1

I would like to disable ECDSA SSH host keys.

I deleted the existing keys:

$ sudo rm -f /etc/ssh/ssh_host_ecdsa_key*

I uncomment ECDSA in /etc/ssh/sshd_config

$ grep -i ecdsa /etc/ssh/sshd_config
#HostKey /etc/ssh/ssh_host_ecdsa_key

But when I restart sshd the keys are re-generated

$ sudo launchctl unload /System/Library/LaunchDaemons/ssh.plist
$ sudo launchctl load -w /System/Library/LaunchDaemons/ssh.plist
$ ls -l /etc/ssh/ssh_host_ecdsa_key*
-rw-------  1 root  wheel  480 Nov 16 14:57 /etc/ssh/ssh_host_ecdsa_key
-rw-r--r--  1 root  wheel  162 Nov 16 14:57 /etc/ssh/ssh_host_ecdsa_key.pub

Ideally, the system would not employ weak elliptic curves as ecdsa-sha2-nistp256 at all going forward.

How can I prevent sshd to regenerate the ECDSA keys?

Improve this question
4
  • 1
    See this relevant post: security.stackexchange.com/questions/29262/…
    – Allan
    Nov 16, 2018 at 14:24
  • @Allan Thanks for the hint. In the end, all the clean solutions involve a new version of OpenSSH. The trick in the question though seems to work
    – Matteo
    Nov 16, 2018 at 14:32
  • I’m curious why you want to disable this. What’s the benefit you are realizing or goal you’re trying to achieve by this? I would love to answer that question if you still have this requirement unsatisfied.
    – bmike ♦
    Feb 9, 2019 at 12:15
  • @bmike I would like to disable weak elliptic curves as ecdsa-sha2-nistp256
    – Matteo
    Feb 10, 2019 at 14:22

2 Answers 2

Reset to default
1

Maybe not the best solution but substituting the key with empty files seems to work:

cd /etc/ssh/
sudo rm ssh_host_ecdsa_key
sudo touch ssh_host_ecdsa_key
sudo rm ssh_host_ecdsa_key.pub
sudo touch ssh_host_ecdsa_key.pub

The key is invalid and not used, but is not corrected/regenerate when starting up

Improve this answer
0

A quick one liner for blanking out host ECDSA keys:

sudo truncate -s 0 /etc/ssh/ssh_host_ecdsa_key* && sudo chmod u-w /etc/ssh/ssh_host_ecdsa_key*

To prevent your sshd server from advertising "weak" ECDSA keys, you need to modify /etc/sshd_config

HostKeyAlgorithms -ecdsa-sha2-nistp256,-ecdsa-sha2-nistp384,-ecdsa-sha2-nistp521

Even better, another way of preventing your sshd server from advertising any "weak" keys would be to specify advertising only strong keys in /etc/sshd_config

HostKeyAlgorithms ssh-ed25519-cert-v[email protected],[email protected],ssh-ed25519,ssh-rsa
Improve this answer
1
  • I tried this and sshd would not restart, and did not generate new keys of any kind. No harm -- I had made a quickie backup in a subdirectory. Also, the config lines do not mention the ed25519 keys (no certs) that I would like to use.
    – ForDummies
    Jan 19 at 16:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .