#1135120 openssh-server: generates ecdsa and ed25519 keys on security upgrade

Package:
openssh-server
Source:
openssh-server
Description:
secure shell (SSH) server, for secure access from remote machines
Submitter:
Thorsten Glaser
Date:
2026-07-29 11:15:01 UTC
Severity:
normal
#1135120#5
Date:
2026-04-27 22:11:01 UTC
From:
To:
There recently was an OpenSSH upgrade, which led to it
generating ecdsa and ed25519 keys I had deliberately
removed because I use only RSA keys.
#1135120#10
Date:
2026-07-28 12:57:15 UTC
From:
To:
Nothing's changed here for a long time.  You can avoid this by
explicitly setting HostKey in /etc/ssh/sshd_config or
/etc/ssh/sshd_config/*.conf to only the host keys you want;
openssh-server.postinst will respect that.

Thanks,
#1135120#15
Date:
2026-07-28 20:38:28 UTC
From:
To:
It’s interesting: it seems that if I set it in /etc/ssh/sshd_config
(as I used to), it is respected, but on the one system where this
happened, I had it in /etc/ssh/sshd_config.d/local.conf, where the
maintainer scripts, in contrast to the dæmon itself, didn’t pick it
up; is this plausible?

bye,
//mirabilos
#1135120#20
Date:
2026-07-29 10:55:58 UTC
From:
To:
Ah, of course, I see you're on bullseye.  In that case your analysis
here is correct.  This is https://bugs.debian.org/959726, which was
fixed in 1:9.3p1-1.  (That fix cannot straightforwardly be backported to
bullseye, because it relies on the new "sshd -G" option which was only
added in OpenSSH 9.3.)

Thanks,
#1135120#25
Date:
2026-07-29 11:12:22 UTC
From:
To:
Aaaah, okay.

I’ve reverted that host to changing sshd_config directly. Fine with me.

bye,
//mirabilos