I am running ubuntu 18.04.3 server HWE edition in my local lab and while reading the manuals I came across the issue that I am unable to determine how to exclude users from connecting to my server via ssh which do not use a key created using the ed25519 algorithm.

I know that I can configure sshd to deny specific ciphers, but I can not find information about restricting the usage of keys with specific algorithms.

I made it sofar that I basically deleted all host keys which are not ed25519 and restricted the renewal to only ed25519, but this obviously will not achieve what I want userside.

Thanks in advance.

  • 1
    "deleted all host keys" ... what does the host key have to do with this? O.o – muru Sep 5 at 3:54
  • Also, why do you wish to deny access to users not using a ed25519 pubkey? – dr01 Sep 5 at 7:23
  • @muru That way my server only identifies itself via ed25519 to incoming ssh-clients alike. I do not want to have my server use anything but that. – Seemax Sep 6 at 0:03
  • @dr01 That I guess is a question of personal flavor. I think ed25519 just does not have the points I consider problems with other algorithms. Not going into detail, that usually only sparks discussion about flavors which I do not want to happen. – Seemax Sep 6 at 0:05
  • You are mixing up user pubkey authentication ("...exclude users from connecting to my server via ssh which do not use a key...") and host authentication ("...That way my server only identifies itself via ed25519..."). Which of these do you want to restrict to ed25519? Both? – dr01 Sep 6 at 5:31

This is not a supported configuration option. To allow only ed25519 user keys, you would need to avoid the sshd provided by your distribution's package manager, and compile your own version from the OpenSSH portable source.

The list of supported key types is struct keytype keytypes[] defined in sshkey.c. All except ed25519 will be excluded by undefing WITH_OPENSSL and WITH_XMSS.

A quick test shows this to work as per your requirements; I would not run such a modified sshd on a production system without more testing and delving into related portions of the code.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.