Technical Tip: How to regenerate local SSH keys

[metz_FTNT]

Description	This article describes how to regenerate FortiGate built-in SSH keys for PKI admin authentication.
Scope	FortiGate.
Solution	It is possible to list the current keys with the command below: fnsysctl ls -l /etc/ssh/ -rw-------    1 0        0       Tue May 14 21:00:14 2024              651 KEY-FILE -rw-------    1 0        0       Tue May 14 21:00:14 2024              602 ssh_host_dsa_key.pub -rw-------    1 0        0       Tue May 14 21:00:14 2024               51 ssh_host_dsa_key.pub.fp Note the timestamp of the files. To regenerate new keys run this command: execute ssh-regen-keys   SSH server will restart and current SSH connections will be disconnected! Do you want to continue? (y/n)  It will restart the SSH service, therefore all SSH connections to the FortiGate will be dropped. To reconnect again, on some systems, it can be required to clean the old key from the PC hosts folder. In Linux, it is possible to do it as follows: ssh-keygen -f "/home/user/.ssh/known_hosts" -R "<Fortigate_IP>" Connect again and confirm the new timestamps:  fnsysctl ls -l /etc/ssh/ -rw-r--r--    1 0        0       Tue May 28 21:07:59 2024              659 KEY-FILE -rw-r--r--    1 0        0       Tue May 28 21:07:59 2024              602 ssh_host_dsa_key.pub -rw-r--r--    1 0        0       Tue May 28 21:07:59 2024               51 ssh_host_dsa_key.pub.fp Note: The moduli file in this directory will not have its timestamp changed upon running the command.