bosh-linux-stemcell-builder icon indicating copy to clipboard operation
bosh-linux-stemcell-builder copied to clipboard

DRAFT: Comply with suggestions from the ssh-audit tool.

Open danielfor opened this issue 1 year ago • 0 comments

The ssh-audit tool suggest to remove certain algorithms from the ssh configuration:

(kex) ecdh-sha2-nistp256                    -- [fail] using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency
(kex) ecdh-sha2-nistp384                    -- [fail] using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency
(kex) ecdh-sha2-nistp521                    -- [fail] using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency
(key) ecdsa-sha2-nistp256                   -- [fail] using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency
(kex) diffie-hellman-group14-sha256         -- [warn] 2048-bit modulus only provides 112-bits of symmetric strength

This commit removes them in our standard jammy stemcell ssh configuration.

However, ecdh and ecdsa algorithms are FIPS compliant. So it's open for discussion if this is a better security posture, and if it is, then it is safe to merge this commit.

danielfor avatar Feb 23 '24 23:02 danielfor