MacOS – Disable ECDSA SSH Host keys

encryptionmacosSecurityssh

I would like to disable ECDSA SSH host keys.

I deleted the existing keys:

$ sudo rm -f /etc/ssh/ssh_host_ecdsa_key*

I uncomment ECDSA in /etc/ssh/sshd_config

$ grep -i ecdsa /etc/ssh/sshd_config
#HostKey /etc/ssh/ssh_host_ecdsa_key

But when I restart sshd the keys are re-generated

$ sudo launchctl unload /System/Library/LaunchDaemons/ssh.plist
$ sudo launchctl load -w /System/Library/LaunchDaemons/ssh.plist
$ ls -l /etc/ssh/ssh_host_ecdsa_key*
-rw-------  1 root  wheel  480 Nov 16 14:57 /etc/ssh/ssh_host_ecdsa_key
-rw-r--r--  1 root  wheel  162 Nov 16 14:57 /etc/ssh/ssh_host_ecdsa_key.pub

Ideally, the system would not employ weak elliptic curves as ecdsa-sha2-nistp256 at all going forward.

How can I prevent sshd to regenerate the ECDSA keys?

Best Answer

Maybe not the best solution but substituting the key with empty files seems to work:

cd /etc/ssh/
sudo rm ssh_host_ecdsa_key
sudo touch ssh_host_ecdsa_key
sudo rm ssh_host_ecdsa_key.pub
sudo touch ssh_host_ecdsa_key.pub

The key is invalid and not used, but is not corrected/regenerate when starting up

Related Question