In addition to the configuration, you also need to reset all logs/custom scripts and boot from the base image.
What will be if you have several images? Should we delete all other images?
What will be if you have container images? Should we delete them?
And there are many other nuances.

@Arc771
Could you provide an example of how to generate the required keys? We will test it.
But It should be a separate task

So the original task means that we don't have new CLI options in login keys
Missing sk-ssh-ed25519

vyos@r14# set system login user foo authentication public-keys foo type 
Possible completions:
   ssh-dss              None
   ssh-rsa              None
   ecdsa-sha2-nistp256  None
   ecdsa-sha2-nistp384  None
   ssh-ed25519          None
   ecdsa-sha2-nistp521

PR https://github.com/vyos/vyos-1x/pull/1623

PR https://github.com/vyos/vyos-1x/pull/1631

@zsdc could we backport it to 1.3?

Also, it can be wildcard-address
@Rain Could you create a PR?

PR https://github.com/vyos/vyos-1x/pull/1606

PR https://github.com/vyos/vyos-1x/pull/1604

Tested with next configuration:

vyos@r14:~$ sudo cat /etc/pam.d/common-auth 
auth  required      pam_env.so
auth  required      pam_faillock.so preauth silent audit deny=3 unlock_time=300
auth  sufficient    pam_unix.so  nullok  try_first_pass
auth  [default=die] pam_faillock.so  authfail  audit  deny=3  unlock_time=300
auth  requisite     pam_succeed_if.so uid >= 1000 quiet_success
auth  required      pam_deny.so
vyos@r14:~$

PR https://github.com/vyos/vyatta-cfg-system/pull/186

PR https://github.com/vyos/vyos-1x/pull/1601

set service ssh hostkey-algorithm '[email protected]'
set service ssh hostkey-algorithm 'ssh-rsa'

@CuBiC3D There is a comment of the commit https://github.com/vyos/vyos-1x/commit/373227e717fac82af5ea8d71e611a3df1c59054e

PR https://github.com/vyos/vyos-1x/pull/1598

@adaker
Could you describe the check/test procedure, how to test that all works as you expected?

I mean Linux man https://man7.org/linux/man-pages/man5/sshd_config.5.html

HostKeyAlgorithms
        Specifies the host key signature algorithms that the server
        offers.  The default for this option is:

Also, it should be enabled by default (at least in ssh documentation)
Could you check it?

We already have task T4720