D3265.diff
No OneTemporary
Actions

Size

712 B

Referenced Files

None

Subscribers

None

D3265.diff
View Options

	diff --git a/roles/core/sshd/files/sshd_config b/roles/core/sshd/files/sshd_config
	--- a/roles/core/sshd/files/sshd_config
	+++ b/roles/core/sshd/files/sshd_config
	@@ -19,6 +19,13 @@
	ListenAddress localhost
	{%- endif %}

	+# Terrapin mitigation
	+# Those ciphers are fine if BOTH SSH client and server are patched.
	+# A up-to-date OpenSSH server isn't enough if the client don't support
	+# strict key exchange. As such, we still disable them.
	+Ciphers -chacha20-poly1305@openssh.com
	+MACs -*etm@openssh.com
	+
	# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
	# but this is overridden so installations will only check .ssh/authorized_keys
	AuthorizedKeysFile .ssh/authorized_keys

File Metadata

Mime Type: text/plain
Expires: Sat, Apr 19, 13:24 (2 h, 49 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 2584705
Default Alt Text: D3265.diff (712 B)

Event Timeline