Customer has vendor who generates a Scan for PCI compliance on their Debian 8 server.
Taken from their report:
DSA keys and RSA keys shorter than 2048 bits are considered vulnerable. It is recommended to install a RSA public key length of at least 2048 bits or greater, or to switch to ECDSA or EdDSA.
Most of my search returns how to deal with ssh as a client. Of the few that obliquely touch on hardening this server suggest that I look to alter the /etc/ssh/ssh_config.
Even though it is said to be out of date, I ran ssh-audit from my local and it provided some suggestions to remove some of the keys, mac and hex. Seeing the vendor's report I commented out
#HostKey /etc/ssh/ssh_host_ecdsa_key
and restarted the ssh.service and re-ran the ssh-audit from local, which didn't seem to change its list of recommendations suggesting that I've not done something right.
I suspect I'm not doing the right thing to resolve this for my customer. What should I be doing instead?
This is a follow-on to showing PCI vendor that Debian 8 has been successfully patched.