You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@karaf.apache.org by jb...@apache.org on 2022/04/08 07:59:11 UTC
[karaf] branch main updated: [KARAF-7363] Allow restriction of signature algorithms for SSH server
This is an automated email from the ASF dual-hosted git repository.
jbonofre pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/karaf.git
The following commit(s) were added to refs/heads/main by this push:
new 4da2926601 [KARAF-7363] Allow restriction of signature algorithms for SSH server
new 2bb388d35b Merge pull request #1487 from seeburger-ag/KARAF-7363
4da2926601 is described below
commit 4da29266015bf61eec6d29e65e7e3c34fca6ed56
Author: Sascha Vogt <s....@seeburger.de>
AuthorDate: Fri Jan 28 22:21:27 2022 +0100
[KARAF-7363] Allow restriction of signature algorithms for SSH server
Signed-off-by: Sascha Vogt <s....@seeburger.de>
---
.../instance/resources/etc/org.apache.karaf.shell.cfg | 6 ++++++
.../java/org/apache/karaf/shell/ssh/Activator.java | 2 ++
.../main/java/org/apache/karaf/shell/ssh/SshUtils.java | 18 ++++++++++++++----
3 files changed, 22 insertions(+), 4 deletions(-)
diff --git a/instance/src/main/resources/org/apache/karaf/instance/resources/etc/org.apache.karaf.shell.cfg b/instance/src/main/resources/org/apache/karaf/instance/resources/etc/org.apache.karaf.shell.cfg
index b5e9a0fa49..fec16fbb13 100644
--- a/instance/src/main/resources/org/apache/karaf/instance/resources/etc/org.apache.karaf.shell.cfg
+++ b/instance/src/main/resources/org/apache/karaf/instance/resources/etc/org.apache.karaf.shell.cfg
@@ -105,6 +105,12 @@ completionMode = GLOBAL
#
# kexAlgorithms = diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
+#
+# Override allowed SSH host key signature algorithms.
+# Default: ssh-rsa,rsa-sha2-256,rsa-sha2-512,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
+#
+# sigAlgorithms = ssh-rsa,rsa-sha2-256,rsa-sha2-512,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
+
#
# Override moduli-url.
# Default: moduli-url not specified to use the internal one from SSHD
diff --git a/shell/ssh/src/main/java/org/apache/karaf/shell/ssh/Activator.java b/shell/ssh/src/main/java/org/apache/karaf/shell/ssh/Activator.java
index d68d1348c3..41748a0460 100644
--- a/shell/ssh/src/main/java/org/apache/karaf/shell/ssh/Activator.java
+++ b/shell/ssh/src/main/java/org/apache/karaf/shell/ssh/Activator.java
@@ -169,6 +169,7 @@ public class Activator extends BaseActivator implements ManagedService {
String[] macs = getStringArray("macs", "hmac-sha2-512,hmac-sha2-256");
String[] ciphers = getStringArray("ciphers", "aes256-ctr,aes192-ctr,aes128-ctr");
String[] kexAlgorithms = getStringArray("kexAlgorithms", "ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256");
+ String[] sigAlgorithms = getStringArray("sigAlgorithms", "ssh-rsa,rsa-sha2-256,rsa-sha2-512,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521");
String welcomeBanner = getString("welcomeBanner", null);
String moduliUrl = getString("moduli-url", null);
boolean sftpEnabled = getBoolean("sftpEnabled", true);
@@ -186,6 +187,7 @@ public class Activator extends BaseActivator implements ManagedService {
server.setMacFactories(SshUtils.buildMacs(macs));
server.setCipherFactories(SshUtils.buildCiphers(ciphers));
server.setKeyExchangeFactories(SshUtils.buildKexAlgorithms(kexAlgorithms));
+ server.setSignatureFactories(SshUtils.buildSigAlgorithms(sigAlgorithms));
server.setShellFactory(new ShellFactoryImpl(sessionFactory));
if (sftpEnabled) {
diff --git a/shell/ssh/src/main/java/org/apache/karaf/shell/ssh/SshUtils.java b/shell/ssh/src/main/java/org/apache/karaf/shell/ssh/SshUtils.java
index 762bdecd7a..aa6aaea41d 100644
--- a/shell/ssh/src/main/java/org/apache/karaf/shell/ssh/SshUtils.java
+++ b/shell/ssh/src/main/java/org/apache/karaf/shell/ssh/SshUtils.java
@@ -27,9 +27,8 @@ import org.apache.sshd.server.ServerBuilder;
import org.apache.sshd.server.SshServer;
import org.apache.sshd.common.NamedFactory;
import org.apache.sshd.common.cipher.Cipher;
-import org.apache.sshd.common.kex.KeyExchange;
import org.apache.sshd.common.mac.Mac;
-
+import org.apache.sshd.common.signature.Signature;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -94,6 +93,13 @@ public class SshUtils {
return filter(avail, names);
}
+ public static List<NamedFactory<Signature>> buildSigAlgorithms(String[] names) {
+ ServerConfig defaults = new ServerConfig();
+ List<NamedFactory<Signature>> avail = defaults.getSignatureAlgorithms();
+
+ return filter(Signature.class, avail, names);
+ }
+
/**
* Simple helper class to avoid duplicating available configuration entries.
*/
@@ -130,8 +136,8 @@ public class SshUtils {
public List<KeyExchangeFactory> getKeyExchangeFactories() {
return keyExchangeFactories;
- }
-
+ }
+
public List<NamedFactory<Cipher>> getCipherFactories() {
return cipherFactories;
}
@@ -139,6 +145,10 @@ public class SshUtils {
public List<NamedFactory<Mac>> getMacFactories() {
return macFactories;
}
+
+ public List<NamedFactory<Signature>> getSignatureAlgorithms() {
+ return signatureFactories;
+ }
}
}