|
 |
51f5c1c |
diff -up openssh/ssh_config.5.crypto-policies openssh/ssh_config.5
|
|
|
51f5c1c |
--- openssh/ssh_config.5.crypto-policies 2020-02-07 15:05:55.665451715 +0100
|
|
|
51f5c1c |
+++ openssh/ssh_config.5 2020-02-07 15:07:11.632641922 +0100
|
|
|
51f5c1c |
@@ -361,15 +361,15 @@ domains.
|
|
|
51f5c1c |
.It Cm CASignatureAlgorithms
|
|
|
51f5c1c |
Specifies which algorithms are allowed for signing of certificates
|
|
|
51f5c1c |
by certificate authorities (CAs).
|
|
|
51f5c1c |
-The default is:
|
|
|
51f5c1c |
-.Bd -literal -offset indent
|
|
|
51f5c1c |
-ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
|
|
|
51f5c1c |
-ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
|
|
|
51f5c1c |
-.Ed
|
|
|
51f5c1c |
-.Pp
|
|
|
51f5c1c |
.Xr ssh 1
|
|
|
51f5c1c |
will not accept host certificates signed using algorithms other than those
|
|
|
51f5c1c |
specified.
|
|
|
51f5c1c |
+.Pp
|
|
|
51f5c1c |
+The default is handled system-wide by
|
|
|
51f5c1c |
+.Xr crypto-policies 7 .
|
|
|
51f5c1c |
+To see the defaults and how to modify this default, see manual page
|
|
|
51f5c1c |
+.Xr update-crypto-policies 8 .
|
|
|
51f5c1c |
+.Pp
|
|
|
51f5c1c |
.It Cm CertificateFile
|
|
|
51f5c1c |
Specifies a file from which the user's certificate is read.
|
|
|
51f5c1c |
A corresponding private key must be provided separately in order
|
|
|
51f5c1c |
@@ -453,12 +453,10 @@ aes256-gcm@openssh.com
|
|
|
6caa973 |
chacha20-poly1305@openssh.com
|
|
|
6caa973 |
.Ed
|
|
|
6caa973 |
.Pp
|
|
|
6caa973 |
-The default is:
|
|
|
6caa973 |
-.Bd -literal -offset indent
|
|
|
6caa973 |
-chacha20-poly1305@openssh.com,
|
|
|
6caa973 |
-aes128-ctr,aes192-ctr,aes256-ctr,
|
|
|
6caa973 |
-aes128-gcm@openssh.com,aes256-gcm@openssh.com
|
|
|
6caa973 |
-.Ed
|
|
|
6caa973 |
+The default is handled system-wide by
|
|
|
6caa973 |
+.Xr crypto-policies 7 .
|
|
|
fdbd5bc |
+To see the defaults and how to modify this default, see manual page
|
|
|
6caa973 |
+.Xr update-crypto-policies 8 .
|
|
|
6caa973 |
.Pp
|
|
|
6caa973 |
The list of available ciphers may also be obtained using
|
|
|
6caa973 |
.Qq ssh -Q cipher .
|
|
|
1cc7c87 |
@@ -824,9 +822,10 @@ gss-nistp256-sha256-,
|
|
|
6caa973 |
gss-curve25519-sha256-
|
|
|
6caa973 |
.Ed
|
|
|
6caa973 |
.Pp
|
|
|
6caa973 |
-The default is
|
|
|
1cc7c87 |
-.Dq gss-group14-sha256-,gss-group16-sha512-,gss-nistp256-sha256-,
|
|
|
1cc7c87 |
-gss-curve25519-sha256-,gss-group14-sha1-,gss-gex-sha1- .
|
|
|
6caa973 |
+The default is handled system-wide by
|
|
|
6caa973 |
+.Xr crypto-policies 7 .
|
|
|
fdbd5bc |
+To see the defaults and how to modify this default, see manual page
|
|
|
6caa973 |
+.Xr update-crypto-policies 8 .
