Bug#1135120: openssh-server: generates ecdsa and ed25519 keys on security upgrade

On Tue, Jul 28, 2026 at 10:38:28PM +0200, Thorsten Glaser wrote:
>On Tue, 28 Jul 2026, Colin Watson wrote:
>> Nothing's changed here for a long time.  You can avoid this by
>> explicitly setting HostKey in /etc/ssh/sshd_config or
>> /etc/ssh/sshd_config/*.conf to only the host keys you want;
>> openssh-server.postinst will respect that.
>
>It’s interesting: it seems that if I set it in /etc/ssh/sshd_config
>(as I used to), it is respected, but on the one system where this
>happened, I had it in /etc/ssh/sshd_config.d/local.conf, where the
>maintainer scripts, in contrast to the dæmon itself, didn’t pick it
>up; is this plausible?

Ah, of course, I see you're on bullseye.  In that case your analysis 
here is correct.  This is https://bugs.debian.org/959726, which was 
fixed in 1:9.3p1-1.  (That fix cannot straightforwardly be backported to 
bullseye, because it relies on the new "sshd -G" option which was only 
added in OpenSSH 9.3.)

Thanks,