I would like to disable ECDSA SSH host keys.
I deleted the existing keys:
$ sudo rm -f /etc/ssh/ssh_host_ecdsa_key*
I uncomment ECDSA in /etc/ssh/sshd_config
$ grep -i ecdsa /etc/ssh/sshd_config #HostKey /etc/ssh/ssh_host_ecdsa_key
But when I restart
sshd the keys are re-generated
$ sudo launchctl unload /System/Library/LaunchDaemons/ssh.plist $ sudo launchctl load -w /System/Library/LaunchDaemons/ssh.plist $ ls -l /etc/ssh/ssh_host_ecdsa_key* -rw------- 1 root wheel 480 Nov 16 14:57 /etc/ssh/ssh_host_ecdsa_key -rw-r--r-- 1 root wheel 162 Nov 16 14:57 /etc/ssh/ssh_host_ecdsa_key.pub
Ideally, the system would not employ weak elliptic curves as ecdsa-sha2-nistp256 at all going forward.
How can I prevent
sshd to regenerate the ECDSA keys?