Default RSA host key length

[oeyre]

My security team has expressed concerns regarding the SSH implementation on Netonix and the lack of support for modern crypto algorithms. On investigation it looks like the version of dropbear used (v2020.81) in Netonix SW does in fact support the favoured modern crypto standards, however modern SSH clients refuse to connect since the RSA host key length is 1024 bits even on 1.5.26.

Is there any particular reason for this? Can we change this default in 2026? Is it safe to jump in via CLI and regenerate ourselves to 2048 bits?

[fictitiousexistence]

Looks like the default keysize is set to RSA 2048 now.
But if you have an older key less than 2048 you have to regenerate it.
It seems safe to do so but I would do it from the web gui because sometimes when you restart the dropbear ssh service it does not come back and you have to start it again.

Code: Select all

 
rm /etc/dropbear/dropbear_*
dropbearkey -t rsa -s 3072 -f /etc/dropbear/dropbear_rsa_host_key (or whatever keysize you want)
/etc/init.d/dropbear restart
 OR
/etc/init.d/dropbear stop
/etc/init.d/dropbear start
 

The dropbear version also supports ed25519 which you can use if you update the /etc/init.d/dropbear script.
Would be nice if they removed dss from that script and added ed25519 instead.