On Tue, Jul 28, 2026 at 10:38:28PM +0200, Thorsten Glaser wrote:
On Tue, 28 Jul 2026, Colin Watson wrote:
Nothing's changed here for a long time. You can avoid this by
explicitly setting HostKey in /etc/ssh/sshd_config or
/etc/ssh/sshd_config/*.conf to only the host keys you want;
openssh-server.postinst will respect that.
It’s interesting: it seems that if I set it in /etc/ssh/sshd_config
(as I used to), it is respected, but on the one system where this
happened, I had it in /etc/ssh/sshd_config.d/local.conf, where the
maintainer scripts, in contrast to the dæmon itself, didn’t pick it
up; is this plausible?
Ah, of course, I see you're on bullseye. In that case your analysis
here is correct. This is https://bugs.debian.org/959726, which was
fixed in 1:9.3p1-1. (That fix cannot straightforwardly be backported to
bullseye, because it relies on the new "sshd -G" option which was only
added in OpenSSH 9.3.)
Thanks,
--
Colin Watson (he/him) [[email protected]]
