Harden sshd algorithms (EdgeOS 2)

10-ssh-config

#!/bin/sh
#
# Harden sshd algorithms
#
# EdgeOS 2:
#   Copy this file to /config/scripts/post-config.d/10-ssh-config
#   and make sure it is executable (chmod a+rx).
#
# Auditing ssh servers: https://github.com/jtesta/ssh-audit/
#
# 20220507  Kimmo Suominen
#

cfg=/etc/ssh/sshd_config

grep -q '^HostKeyAlgorithms' "${cfg}" || sed -i -e '
/^$/ {
    i \
HostKeyAlgorithms ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-ed25519\
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512\
MACs umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com
}
' "${cfg}"