OpenSSH: how to disallow weak (<2048 bits) RSA keys

Question

Are there any configs for OpenSSH server to disallow weak (e.g. <2048 bits) RSA keys? I'm aware of PubkeyAccetedAlgorithms which can disallow specific key types, incl. rsa-sha2, as a whole.

Answer 1

I can't see it would be run-time configurable, but you could change the compile-time definition of SSH_RSA_MINIMUM_MODULUS_SIZE in sshkey.h and recompile:

#define SSH_RSA_MINIMUM_MODULUS_SIZE    1024

to

#define SSH_RSA_MINIMUM_MODULUS_SIZE    2048

Either that, or just don't install keys that are shorter. It might be possible to scan the users' authorized_keys files for keys that are shorter than that, at least if we accept the length of the encoded key as an indicator of the length of the actual key.

The encoding for a 2048 bit RSA key seems to be 372 characters long, so something like this might match shorter keys:

grep -E 'ssh-rsa [a-zA-Z0-9+/=]{,371}( |$)' file...

Answer 2

The RequiredRSASize option was added in OpenSSH 9.1, released on October 4th, 2022:

• ssh(1), sshd(8): add a RequiredRSASize directive to set a minimum RSA key length. Keys below this length will be ignored for user authentication and for host authentication in sshd(8).

  ssh(1) will terminate a connection if the server offers an RSA key that falls below this limit, as the SSH protocol does not include the ability to retry a failed key exchange.