|
|
|
1cc7c87 |
This option only applies to connections using GSSAPI.
|
|
|
6caa973 |
.It Cm HashKnownHosts
|
|
|
6caa973 |
Indicates that
|
|
|
51f5c1c |
@@ -1162,15 +1162,10 @@ If the specified list begins with a
|
|
|
36fef56 |
.Sq ^
|
|
|
36fef56 |
character, then the specified methods will be placed at the head of the
|
|
|
36fef56 |
default set.
|
|
|
6caa973 |
-The default is:
|
|
|
6caa973 |
-.Bd -literal -offset indent
|
|
|
6caa973 |
-curve25519-sha256,curve25519-sha256@libssh.org,
|
|
|
6caa973 |
-ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
|
|
|
6caa973 |
-diffie-hellman-group-exchange-sha256,
|
|
|
6caa973 |
-diffie-hellman-group16-sha512,
|
|
|
6caa973 |
-diffie-hellman-group18-sha512,
|
|
|
51f5c1c |
-diffie-hellman-group14-sha256
|
|
|
6caa973 |
-.Ed
|
|
|
6caa973 |
+The default is handled system-wide by
|
|
|
6caa973 |
+.Xr crypto-policies 7 .
|
|
|
fdbd5bc |
+To see the defaults and how to modify this default, see manual page
|
|
|
6caa973 |
+.Xr update-crypto-policies 8 .
|
|
|
6caa973 |
.Pp
|
|
|
6caa973 |
The list of available key exchange algorithms may also be obtained using
|
|
|
6caa973 |
.Qq ssh -Q kex .
|
|
|
51f5c1c |
@@ -1252,14 +1247,10 @@ The algorithms that contain
|
|
|
6caa973 |
calculate the MAC after encryption (encrypt-then-mac).
|
|
|
6caa973 |
These are considered safer and their use recommended.
|
|
|
6caa973 |
.Pp
|
|
|
6caa973 |
-The default is:
|
|
|
6caa973 |
-.Bd -literal -offset indent
|
|
|
6caa973 |
-umac-64-etm@openssh.com,umac-128-etm@openssh.com,
|
|
|
6caa973 |
-hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,
|
|
|
6caa973 |
-hmac-sha1-etm@openssh.com,
|
|
|
6caa973 |
-umac-64@openssh.com,umac-128@openssh.com,
|
|
|
6caa973 |
-hmac-sha2-256,hmac-sha2-512,hmac-sha1
|
|
|
6caa973 |
-.Ed
|
|
|
6caa973 |
+The default is handled system-wide by
|
|
|
6caa973 |
+.Xr crypto-policies 7 .
|
|
|
fdbd5bc |
+To see the defaults and how to modify this default, see manual page
|
|
|
6caa973 |
+.Xr update-crypto-policies 8 .
|
|
|
6caa973 |
.Pp
|
|
|
6caa973 |
The list of available MAC algorithms may also be obtained using
|
|
|
6caa973 |
.Qq ssh -Q mac .
|
|
|
51f5c1c |
@@ -1407,22 +1398,10 @@ If the specified list begins with a
|
|
|
36fef56 |
.Sq ^
|
|
|
36fef56 |
character, then the specified key types will be placed at the head of the
|
|
|
36fef56 |
default set.
