commit 849d40693c79a1dbf59613352f62dbbc29359cf2 Author: David Sorber Date: Mon Aug 20 18:20:54 2018 -0400 Remove no-longer-supported MACs: hmac-ripemd160 diff --git a/software/misc/make_ssh_secure.sh b/software/misc/make_ssh_secure.sh index c9f133b..0437465 100755 --- a/software/misc/make_ssh_secure.sh +++ b/software/misc/make_ssh_secure.sh @@ -15,7 +15,7 @@ fi DAEMON_CONFIG=/etc/ssh/sshd_config echo -e "\nKexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256\n" >> $DAEMON_CONFIG echo -e "Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\n" >> $DAEMON_CONFIG -echo -e "MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com" >> $DAEMON_CONFIG +echo -e "MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com" >> $DAEMON_CONFIG sed -i "s|HostKey /etc/ssh/ssh_host_dsa_key|#HostKey /etc/ssh/ssh_host_dsa_key|g" $DAEMON_CONFIG sed -i "s|HostKey /etc/ssh/ssh_host_ecdsa_key|#HostKey /etc/ssh/ssh_host_ecdsa_key|g" $DAEMON_CONFIG @@ -25,7 +25,7 @@ sed -i "s|HostKey /etc/ssh/ssh_host_ecdsa_key|#HostKey /etc/ssh/ssh_host_ecdsa_k CLIENT_CONFIG=/etc/ssh/ssh_config echo -e " KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256" >> $CLIENT_CONFIG sed -i "s|# Ciphers.*| Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr|g" $CLIENT_CONFIG -sed -i "s|# MACs.*| MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com|g" $CLIENT_CONFIG +sed -i "s|# MACs.*| MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com|g" $CLIENT_CONFIG sed -i "s|# Protocol 2,1| Protocol 2|g" $CLIENT_CONFIG # Remove insecure moduli