Re: Stronger ssh settings

> On Apr 5, 2026, at 8:04=E2=80=AFAM, Dag-Erling Sm=C3=B8rgrav =
<[email protected]> wrote:
>=20
> Christian Weisgerber <[email protected]> writes:
>> Government standards may require disabling some of the algorithms
>> OpenSSH prefers.  That is more likely a disimprovement.  Anyway,
>> if people would like example configurations compliant with FIPS or
>> such, I don't object.
>=20
> FIPS compliance requires not only using only approved algorithms, but
> also using only approved implementations of those algorithms.  Simply
> editing your ssh(d) configuration will not achieve that.

	Yup. OpenSSH needs to be told to use FIPS using sshd_config (I =
need to figure out where that patch is) and the FIPS module needs to be =
present/configured for the running system.
	FIPS 140* is both =E2=80=9Cstronger=E2=80=9D while also being a =
bit silly about how it=E2=80=99s accomplished (less about the standard =
and more about the folks that help enforce/certify for it): a lot of =
consulting businesses make money validating that FIPS 140* compliance is =
achieved by OSes for a stamp of approval that entities like the US =
Government require in order to get on Approved Product Lists (APL =
compliance). It=E2=80=99s one way of being =E2=80=9Csecure=E2=80=9D, but =
isn=E2=80=99t the end-all-be-all for security in my book *shrug*. Using =
passwordless authentication, for instance, isn=E2=80=99t a requirement =
to get on the APL (last I checked), but it=E2=80=99s a good best =
practice.
Thanks,
-Enji=