Generating new SSH Keys ?!

General questions
1

Hi All,

I usually install VyOS via ISO and create its OVA for deployments. I setup 2025.08.13-0020-rolling but when deploying the 2nd OVA and connecting via SSH the terminal shows this KEY already exists.

I want to know how to generate new SSH Key during initial boot..

I used restart ssh and generate ssh server-key and they work but how do I use them in pre or post script. To my understand they will always generate a new SSH key on every boot.

I tried going through Cloud-Init but can’t understand it, or how its used..

Any other thoughts..

2

Just found this..

How to Set SSH Keys While Using cloud-init in Linux | Baeldung on Linux

Still need to understand how to setup cloud-Init, how to add the file, where etc.

3

I found this Troubleshooting — VyOS 1.5.x (circinus) documentation to give me a better understanding..

Now the question is where do I place the file that cloud-init can run it on 1st boot..

4

The rolling images don’t include cloud-init

5

Thanks,

Any other way to achieve what I’m trying to do, generate a new SSH Key for the system..

6

This should be possible via generate ssh server-key unfortunately it’s broken ⚓ T7751 ssh: re-generating server key causes PermissionError

7

Even with cloud-init, if it’s deployed once and cloud-init files aren’t cleaned up, it would keep the keys.

I can see two options:

  • Replicate what we are doing for LTS releases: build a VMDK image using the flavor system, then convert it to an OVA with ovftool. That way the keys simply aren’t there inside the OVA in the first place. See vyos-build/data/build-flavors/generic.toml at current · vyos/vyos-build · GitHub — you can change that line to image_format = “vmdk”. There are more things you can do to automate the build, you’ll need to read the build script to get a sense of that, since we don’t have public documentation about that at the moment.
  • Delete the keys before exporting to OVA. That will probably work.
8

Thanks @dmbaturin

As mentioned I know about regenerating the keys, I’m trying to find what command deletes the keys, any thoughts, commands, or how to do it ?

9

sudo rm

And path to remove

10

You mean removing the .ssh directory right ?

11

Before we generate images, we go in and sudo rm -rf /etc/ssh/ssh_host_*, then we poweroff the machine, then take image.

The lack of SSH host keys on boot means it will re-generate them automatically. This means any machine created from the image will have unique host keys.

12

Appreciate that @zero1three013

13

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.