> Source: [sk185015](https://support.checkpoint.com/results/sk/sk185015)

# sk185015 - Maestro Security Group Members show mismatched SSH keys

| Property | Value |
|----------|-------|
| Solution ID | sk185015 |
| Date Created | 2026-06-01 |
| Last Modified | 2026-06-22 |
| Technical Level | Advanced |
| Products | Scalable Platforms |
| Versions | R82.10, R82, R81.20, R81.10 (EOS) |

## Symptoms

- * After upgrading a Maestro Security Group from version R81.10 Take 150 to R81.20, the Secure Shell (SSH) host keys are not synchronized across Security Group Members (SGMs). Administrators observe different host key fingerprints on different SGMs.
  Hash comparisons of SSH host key files on each SGM show different checksums. For example:

      [sgm1]# md5sum /etc/ssh/ssh_host_*
      d41d8cd98f00b204e9800998ecf8427e  /etc/ssh/ssh_host_rsa_key
      098f6bcd4621d373cade4e832627b4f6  /etc/ssh/ssh_host_rsa_key.pub
      
      
      [sgm2]# md5sum /etc/ssh/ssh_host_*
      0cc175b9c0f1b6a831c399e269772661  /etc/ssh/ssh_host_rsa_key
      92eb5ffee6ae2fec3ad71c777531578f  /etc/ssh/ssh_host_rsa_key.pub
      
  <br />

* The file transfer configuration indicates that SSH host keys should be cloned, but the files are not present on all SGMs.
  Example from the Single Management Object (SMO):

      /etc/xfer_file_list
      global_context /etc/ssh/ssh_host* /bin/true

  <br />

* After an SMO failover, administrators connecting from an external jump host see the following error when strict host key checking is enabled:

      
      WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!    

  <br />

## Cause

During the Maestro upgrade workflow, the system temporarily blocks the Pull configuration operation.  
This behavior prevents unintended service restarts during the upgrade.  
Because of this block, SSH host key files located in the global context (*/etc/ssh/ssh_host_\** ) do not propagate from the Single Management Object (SMO) to the Security Group Members (SGMs).  
As a result, different SGMs generate or retain different SSH host keys.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content