I have a shell script which adds the below to sshd_config
and then restarts ssh.
cat << EOF >> /etc/ssh/sshd_config
KexAlgorithms [email protected],diffie-hellman-group-exchange-sha256
Ciphers [email protected],[email protected],[email protected]
MACs [email protected],[email protected],[email protected]
HostKeyAlgorithms ssh-ed25519,rsa-sha2-256,rsa-sha2-512,[email protected]
EOF
It worked fine until I ran it on a Debian 8 box where the given HostKeyAlgorithms
aren't supported, so ssh wouldn't start. Removing the HostKeyAlgorithms
line using emergency console fixed the issue and ssh started.
Is there a clever way for that script to check if these HostKeyAlgorithms
(and maybe KexAlgorithms
, Ciphers
and MACs
) are supported by SSH before restarting it and risking getting locked out?