Enforce sshd key algorithm

Question

In ssh_config I have the HostKeyAlgorithms parameter where I can enforce the use of DSS algorithm for the key, like:

HostKeyAlgorithms "ssh-dss"

How can I do this in sshd_config (daemon config) in order to enforce that all connections incoming should use the ssh-dss instead of ssh-rsa ?

Answer 1

remove

HostKey /etc/ssh/ssh_host_rsa_key

from sshd_config.

I have to note that using 1024 bit keys with either RSA or DSA is no longer considered secure and standard DSA limits key size to 1024 bits (though OpenSSH can generate DSA keys up to 2048bits)