rsa -f ~/.ssh/id_rsa_key
  4. ssh-keygen -t rsa -f ~/.ssh/id_ecdsa_key
  5. ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key.pub

The correct answer seems to be 1. but I'd opted for 3. Why is 1. correct? how is it different than 3.?

  • 1
    Weird question, generating a new pair of keys for your user does not require "super user privileges".
    – Panki
    Apr 16, 2021 at 12:56
  • 1
    To understand which key is what, read the section "AUTHENTICATION" of man ssh
    – Panki
    Apr 16, 2021 at 13:00

1 Answer 1


You can already infer from the file names that a key in /etc belongs to the system, while a key in ~ (or $HOME) belongs to a user.

If a person's user is compromised, that user creates a new key. Super user privileges are not necessary.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.