I would like to disable ECDSA SSH host keys.
I deleted the existing keys:
$ sudo rm -f /etc/ssh/ssh_host_ecdsa_key*
I uncomment ECDSA in /etc/ssh/sshd_config
$ grep -i ecdsa /etc/ssh/sshd_config
#HostKey /etc/ssh/ssh_host_ecdsa_key
But when I restart sshd
the keys are re-generated
$ sudo launchctl unload /System/Library/LaunchDaemons/ssh.plist
$ sudo launchctl load -w /System/Library/LaunchDaemons/ssh.plist
$ ls -l /etc/ssh/ssh_host_ecdsa_key*
-rw------- 1 root wheel 480 Nov 16 14:57 /etc/ssh/ssh_host_ecdsa_key
-rw-r--r-- 1 root wheel 162 Nov 16 14:57 /etc/ssh/ssh_host_ecdsa_key.pub
Ideally, the system would not employ weak elliptic curves as ecdsa-sha2-nistp256 at all going forward.
How can I prevent sshd
to regenerate the ECDSA keys?