I would like to disable ECDSA SSH host keys.

I deleted the existing keys:

$ sudo rm -f /etc/ssh/ssh_host_ecdsa_key*

I uncomment ECDSA in /etc/ssh/sshd_config

$ grep -i ecdsa /etc/ssh/sshd_config
#HostKey /etc/ssh/ssh_host_ecdsa_key

But when I restart sshd the keys are re-generated

$ sudo launchctl unload /System/Library/LaunchDaemons/ssh.plist
$ sudo launchctl load -w /System/Library/LaunchDaemons/ssh.plist
$ ls -l /etc/ssh/ssh_host_ecdsa_key*
-rw-------  1 root  wheel  480 Nov 16 14:57 /etc/ssh/ssh_host_ecdsa_key
-rw-r--r--  1 root  wheel  162 Nov 16 14:57 /etc/ssh/ssh_host_ecdsa_key.pub

Ideally, the system would not employ weak elliptic curves as ecdsa-sha2-nistp256 at all going forward.

How can I prevent sshd to regenerate the ECDSA keys?

  • 1
    See this relevant post: security.stackexchange.com/questions/29262/… – Allan Nov 16 '18 at 14:24
  • @Allan Thanks for the hint. In the end, all the clean solutions involve a new version of OpenSSH. The trick in the question though seems to work – Matteo Nov 16 '18 at 14:32
  • I’m curious why you want to disable this. What’s the benefit you are realizing or goal you’re trying to achieve by this? I would love to answer that question if you still have this requirement unsatisfied. – bmike Feb 9 at 12:15
  • @bmike I would like to disable weak elliptic curves as ecdsa-sha2-nistp256 – Matteo Feb 10 at 14:22

Maybe not the best solution but substituting the key with empty files seems to work:

cd /etc/ssh/
sudo rm ssh_host_ecdsa_key
sudo touch ssh_host_ecdsa_key
sudo rm ssh_host_ecdsa_key.pub
sudo touch ssh_host_ecdsa_key.pub

The key is invalid and not used, but is not corrected/regenerate when starting up

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .