You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@tooling.apache.org by ar...@apache.org on 2026/02/17 11:00:21 UTC
(tooling-trusted-releases) branch ssh_security_config created (now a94451de)
This is an automated email from the ASF dual-hosted git repository.
arm pushed a change to branch ssh_security_config
in repository https://gitbox.apache.org/repos/asf/tooling-trusted-releases.git
at a94451de #677 - Add explicit ciphers, kex and mac algorithms.
This branch includes the following new commits:
new a94451de #677 - Add explicit ciphers, kex and mac algorithms.
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org
(tooling-trusted-releases) 01/01: #677 - Add explicit ciphers, kex and mac algorithms.
Posted by ar...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
arm pushed a commit to branch ssh_security_config
in repository https://gitbox.apache.org/repos/asf/tooling-trusted-releases.git
commit a94451de13c388ede79b02449f0a5d2ea57267c6
Author: Alastair McFarlane <ar...@apache.org>
AuthorDate: Tue Feb 17 11:00:09 2026 +0000
#677 - Add explicit ciphers, kex and mac algorithms.
---
atr/ssh.py | 33 +++++++++++++++++++++++++++++++++
1 file changed, 33 insertions(+)
diff --git a/atr/ssh.py b/atr/ssh.py
index b04031a7..46ab5b59 100644
--- a/atr/ssh.py
+++ b/atr/ssh.py
@@ -43,6 +43,36 @@ import atr.util as util
_CONFIG: Final = config.get()
+_APPROVED_CIPHERS: Final[list[str]] = [
+ "chacha20-poly1305@openssh.com",
+ "aes256-gcm@openssh.com",
+ "aes128-gcm@openssh.com",
+ "aes256-ctr",
+ "aes192-ctr",
+ "aes128-ctr",
+]
+
+_APPROVED_KEX: Final[list[str]] = [
+ "rsa2048-sha256",
+ "curve25519-sha256",
+ "ecdh-sha2-nistp256",
+ "diffie-hellman-group16-sha512",
+]
+
+_APPROVED_MACS: Final[list[str]] = [
+ "hmac-sha2-256-etm@openssh.com",
+ "hmac-sha2-512-etm@openssh.com",
+ "hmac-sha1-etm@openssh.com",
+ "hmac-sha2-256",
+ "hmac-sha2-512",
+ "hmac-sha1",
+ "hmac-sha256-2@ssh.com",
+ "hmac-sha224@ssh.com",
+ "hmac-sha256@ssh.com",
+ "hmac-sha384@ssh.com",
+ "hmac-sha512@ssh.com",
+]
+
class RsyncArgsError(Exception):
"""Exception raised when the rsync arguments are invalid."""
@@ -178,6 +208,9 @@ async def server_start() -> asyncssh.SSHAcceptor:
host=_CONFIG.SSH_HOST,
port=_CONFIG.SSH_PORT,
encoding=None,
+ encryption_algs=_APPROVED_CIPHERS,
+ kex_algs=_APPROVED_KEX,
+ mac_algs=_APPROVED_MACS,
)
log.info(f"SSH server started on {_CONFIG.SSH_HOST}:{_CONFIG.SSH_PORT}")
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org