Re: Stronger ssh settings

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)

--=_a9c4fc90bce811669df60bf14d62b5b5
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=US-ASCII;
 format=flowed

Am 2026-04-04 20:08, schrieb Alexander Leidinger:
> Hi,
> 
> I propose to extend our ssh config (and maybe other configs) regarding
>  - settings for government standards
>  - improved FreeBSD defaults
> 
> Both of them are sort of about the same thing, and at the same time 
> independent from each other, as such I haven'T split it up here. In the 
> example below, I have a patch for improved FreeBSD defaults, and an 
> example of the German BSI recommendation for ssh.
> 
> I would like to get an idea if one or both is considered a welcome 
> change (there was at least a discussion about improved settings in the 
> lists long ago, which was in favour, but no patch), and if yes 
> additional settings for e.g. FIPS or whatever, and a discussion of what 
> the improved FreeBSD defaults should be (I simply included what I use 
> on my systems, and they should work for connections from and to all 
> supported FreeBSD releases as I have them like that since a long time; 
> an alternative would be to use the exclude syntax instead).

To not give a less than optimal impression in this thread, my settings 
where outdated (but from a security POV not weak), here is a better 
example in exclude-notation (for my particular use case, not as the 
specific target of a change):
---snip---
HostKeyAlgorithms -ssh-rsa,[email protected]
Ciphers -3des-cbc,aes128-cbc,aes192-cbc,aes256-cbc
MACs 
-hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected]
KexAlgorithms 
-diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1

# Ciphers and keying
RekeyLimit 1G 1h
---snip---

The difference is, that the above excludes unwanted algorithms, while 
allowing new algorithms on updates, whereas my previous example was 
setting in stone the algorithms of a particular date (long ago).

Bye,
Alexander.

-- 
http://www.Leidinger.net [email protected]: PGP 0x8F31830F9F2772BF
http://www.FreeBSD.org    [email protected]  : PGP 0x8F31830F9F2772BF

--=_a9c4fc90bce811669df60bf14d62b5b5
Content-Type: application/pgp-signature;
 name=signature.asc
Content-Disposition: attachment;
 filename=signature.asc;
 size=833
Content-Description: OpenPGP digital signature

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEER9UlYXp1PSd08nWXEg2wmwP42IYFAmnUxg4ACgkQEg2wmwP4
2IaDCw//ZUzX5v9BWuTQbCy86GF8/91kmadow3Nd3XejZoj1jc1EnCxlF8Dz/gbT
Y0S1iylzrkLhnBsWHsF/Al0AGmovwcEc1X719/KF9B1+lqerpqZyv3uWdLnLYiJJ
SHABrijSU/yYavBs7uYKkm8lPrXxsvpFOAdKZOeubJ/rxCE+g+s4vVYiLifMaTvj
qUTvQ+OSoXqPlFbhcLfNqCuFxD6mZOi0+LJyIkgPonSBEANrkGf0jPc58G29O5bJ
PoetLhWeYCDD2J6QKrnKsV/rJoEHfqXT0yItD6TAiIw2t4fq8BXzZi8nbaIMJzVR
DDo7mMQObWfbDebsbmeOVSJ1VM7cLxriOA93Irla/cYVSxnHBL9hmIUPyaMLUn7p
V1zFPoWcldMMCN+NIoLiZskFMRZMdO052TX6FOu8Y4h8y/lWbtJwlHR+ryhGJXRl
LDxUhXHfh/U52m9keQ7LDMJOzknRZKBxgbdfPaMq9e4CFiHnCUavmF9aJcCC+K1o
1iVFKM921FKiL2FCgDK0pkU2QRmpD23Ekk9OOlzFJfOCJF89zyFix5LdpXjfCGit
gT7/1629CDVxaN/gLhzkzV+pAub7B2vubt4uUBsgHlj9QGfLcL8QcxXUg807jtFh
HtCk65NfEz86FJ+S3KD/GW8kZYLAF7NE2J2kOSSG0NNrgHdu/IU=
=PRY3
-----END PGP SIGNATURE-----

--=_a9c4fc90bce811669df60bf14d62b5b5--