SSH server default configuration changes
For the AL2023 AMI, we changed the types of sshd host keys that we generate
with the release. We also dropped some legacy key types to avoid generating them at launch
time. Clients must support the rsa-sha2-256 and rsa-sha2-512
protocols or ssh-ed25519 with use of an ed25519 key. By default,
ssh-rsa signatures are disabled.
Additionally, AL2023 configuration settings in the default sshd_config file
contain UseDNS=no. This new setting means that DNS impairments are
less likely to block your ability to establish ssh sessions with your instances.
The tradeoff is that the
from=
line entries in your hostname.domain,hostname.domainauthorized_keys files won't be resolved. Because
sshd no longer attempts to resolve the DNS names, each comma separated
hostname.domain
For more information, see Default SSH server configuration.
