Description

This article provides information on how to generate SSH host keys using various commands in shell mode.

Symptoms

You may not be able to connect to a Junos router/switch/firewall and see the following log messages on the device:

juniper01 sshd[951]: error: Could not load host key: /etc/ssh/ssh_host_rsa_key
juniper01 sshd[951]: error: Could not load host key: /etc/ssh/ssh_host_dsa_key
juniper01 sshd[951]: Disabling protocol version 2. Could not load host key
juniper01 sshd[951]: sshd: no hostkeys available -- exiting.
juniper01 inetd[820]: /usr/sbin/sshd[951]: exited, status 1

Solution

To resolve this issue, regenerate the SSH host keys. Follow this procedure:

  1. Log in to the router with root account:
    user@junos> start shell user root
    Password:
    root@junos%
  2. Regenerate host keys: At shell prompt enter the following commands:
    root@junos% ssh-keygen -t ecdsa -b 384 -f /etc/ssh/ssh_host_ecdsa_key
    root@junos% ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key
    root@junos% ssh-keygen -t ed25519 -b 384 -f /etc/ssh/ssh_host_ed25519_key

These commands will prompt for a passphrase, but it should be left blank, as this is not used for outgoing connections.

After this, the device will regenerate the keys.

 

Note 1 : It may say “key already exists” but you will need to overwrite.

Note 2 : It may also say it does not exist. If this happens, the ssh directory may be missing and you will need to create the directory.

user@junos% mkdir /etc/ssh

If you get an error that this already exists, you may be on a version of Junos where the /etc/ssh is a link to another directory.

root@junos% ls -al /etc/ssh
lrw-r--r--  1 root  wheel  11 Dec 31  2018 /etc/ssh -> /cf/etc/ssh

And then you will need to check it, which will probably be another link.

root@junos% ls -al /cf/etc/ssh
lrwxr-xr-x  1 root  wheel  11 Feb  1 14:29 /cf/etc/ssh -> /var/db/ssh

root@junos% ls -al /var/db/ssh
ls: /var/db/ssh: No such file or directory

This is the directory we will need to create.
root@junos% mkdir /var/db/ssh
root@junos%

They you can run the ssh-keygen commands above.

Note 3 : If the new keys are not taking effect, please restart the device management. "management" is hidden on most devices.

user@junos> restart management

Modification History

2019-08-03: Updated instructions from EX devices to include all Junos devices. Also, added additional instructions for a common error.
2022-09-12: Added ed25519 per online feedback, and added the "restart management" note.