2
The defaults for a recent version of openssh are good.
The server's asymmetric key type and client's asymmetric key type are specified in
HostKeyAlgorithms and PubkeyAcceptedAlgorithms respectively.
Modern curves (Ed25519) are preferred over NIST P curves, which are preferred over FFDHE. The curves need to be at least 256 bits, RSA keys need to have a ...
1
I think the IETF CURDLE stuff is a good place to start, see this. I hadn't looked at it in a while, but it appears a lot of the stuff has been moved from draft status to RFC. The only one that's not right now is a suggested updated for KEX for SSH.
1
Here are a few take-aways after some back-and-forth with the OP in the comments:
In OP's model, users' passwords are encrypted and decrypted at the server. This means that the server has knowledge of these passwords at the moments that they are encrypted or decrypted. Some users may not be comfortable with the server having knowledge of their passwords, ...
Only top voted, non community-wiki answers of a minimum length are eligible