|
|
|
6caa973 |
-The default for this option is:
|
|
|
6caa973 |
-.Bd -literal -offset 3n
|
|
|
6caa973 |
-ecdsa-sha2-nistp256-cert-v01@openssh.com,
|
|
|
6caa973 |
-ecdsa-sha2-nistp384-cert-v01@openssh.com,
|
|
|
6caa973 |
-ecdsa-sha2-nistp521-cert-v01@openssh.com,
|
|
|
51f5c1c |
-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
|
|
|
6caa973 |
-ssh-ed25519-cert-v01@openssh.com,
|
|
|
51f5c1c |
-sk-ssh-ed25519-cert-v01@openssh.com,
|
|
|
51f5c1c |
-rsa-sha2-512-cert-v01@openssh.com,
|
|
|
51f5c1c |
-rsa-sha2-256-cert-v01@openssh.com,
|
|
|
6caa973 |
-ssh-rsa-cert-v01@openssh.com,
|
|
|
6caa973 |
-ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
|
|
|
51f5c1c |
-sk-ecdsa-sha2-nistp256@openssh.com,
|
|
|
51f5c1c |
-ssh-ed25519,sk-ssh-ed25519@openssh.com,
|
|
|
51f5c1c |
-rsa-sha2-512,rsa-sha2-256,ssh-rsa
|
|
|
6caa973 |
-.Ed
|
|
|
6caa973 |
+The default is handled system-wide by
|
|
|
6caa973 |
+.Xr crypto-policies 7 .
|
|
|
fdbd5bc |
+To see the defaults and how to modify this default, see manual page
|
|
|
6caa973 |
+.Xr update-crypto-policies 8 .
|
|
|
6caa973 |
.Pp
|
|
|
6caa973 |
The list of available key types may also be obtained using
|
|
|
51f5c1c |
.Qq ssh -Q PubkeyAcceptedKeyTypes .
|
|
|
51f5c1c |
diff -up openssh/sshd_config.5.crypto-policies openssh/sshd_config.5
|
|
|
51f5c1c |
--- openssh/sshd_config.5.crypto-policies 2020-02-07 15:05:55.639451308 +0100
|
|
|
51f5c1c |
+++ openssh/sshd_config.5 2020-02-07 15:05:55.672451825 +0100
|
|
|
51f5c1c |
@@ -377,14 +377,14 @@ By default, no banner is displayed.
|
|
|
51f5c1c |
.It Cm CASignatureAlgorithms
|
|
|
51f5c1c |
Specifies which algorithms are allowed for signing of certificates
|
|
|
51f5c1c |
by certificate authorities (CAs).
|
|
|
51f5c1c |
-The default is:
|
|
|
51f5c1c |
-.Bd -literal -offset indent
|
|
|
51f5c1c |
-ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
|
|
|
51f5c1c |
-ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
|
|
|
51f5c1c |
-.Ed
|
|
|
51f5c1c |
-.Pp
|
|
|
51f5c1c |
Certificates signed using other algorithms will not be accepted for
|
|
|
51f5c1c |
public key or host-based authentication.
|
|
|
51f5c1c |
+.Pp
|
|
|
51f5c1c |
+The default is handled system-wide by
|
|
|
51f5c1c |
+.Xr crypto-policies 7 .
|
|
|
51f5c1c |
+To see the defaults and how to modify this default, see manual page
|
|
|
51f5c1c |
+.Xr update-crypto-policies 8 .
|
|
|
51f5c1c |
+.Pp
|
|
|
51f5c1c |
.It Cm ChallengeResponseAuthentication
|
|
|
51f5c1c |
Specifies whether challenge-response authentication is allowed (e.g. via
|
|
|
51f5c1c |
PAM or through authentication styles supported in
|
|
|
51f5c1c |
@@ -486,12 +486,10 @@ aes256-gcm@openssh.com
|
|
|
6caa973 |
chacha20-poly1305@openssh.com
|
|
|
6caa973 |
.El
|
|
|
6caa973 |
.Pp
|
|
|
6caa973 |
-The default is:
|
|
|
6caa973 |
-.Bd -literal -offset indent
|
|
|
6caa973 |
-chacha20-poly1305@openssh.com,
|
|
|
6caa973 |
-aes128-ctr,aes192-ctr,aes256-ctr,
|
|
|
6caa973 |
-aes128-gcm@openssh.com,aes256-gcm@openssh.com
|
|
|
6caa973 |
-.Ed
|
|
|
6caa973 |
+The default is handled system-wide by
|
|
|
6caa973 |
+.Xr crypto-policies 7 .
