The base OpenSSH rc.d script has a nice undocumented set of options that easily allow to disable the automatic creation of undesired, and possibly outdated, keys. Those options are: sshd_rsa1_enable, sshd_rsa_enable, sshd_dsa_enable, sshd_ecdsa_enable, sshd_ed25519_enable Reference: https://svnweb.freebsd.org/base/release/10.3.0/etc/rc.d/sshd?view=markup It's possible to port those options in openssh-portable too? I think they are useful to avoid useless files and to increase the clarity of the overall configuration of a system. For information, a simple workaround I found is to pre-create the empty files for the keys I don't want to be created. This works thanks to bug #202792. As a final remark, the abovementioned options are quite undocumented in the system (not in the man pages). Could be nice to document them. Thank for your support. Best Regards, Nicholas
I don't have time to do it soon, but I'll gladly take a patch. Otherwise I can add this in a few weeks.
Is still not in: : ${sshd_rsa1_enable:="yes"} : ${sshd_rsa_enable:="yes"} : ${sshd_dsa_enable:="yes"} : ${sshd_ecdsa_enable:="yes"} : ${sshd_ed25519_enable:="yes"} but it is the question if this is stil wanted?.
(In reply to w.schwarzenfeld from comment #2) Regarding the two original requests: 1) support of the options in openssh-portable: yes, I think is still wanted as those options exist for the base OpenSSH build. 2) documentation of the options in man pages and handbook (for base OpenSSH): still undocumented. I think they should be documented somewhere.
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=1249b096fa52847f13a956ee0364b2a14c60e9b5 commit 1249b096fa52847f13a956ee0364b2a14c60e9b5 Author: Bryan Drewery <bdrewery@FreeBSD.org> AuthorDate: 2022-03-03 19:35:43 +0000 Commit: Bryan Drewery <bdrewery@FreeBSD.org> CommitDate: 2022-03-03 19:37:07 +0000 security/openssh-portable: Tweak new rc var names Commit ae66cffc19f357cbd5 added new rc vars to control generating of host keys [1]. Rename these to more closely match the base version before it becomes widely adopted. PR: 202169 [1] PR: 209948 [FYI] security/openssh-portable/files/openssh.in | 40 +++++++++++++++--------------- 1 file changed, 20 insertions(+), 20 deletions(-)