You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tooling.apache.org by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 06:38:01 UTC
[I] SSH server: Configure explicit cipher suites, KEX, and MAC algorithms (tooling-trusted-releases)
andrewmusselman opened a new issue, #677:
URL: https://github.com/apache/tooling-trusted-releases/issues/677
**ASVS References:** 11.3.1 (INFO-02), 11.3.2 (Finding 1 — Medium)
### Description
The SSH server created via `asyncssh.create_server()` in `atr/ssh.py` (line ~147) does not specify explicit `encryption_algs`, `kex_algs`, or `mac_algs`. While asyncssh's current defaults are secure, relying on implicit defaults means:
- A client could potentially negotiate a legacy algorithm if one is supported by the library.
- Future library updates could change defaults without the application noticing.
- There is no auditable record of which algorithms are intentionally permitted.
### Current code
```python
server = await asyncssh.create_server(
SSHServer,
server_host_keys=[key_path],
process_factory=process_factory,
host=_CONFIG.SSH_HOST,
port=_CONFIG.SSH_PORT,
encoding=None,
)
```
### Recommended remediation
```python
APPROVED_CIPHERS = [
'aes256-gcm@openssh.com',
'aes128-gcm@openssh.com',
'aes256-ctr',
'aes128-ctr',
]
APPROVED_KEX = [
'curve25519-sha256',
'ecdh-sha2-nistp256',
'diffie-hellman-group16-sha512',
]
APPROVED_MACS = [
'hmac-sha2-256-etm@openssh.com',
'hmac-sha2-512-etm@openssh.com',
]
server = await asyncssh.create_server(
SSHServer,
server_host_keys=[key_path],
process_factory=process_factory,
host=_CONFIG.SSH_HOST,
port=_CONFIG.SSH_PORT,
encoding=None,
encryption_algs=APPROVED_CIPHERS,
kex_algs=APPROVED_KEX,
mac_algs=APPROVED_MACS,
)
```
### Severity
Medium — This is the only non-informational finding across all three audits. It is a defense-in-depth gap, not an active vulnerability.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] SSH server: Configure explicit cipher suites, KEX, and MAC algorithms (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #677:
URL: https://github.com/apache/tooling-trusted-releases/issues/677#issuecomment-3936076407
Resolved by 030b4fc39add34172696cc0c222fa4751db38d00.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] SSH server: Configure explicit cipher suites, KEX, and MAC algorithms (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp closed issue #677: SSH server: Configure explicit cipher suites, KEX, and MAC algorithms
URL: https://github.com/apache/tooling-trusted-releases/issues/677
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org