|
|
|
fdbd5bc |
+To see the defaults and how to modify this default, see manual page
|
|
|
6caa973 |
+.Xr update-crypto-policies 8 .
|
|
|
6caa973 |
.Pp
|
|
|
6caa973 |
The list of available ciphers may also be obtained using
|
|
|
6caa973 |
.Qq ssh -Q cipher .
|
|
|
1cc7c87 |
@@ -693,9 +691,10 @@ gss-nistp256-sha256-,
|
|
|
6caa973 |
gss-curve25519-sha256-
|
|
|
6caa973 |
.Ed
|
|
|
6caa973 |
.Pp
|
|
|
6caa973 |
-The default is
|
|
|
1cc7c87 |
-.Dq gss-group14-sha256-,gss-group16-sha512-,gss-nistp256-sha256-,
|
|
|
1cc7c87 |
-gss-curve25519-sha256-,gss-group14-sha1-,gss-gex-sha1- .
|
|
|
6caa973 |
+The default is handled system-wide by
|
|
|
6caa973 |
+.Xr crypto-policies 7 .
|
|
|
fdbd5bc |
+To see the defaults and how to modify this default, see manual page
|
|
|
6caa973 |
+.Xr update-crypto-policies 8 .
|
|
|
1cc7c87 |
This option only applies to connections using GSSAPI.
|
|
|
6caa973 |
.It Cm HostbasedAcceptedKeyTypes
|
|
|
6caa973 |
Specifies the key types that will be accepted for hostbased authentication
|
|
|
51f5c1c |
@@ -794,22 +794,10 @@ environment variable.
|
|
|
6caa973 |
.It Cm HostKeyAlgorithms
|
|
|
6caa973 |
Specifies the host key algorithms
|
|
|
6caa973 |
that the server offers.
|
|
|
6caa973 |
-The default for this option is:
|
|
|
6caa973 |
-.Bd -literal -offset 3n
|
|
|
6caa973 |
-ecdsa-sha2-nistp256-cert-v01@openssh.com,
|
|
|
6caa973 |
-ecdsa-sha2-nistp384-cert-v01@openssh.com,
|
|
|
6caa973 |
-ecdsa-sha2-nistp521-cert-v01@openssh.com,
|
|
|
51f5c1c |
-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
|
|
|
6caa973 |
-ssh-ed25519-cert-v01@openssh.com,
|
|
|
51f5c1c |
-sk-ssh-ed25519-cert-v01@openssh.com,
|
|
|
51f5c1c |
-rsa-sha2-512-cert-v01@openssh.com,
|
|
|
51f5c1c |
-rsa-sha2-256-cert-v01@openssh.com,
|
|
|
6caa973 |
-ssh-rsa-cert-v01@openssh.com,
|
|
|
6caa973 |
-ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
|
|
|
51f5c1c |
-sk-ecdsa-sha2-nistp256@openssh.com,
|
|
|
51f5c1c |
-ssh-ed25519,sk-ssh-ed25519@openssh.com,
|
|
|
51f5c1c |
-rsa-sha2-512,rsa-sha2-256,ssh-rsa
|
|
|
6caa973 |
-.Ed
|
|
|
6caa973 |
+The default is handled system-wide by
|
|
|
6caa973 |
+.Xr crypto-policies 7 .
|
|
|
fdbd5bc |
+To see the defaults and how to modify this default, see manual page
|
|
|
6caa973 |
+.Xr update-crypto-policies 8 .
|
|
|
6caa973 |
.Pp
|
|
|
6caa973 |
The list of available key types may also be obtained using
|
|
|
51f5c1c |
.Qq ssh -Q HostKeyAlgorithms .
