SSH transport: Re-enable weak kex algorithms After the upgrade of MINA SSHD to 2.6.0, this change was included: [1], that disabled weak kex algorithms per default, to be aligned with OpenSSH: [2]. Keep the weak kex algorithms disabled per default, but add new configuration option to re-enable them. We should also deprecate those algorithms in next gerrit releases and consider to remove support for weak kex algorithms in future gerrit releases. [1] https://issues.apache.org/jira/browse/SSHD-1004 [2] https://www.zdnet.com/article/openssh-to-deprecate-sha-1-logins-due-to-security-risk Bug: Issue 14644 Change-Id: Icd8680a68f4859c631984a514c6f299cd2c7e77e
diff --git a/Documentation/config-gerrit.txt b/Documentation/config-gerrit.txt index 1c98b9af..93d2a52 100644 --- a/Documentation/config-gerrit.txt +++ b/Documentation/config-gerrit.txt
@@ -5107,6 +5107,16 @@ + By default, all supported MACs are available. +[[sshd.enableDeprecatedKexAlgorithms]]sshd.enableDeprecatedKexAlgorithms:: ++ +Enable deprecated kex algorithms: ++ +* `diffie-hellman-group1-sha1` +* `diffie-hellman-group14-sha1` +* `diffie-hellman-group-exchange-sha1` + +By default, the deprecated kex algorithms are disabled. + [[sshd.kex]]sshd.kex:: + -- @@ -5117,24 +5127,20 @@ algorithms, key exchange algorithm names starting with `-` are removed from the default key exchange algorithms. -In the following example configuration, support for the 1024-bit -`diffie-hellman-group1-sha1` key exchange is disabled while leaving -all of the other default algorithms enabled: - ----- -[sshd] - kex = -diffie-hellman-group1-sha1 ----- - Supported key exchange algorithms: * `ecdh-sha2-nistp521` * `ecdh-sha2-nistp384` * `ecdh-sha2-nistp256` * `diffie-hellman-group-exchange-sha256` -* `diffie-hellman-group-exchange-sha1` -* `diffie-hellman-group14-sha1` -* `diffie-hellman-group1-sha1` +* `diffie-hellman-group18-sha512` +* `diffie-hellman-group17-sha512` +* `diffie-hellman-group16-sha512` +* `diffie-hellman-group15-sha512` +* `diffie-hellman-group14-sha256` + +See link:#sshd.enableDeprecatedKexAlgorithms[sshd.enableDeprecatedKexAlgorithms] +for deprecated key algorithms and how to enable them. By default, all supported key exchange algorithms are available.