lunny/gitea

Archived

Internal ssh server respect Ciphers, MACs and KeyExchanges settings #14523

Merged

root360-StefanHeitmueller merged 2 commits from internal-ssh-ciphers-and-macs into master

2021-01-30 13:20:33 +00:00

root360-StefanHeitmueller commented

2021-01-29 16:42:32 +00:00

(Migrated from github.com)

Fix // TODO: Handle ciphers, keyExchanges, and macs for internal ssh server.
Fix #14518

Details see here (despite it was renamed).

Testconfig:

START_SSH_SERVER = true
SSH_SERVER_MACS  = hmac-sha2-256-etm@openssh.com, hmac-sha2-256
SSH_PORT                   = 2222

Before:

# nmap --script ssh2-enum-algos -sV -p 2222 gitea.example.com
Starting Nmap 7.80 ( https://nmap.org ) at 2021-01-29 17:46 CET
Nmap scan report for gitea.example.com (xxx.xxx.xxx.xxx)
Host is up (0.00055s latency).

PORT     STATE SERVICE VERSION
2222/tcp open  ssh     (protocol 2.0)
| fingerprint-strings: 
|   NULL: 
|_    SSH-2.0-Go
| ssh2-enum-algos: 
|   kex_algorithms: (5)
|       curve25519-sha256@libssh.org
|       ecdh-sha2-nistp256
|       ecdh-sha2-nistp384
|       ecdh-sha2-nistp521
|       diffie-hellman-group14-sha1
|   server_host_key_algorithms: (1)
|       ssh-rsa
|   encryption_algorithms: (5)
|       aes128-gcm@openssh.com
|       chacha20-poly1305@openssh.com
|       aes128-ctr
|       aes192-ctr
|       aes256-ctr
|   mac_algorithms: (4)
|       hmac-sha2-256-etm@openssh.com
|       hmac-sha2-256
|       hmac-sha1
|       hmac-sha1-96
|   compression_algorithms: (1)
|_      none

Afterwards:

# nmap --script ssh2-enum-algos -sV -p 2222 gitea.lan | sed 's,gitea\.lan,gitea.example.com,g'
Starting Nmap 7.80 ( https://nmap.org ) at 2021-01-29 17:47 CET
Nmap scan report for gitea.example.com (xxx.xxx.xxx.xxx)
Host is up (0.00052s latency).

PORT     STATE SERVICE VERSION
2222/tcp open  ssh     (protocol 2.0)
| fingerprint-strings: 
|   NULL: 
|_    SSH-2.0-Go
| ssh2-enum-algos: 
|   kex_algorithms: (6)
|       diffie-hellman-group1-sha1
|       diffie-hellman-group14-sha1
|       ecdh-sha2-nistp256
|       ecdh-sha2-nistp384
|       ecdh-sha2-nistp521
|       curve25519-sha256@libssh.org
|   server_host_key_algorithms: (1)
|       ssh-rsa
|   encryption_algorithms: (6)
|       aes128-ctr
|       aes192-ctr
|       aes256-ctr
|       aes128-gcm@openssh.com
|       arcfour256
|       arcfour128
|   mac_algorithms: (2)
|       hmac-sha2-256-etm@openssh.com
|       hmac-sha2-256
|   compression_algorithms: (1)
|_      none

Fix `// TODO: Handle ciphers, keyExchanges, and macs` for internal ssh server. Fix #14518 Details see [here](https://github.com/gliderlabs/ssh/pull/95) (despite it was [renamed](https://github.com/gliderlabs/ssh/pull/112)). Testconfig: ``` START_SSH_SERVER = true SSH_SERVER_MACS = hmac-sha2-256-etm@openssh.com, hmac-sha2-256 SSH_PORT = 2222 ``` Before: ``` # nmap --script ssh2-enum-algos -sV -p 2222 gitea.example.com Starting Nmap 7.80 ( https://nmap.org ) at 2021-01-29 17:46 CET Nmap scan report for gitea.example.com (xxx.xxx.xxx.xxx) Host is up (0.00055s latency). PORT STATE SERVICE VERSION 2222/tcp open ssh (protocol 2.0) | fingerprint-strings: | NULL: |_ SSH-2.0-Go | ssh2-enum-algos: | kex_algorithms: (5) | curve25519-sha256@libssh.org | ecdh-sha2-nistp256 | ecdh-sha2-nistp384 | ecdh-sha2-nistp521 | diffie-hellman-group14-sha1 | server_host_key_algorithms: (1) | ssh-rsa | encryption_algorithms: (5) | aes128-gcm@openssh.com | chacha20-poly1305@openssh.com | aes128-ctr | aes192-ctr | aes256-ctr | mac_algorithms: (4) | hmac-sha2-256-etm@openssh.com | hmac-sha2-256 | hmac-sha1 | hmac-sha1-96 | compression_algorithms: (1) |_ none ``` Afterwards: ``` # nmap --script ssh2-enum-algos -sV -p 2222 gitea.lan | sed 's,gitea\.lan,gitea.example.com,g' Starting Nmap 7.80 ( https://nmap.org ) at 2021-01-29 17:47 CET Nmap scan report for gitea.example.com (xxx.xxx.xxx.xxx) Host is up (0.00052s latency). PORT STATE SERVICE VERSION 2222/tcp open ssh (protocol 2.0) | fingerprint-strings: | NULL: |_ SSH-2.0-Go | ssh2-enum-algos: | kex_algorithms: (6) | diffie-hellman-group1-sha1 | diffie-hellman-group14-sha1 | ecdh-sha2-nistp256 | ecdh-sha2-nistp384 | ecdh-sha2-nistp521 | curve25519-sha256@libssh.org | server_host_key_algorithms: (1) | ssh-rsa | encryption_algorithms: (6) | aes128-ctr | aes192-ctr | aes256-ctr | aes128-gcm@openssh.com | arcfour256 | arcfour128 | mac_algorithms: (2) | hmac-sha2-256-etm@openssh.com | hmac-sha2-256 | compression_algorithms: (1) |_ none ```

6543 (Migrated from github.com) approved these changes 2021-01-29 17:34:41 +00:00

lunny approved these changes 2021-01-30 11:25:03 +00:00

This repo is archived. You cannot comment on pull requests.

No reviewers

No Label

good first issue

hacktoberfest-accepted

kind/deployment

kind/deprecated

kind/enhancement

kind/moderation

kind/regression

kind/translation

kind/upstream-related

performance/bigrepo

performance/cpu

performance/memory

performance/speed

priority/critical

priority/medium

proposal/rejected

reviewed/confirmed

reviewed/duplicate

reviewed/invalid

reviewed/not-a-bug

reviewed/wontfix

status/needs-feedback

theme/authentication

theme/backup-restore

theme/federation

theme/migration

theme/timetracker

No Milestone

No project

No Assignees

1 Participants

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: lunny/gitea#14523

No description provided.