{"record":{"id":"4f676f6cc8f36a05","repo":"hashicorp/vagrant","slug":"vagrant-is-configured-to-generate-a-random-keypair","errorCode":null,"errorMessage":"Vagrant is configured to generate a random keypair and insert it\nonto the guest machine, but it appears Vagrant doesn't know how to do\nthis with your guest OS. Please disable key insertion by setting\n`config.ssh.insert_key = false` in the Vagrantfile.\n\nAfter doing so, run `vagrant reload` for the setting to take effect.","messagePattern":"Vagrant is configured to generate a random keypair and insert it\nonto the guest machine, but it appears Vagrant doesn't know how to do\nthis with your guest OS\\. Please disable key insertion by setting\n`config\\.ssh\\.insert_key = false` in the Vagrantfile\\.\n\nAfter doing so, run `vagrant reload` for the setting to take effect\\.","errorType":"exception","errorClass":"Vagrant::Errors::SSHInsertKeyUnsupported","httpStatus":null,"severity":"error","filePath":"plugins/communicators/ssh/communicator.rb","lineNumber":191,"sourceCode":"        end\n\n        # If we used a password, then insert the insecure key\n        ssh_info = @machine.ssh_info\n        return if ssh_info.nil?\n        insert   = ssh_info[:password] && ssh_info[:private_key_path].empty?\n        ssh_info[:private_key_path].each do |pk|\n          if insecure_key?(pk)\n            insert = true\n            @machine.ui.detail(\"\\n\"+I18n.t(\"vagrant.inserting_insecure_detected\"))\n            break\n          end\n        end\n\n        if insert\n          # If we don't have the power to insert/remove keys, then its an error\n          cap = @machine.guest.capability?(:insert_public_key) &&\n            @machine.guest.capability?(:remove_public_key)\n          raise Vagrant::Errors::SSHInsertKeyUnsupported if !cap\n\n          key_type = machine_config_ssh.key_type\n\n          begin\n            # If the key type is set to `:auto` check for supported type. Otherwise\n            # ensure that the key type is supported by the guest\n            if key_type == :auto\n              key_type = catch(:key_type) do\n                begin\n                  Vagrant::Util::Keypair::PREFER_KEY_TYPES.each do |type_name, type|\n                    throw :key_type, type if supports_key_type?(type_name)\n                  end\n                  nil\n                rescue => err\n                  @logger.warn(\"Failed to check key types server supports: #{err}\")\n                  nil\n                end\n              end","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/hashicorp/vagrant/blob/35f3160f4ad6edc3a9f3aa9570adfc1a4d73aaa5/plugins/communicators/ssh/communicator.rb#L173-L209","documentation":"On first connect Vagrant replaces the insecure default key with a generated keypair. If the guest's capability chain cannot do either half of that (insert_public_key / remove_public_key), SSHInsertKeyUnsupported is raised instead of silently leaving the insecure key in place. The message tells you to disable key insertion with `config.ssh.insert_key = false` and reload.","triggerScenarios":"Booting a box whose guest detection falls back to a generic/unknown guest without insert_public_key or remove_public_key capabilities; stripped-down appliances or containers missing the tools those capabilities require; misdetected guest OS selecting the wrong guest plugin.","commonSituations":"Custom minimal base boxes; appliance-like guests; boxes built years ago running on newer Vagrant versions where key-insertion capability requirements tightened.","solutions":["Set `config.ssh.insert_key = false` in the Vagrantfile and run `vagrant reload` (exactly as the error instructs)","Fix guest detection so real capabilities load: use a standard box whose OS Vagrant recognizes","Replace the insecure key manually (ssh-copy-id or provider console) if rotation is required without the capability"],"exampleFix":"# before\nVagrant.configure('2') do |config|\n  config.vm.box = 'custom-appliance'\nend\n# vagrant up  ->  SSHInsertKeyUnsupported\n\n# after\nVagrant.configure('2') do |config|\n  config.vm.box = 'custom-appliance'\n  config.ssh.insert_key = false\nend\n# then: vagrant reload","handlingStrategy":"fallback","validationCode":"unless machine.guest.capability?(:insert_public_key) && machine.guest.capability?(:remove_public_key)\n  warn 'guest cannot rotate SSH keys; set config.ssh.insert_key = false in the Vagrantfile'\nend","typeGuard":null,"tryCatchPattern":"begin\n  env.cli('up')\nrescue Vagrant::Errors::SSHInsertKeyUnsupported\n  # append `config.ssh.insert_key = false` to the Vagrantfile, then run `vagrant reload`\nend","preventionTips":["Default to `config.ssh.insert_key = false` for nonstandard guests and manage keys yourself","Prefer official or widely-used boxes so guest capabilities are implemented","Smoke-test new boxes with `vagrant up` before using them in pipelines"],"tags":["vagrant","ssh","keys","guest-capability","security"],"backgroundTag":"missing-capability","analyzedSha":"35f3160f4ad6edc3a9f3aa9570adfc1a4d73aaa5","analyzedAt":"2026-08-21T13:34:32.514Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}