vyos@r14:~$ sudo cat /etc/pam.d/common-auth 
auth  required      pam_env.so
auth  required      pam_faillock.so preauth silent audit deny=3 unlock_time=300
auth  sufficient    pam_unix.so  nullok  try_first_pass
auth  [default=die] pam_faillock.so  authfail  audit  deny=3  unlock_time=300
auth  requisite     pam_succeed_if.so uid >= 1000 quiet_success
auth  required      pam_deny.so
vyos@r14:~$

set service ssh hostkey-algorithm 'sk-ssh-ed25519@openssh.com'
set service ssh hostkey-algorithm 'ssh-rsa'

HostKeyAlgorithms
        Specifies the host key signature algorithms that the server
        offers.  The default for this option is:

vyos@r14:~$ show vpn ipsec sa 
Connection         State    Uptime    Bytes In/Out    Packets In/Out    Remote address    Remote ID    Proposal
-----------------  -------  --------  --------------  ----------------  ----------------  -----------  ---------------------------------------
OFFICE-B-tunnel-0  up       4s        0B/0B           0/0               192.0.2.2         192.0.2.2    AES_CBC_256/HMAC_SHA2_256_128/MODP_1024
vyos@r14:~$ 
vyos@r14:~$ 
vyos@r14:~$ reset vpn ipsec-peer OFFICE-B 
closing CHILD_SA OFFICE-B-tunnel-0{16} with SPIs cc364877_i (0 bytes) c521f540_o (0 bytes) and TS 192.168.0.0/24 === 10.0.0.0/21
CHILD_SA {16} closed successfully
generating QUICK_MODE request 1449430238 [ HASH SA No KE ID ID ]
sending packet: from 192.0.2.1[500] to 192.0.2.2[500] (332 bytes)
received packet: from 192.0.2.2[500] to 192.0.2.1[500] (332 bytes)
parsed QUICK_MODE response 1449430238 [ HASH SA No KE ID ID ]
selected proposal: ESP:AES_CBC_256/HMAC_SHA2_256_128/MODP_1024/NO_EXT_SEQ
CHILD_SA OFFICE-B-tunnel-0{17} established with SPIs cd451e27_i cfb63c3c_o and TS 192.168.0.0/24 === 10.0.0.0/21
generating QUICK_MODE request 1449430238 [ HASH ]
sending packet: from 192.0.2.1[500] to 192.0.2.2[500] (76 bytes)
connection 'OFFICE-B-tunnel-0' established successfully
Peer reset result: success
vyos@r14:~$