I am trying to fix my SSH setup on Fedora and RedHat with ssh-audit.
I managed to fix the ciphers and algorithms by setting
KexAlgorithms diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,firstname.lastname@example.org Ciphers email@example.com,firstname.lastname@example.org,email@example.com,aes256-ctr,aes192-ctr,aes128-ctr MACs firstname.lastname@example.org,email@example.com,firstname.lastname@example.org
The audit tool is still complaining about the host keys that should be re-generated:
# host-key algorithms [...] (key) ecdsa-sha2-nistp256 -- [fail] using weak elliptic curves `- [warn] using weak random number generator could reveal the key `- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62 [...] # algorithm recommendations (for OpenSSH 7.9) (rec) -ecdsa-sha2-nistp256 -- key algorithm to remove
I then recreated the Diffie-Hellman moduli and generated new keys
rm -fv /etc/ssh/ssh_host_* ssh-keygen -G moduli-2048.candidates -b 2048 ssh-keygen -T moduli-2048 -f moduli-2048.candidates cp moduli-2048 /etc/ssh/moduli ssh-keygen -A
The audit tool is still complaining. How could I use a better random number generator? I can I exclude ecdsa-sha2-nistp256 by the key generation?