anchor.diff:  
               if ! test -f ${cfg.hostKeyPath}; then
                   ssh-keygen -t ${hktn} -b ${toString hktb} -f ${cfg.hostKeyPath} -N ""
  +            fi
  +
  +            result=$(ssh-keygen -lf ${cfg.hostKeyPath}|awk '{ print ($1>=${toString hktsb}?1:0)}')
  +            if [ "$result" -ne "1" ]; then
  +              ERROR="SECURITY ALERT: SSH Host Key is too weak. Generate a strong key NOW."
  +              echo "$ERROR"
  +              echo "$ERROR" > /dev/console
               fi
             '';
   
  
positive.code:     v == "no";
  
    hostKeyTypeNames = {
      dsa1024  = "dsa";
      rsa1024  = "rsa";
      ecdsa521 = "ecdsa";
    };
  
    hostKeyTypeBits = {
      dsa1024  = 1024;
      rsa1024  = 1024;
      ecdsa521 = 521;
    };
  
    hktn = attrByPath [cfg.hostKeyType] (throw "unknown host key type `${cfg.hostKeyType}'") hostKeyTypeNames;
    hktb = attrByPath [cfg.hostKeyType] (throw "unknown host key type `${cfg.hostKeyType}'") hostKeyTypeBits;
  
    knownHosts = map (h: getAttr h cfg.knownHosts) (attrNames cfg.knownHosts);
  
  
negative.code: 
          stopIfChanged = false;
  
          path = [ pkgs.openssh pkgs.gawk ];
  
          environment.LD_LIBRARY_PATH = nssModulesPath;
          environment.LOCALE_ARCHIVE = "/run/current-system/sw/lib/locale/locale-archive";
  