I have a shell script which adds the below to
sshd_config and then restarts ssh.
cat << EOF >> /etc/ssh/sshd_config KexAlgorithms firstname.lastname@example.org,diffie-hellman-group-exchange-sha256 Ciphers email@example.com,firstname.lastname@example.org,email@example.com MACs firstname.lastname@example.org,email@example.com,firstname.lastname@example.org HostKeyAlgorithms ssh-ed25519,rsa-sha2-256,rsa-sha2-512,email@example.com EOF
It worked fine until I ran it on a Debian 8 box where the given
HostKeyAlgorithms aren't supported, so ssh wouldn't start. Removing the
HostKeyAlgorithms line using emergency console fixed the issue and ssh started.
Is there a clever way for that script to check if these
HostKeyAlgorithms (and maybe
MACs) are supported by SSH before restarting it and risking getting locked out?