mirrors/flatcar-scripts
1
0
Fork 0
mirror of https://github.com/flatcar/scripts.git synced 2026-05-04 19:56:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3614 from flatcar/chewi/sshd_config

Browse Source 
coreos-base/misc-files: Drop Ciphers, MACs, KexAlgorithms from sshd conf
This commit is contained in:
James Le Cuirot 2026-01-06 11:56:28 +00:00 committed by GitHub
commit d201d0e2a2
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 1 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
changelog/changes/2026-01-02-sshd-config.md Normal file
View File

@ -0,0 +1 @@
- Dropped Ciphers, MACs, and KexAlgorithms from the sshd configuration so that the OpenSSH upstream defaults are used. This introduces post-quantum key exchange algorithms for better security. ([Flatcar#1921](https://github.com/flatcar/Flatcar/issues/1921)). Users requiring legacy Ciphers, MACs, and/or KexAlgos can override / re-enable this by deploying a custom drop-in config to `/etc/ssh/sshd_config.d/`.

4
sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/openssh/50-flatcar-sshd.conf vendored
View File

@ -16,10 +16,6 @@ PrintLastLog no
PrintMotd no
# END SETTINGS KEPT FOR COMPATIBILITY
Ciphers chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,umac-128-etm@openssh.com,umac-128@openssh.com
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
# Temporarily accept ssh-rsa algorithm for openssh >= 8.8,
# until most ssh clients could deprecate ssh-rsa.
HostkeyAlgorithms +ssh-rsa

0
sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/misc-files-0-r8.ebuild → sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/misc-files-0-r9.ebuild vendored
View File