Proxmox Host SSH keys - Revision history

Maeve at 21:21, 28 May 2026

2026-05-28T21:21:08Z

← Older revision		Revision as of 21:21, 28 May 2026
Line 1:		Line 1:
	== ~~Intended method:~~ ==		== Introduction ==
	Delete old ssh host keys:		Proxmox nodes in a cluster communicate with each other through the Secure Shell (SSH) protocol. The SSH protocol is configured to require authentication by encryption keys. The host stores these keys in /root/.ssh/id_rsa.pub and in /etc/ssh/ssh_host_rsa_key.pub. When removing or replacing a Proxmox node, manual cleanup must be done. You must remove the old key from /etc/pve/priv/authorized_keys, and if joining a new machine in its place, add the new one.

			== Removing keys from removed machine. ==
			Delete old ssh host keys on the host you're troubleshooting or have removed with:
	rm /etc/ssh/ssh_host_*		rm /etc/ssh/ssh_host_*
	~~Reconfigure~~ OpenSSH ~~Server:~~		After doing this, we need to make sure the fingerprint of the old key is no longer on the other machines. Navigate to ''/etc/pve/priv/known_hosts'' and remove the fingerprint with the hostname of the machine you're treating. Also remove the key itself from /etc/pve/priv/authorized_keys.

			== Adding key ==
			Then we can recreate the keys with OpenSSH.
	dpkg-reconfigure openssh-server		dpkg-reconfigure openssh-server
	~~Update all~~ ssh ~~client(s) at ~~~/.~~ssh~~/~~known_hosts~~		After doing this we must copy the new key from /etc/ssh/ssh_host_rsa_key.pub on the treated machine to /etc/pve/priv/authorized keys. You will most likely have to do this manually copying from the broken machine to a machine still in the cluster, as with the keys removed, corosync may not copy the files correctly. After this we want to make sure that the fingerprint has been updated. On the treated machine, run:

	~~Then update certs and~~ keys ~~''on each~~ machine'':
	pvecm updatecerts -f		pvecm updatecerts -f

	== Manual ~~method~~<ref>https://forum.proxmox.com/threads/pvecm-updatecert-f-not-working.135812/page-3#post-660500</ref>: ==		== Manual correction if the above fails<ref>https://forum.proxmox.com/threads/pvecm-updatecert-f-not-working.135812/page-3#post-660500</ref> ==
	If this fails (which it might), ~~log into each troublesome node through SSHd and~~ copy the public key from		If this fails (which it might), copy the public key of the troublesome node from ''/etc/ssh/ssh_host_rsa_key.pub'' to ''/etc/pve/nodes/<node>/ssh_known_hosts'' and prepend it with that machine's hostname. Assuming a hostname of pve1, this line should appear as
	/etc/ssh/ssh_host_rsa_key.pub.
	~~Copy this~~ to
	/etc/pve/nodes/<node>/ssh_known_hosts
	and prepend it with that machine's hostname. Assuming a hostname of pve1, this line should appear as
	pve1 ssh-rsa <key>		pve1 ssh-rsa <key>
	Then restart the SSH daemon:		Then restart the SSH daemon:
	systemctl restart sshd		systemctl restart sshd

Maeve at 18:46, 13 December 2024

2024-12-13T18:46:12Z

@@ Line 1: / Line 1: @@
-Follow these steps to regenerate OpenSSH Host Keys after cloning a Proxmox host.
+Then update certs and keys ''on each machine'':
-    Delete old ssh host keys: rm /etc/ssh/ssh_host_*
+== Manual method<ref>https://forum.proxmox.com/threads/pvecm-updatecert-f-not-working.135812/page-3#post-660500</ref>: ==
-    Reconfigure OpenSSH Server: dpkg-reconfigure openssh-server
+If this fails (which it might), log into each troublesome node through SSHd and copy the public key from
-    Update all ssh client(s) ~/.ssh/known_hosts files
+  /etc/ssh/ssh_host_rsa_key.pub.
+Copy this to
+  /etc/pve/nodes/<node>/ssh_known_hosts
-    pvecm updatecerts -f
+and prepend it with that machine's hostname. Assuming a hostname of pve1, this line should appear as
+  pve1 ssh-rsa <key>
-    ufear said:
+Then restart the SSH daemon:
-    So, if anybody runs into this. I couldn't get updatecerts to add keys for reinstalled nodes to the global /etc/pve/priv/ssh_known_hosts; however the folder /etc/pve/nodes/<nodename> contains a ssh_known_hosts file which contains the content you need; copy it over and the world is good again.
+  systemctl restart sshd

Julian at 00:06, 4 December 2024

2024-12-04T00:06:39Z

← Older revision		Revision as of 00:06, 4 December 2024
Line 1:		Line 1:

	Follow these steps to regenerate OpenSSH Host Keys		Follow these steps to regenerate OpenSSH Host Keys after cloning a Proxmox host.

	Delete old ssh host keys: rm /etc/ssh/ssh_host_*		Delete old ssh host keys: rm /etc/ssh/ssh_host_*

Julian at 00:06, 4 December 2024

2024-12-04T00:06:02Z

← Older revision		Revision as of 00:06, 4 December 2024
Line 1:		Line 1:

			Follow these steps to regenerate OpenSSH Host Keys

			Delete old ssh host keys: rm /etc/ssh/ssh_host_*
			Reconfigure OpenSSH Server: dpkg-reconfigure openssh-server
			Update all ssh client(s) ~/.ssh/known_hosts files


	pvecm updatecerts -f		pvecm updatecerts -f

Julian at 23:52, 3 December 2024

2024-12-03T23:52:20Z

← Older revision		Revision as of 23:52, 3 December 2024
Line 1:		Line 1:

			pvecm updatecerts -f
	~~May 3, 2024~~

	~~Add bookmark~~
	~~#59~~

	ufear said:		ufear said:

Julian: Created page with " May 3, 2024 Add bookmark #59 ufear said: So, if anybody runs into this. I couldn't get updatecerts to add keys for reinstalled nodes to the global /etc/pve/priv/ssh_known_hosts; however the folder /etc/pve/nodes/ contains a ssh_known_hosts file which contains the content you need; copy it over and the world is good again. Your post put me in the right track and it seems I'm able to connect by WebGUI shell from any host to any host in..."

2024-12-03T23:49:06Z

Created page with " May 3, 2024 Add bookmark #59 ufear said: So, if anybody runs into this. I couldn't get updatecerts to add keys for reinstalled nodes to the global /etc/pve/priv/ssh_known_hosts; however the folder /etc/pve/nodes/<nodename> contains a ssh_known_hosts file which contains the content you need; copy it over and the world is good again. Your post put me in the right track and it seems I'm able to connect by WebGUI shell from any host to any host in..."

New page

May 3, 2024

Add bookmark
#59

ufear said:
So, if anybody runs into this. I couldn't get updatecerts to add keys for reinstalled nodes to the global /etc/pve/priv/ssh_known_hosts; however the folder /etc/pve/nodes/<nodename> contains a ssh_known_hosts file which contains the content you need; copy it over and the world is good again.

Your post put me in the right track and it seems I'm able to connect by WebGUI shell from any host to any host in the cluster now.

The problem was that two of my nodes were missing ssh_known_hosts file in
Code:

/etc/pve/nodes/<node>/

(The hosts that gave me KEY CHANGED warning in WebGUI Shell)

I logged in to both troublesome nodes via ssh terminal and copied SSH public key from
Code:

/etc/ssh/ssh_host_rsa_key.pub

to
Code:

/etc/pve/nodes/<node>/ssh_known_hosts

file and added the node hostname in the beginning of the line before RSA public key like so:

Code:

NodeHostname ssh-rsa <the_rsa_pub_key>

after that I restarted SSH service systemctl restart sshd on both nodes (not sure if necessary)

This seems to have worked.