|
|
|
51f5c1c |
@@ -987,14 +975,10 @@ ecdh-sha2-nistp521
|
|
|
51f5c1c |
sntrup4591761x25519-sha512@tinyssh.org
|
|
|
6caa973 |
.El
|
|
|
6caa973 |
.Pp
|
|
|
6caa973 |
-The default is:
|
|
|
6caa973 |
-.Bd -literal -offset indent
|
|
|
6caa973 |
-curve25519-sha256,curve25519-sha256@libssh.org,
|
|
|
6caa973 |
-ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
|
|
|
6caa973 |
-diffie-hellman-group-exchange-sha256,
|
|
|
6caa973 |
-diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,
|
|
|
51f5c1c |
-diffie-hellman-group14-sha256
|
|
|
6caa973 |
-.Ed
|
|
|
6caa973 |
+The default is handled system-wide by
|
|
|
6caa973 |
+.Xr crypto-policies 7 .
|
|
|
fdbd5bc |
+To see the defaults and how to modify this default, see manual page
|
|
|
6caa973 |
+.Xr update-crypto-policies 8 .
|
|
|
6caa973 |
.Pp
|
|
|
6caa973 |
The list of available key exchange algorithms may also be obtained using
|
|
|
51f5c1c |
.Qq ssh -Q KexAlgorithms .
|
|
|
51f5c1c |
@@ -1121,14 +1105,10 @@ umac-64-etm@openssh.com
|
|
|
6caa973 |
umac-128-etm@openssh.com
|
|
|
6caa973 |
.El
|
|
|
6caa973 |
.Pp
|
|
|
6caa973 |
-The default is:
|
|
|
6caa973 |
-.Bd -literal -offset indent
|
|
|
6caa973 |
-umac-64-etm@openssh.com,umac-128-etm@openssh.com,
|
|
|
6caa973 |
-hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,
|
|
|
6caa973 |
-hmac-sha1-etm@openssh.com,
|
|
|
6caa973 |
-umac-64@openssh.com,umac-128@openssh.com,
|
|
|
6caa973 |
-hmac-sha2-256,hmac-sha2-512,hmac-sha1
|
|
|
6caa973 |
-.Ed
|
|
|
6caa973 |
+The default is handled system-wide by
|
|
|
6caa973 |
+.Xr crypto-policies 7 .
|
|
|
fdbd5bc |
+To see the defaults and how to modify this default, see manual page
|
|
|
6caa973 |
+.Xr update-crypto-policies 8 .
|
|
|
6caa973 |
.Pp
|
|
|
6caa973 |
The list of available MAC algorithms may also be obtained using
|
|
|
6caa973 |
.Qq ssh -Q mac .
|
|
|
51f5c1c |
@@ -1492,22 +1472,10 @@ If the specified list begins with a
|
|
|
36fef56 |
.Sq ^
|
|
|
36fef56 |
character, then the specified key types will be placed at the head of the
|
|
|
36fef56 |
default set.
|
|
|
6caa973 |
-The default for this option is:
|
|
|
6caa973 |
-.Bd -literal -offset 3n
|
|
|
6caa973 |
-ecdsa-sha2-nistp256-cert-v01@openssh.com,
|
|
|
6caa973 |
-ecdsa-sha2-nistp384-cert-v01@openssh.com,
|
|
|
6caa973 |
-ecdsa-sha2-nistp521-cert-v01@openssh.com,
|
|
|
51f5c1c |
-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
|
|
|
6caa973 |
-ssh-ed25519-cert-v01@openssh.com,
|
|
|
51f5c1c |
-sk-ssh-ed25519-cert-v01@openssh.com,
|
|
|
51f5c1c |
-rsa-sha2-512-cert-v01@openssh.com,
|
|
|
51f5c1c |
-rsa-sha2-256-cert-v01@openssh.com,
|
|
|
6caa973 |
-ssh-rsa-cert-v01@openssh.com,
|
|
|
6caa973 |
-ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
|
|
|
51f5c1c |
-sk-ecdsa-sha2-nistp256@openssh.com,
|
|
|
51f5c1c |
-ssh-ed25519,sk-ssh-ed25519@openssh.com,
|
|
|
51f5c1c |
-rsa-sha2-512,rsa-sha2-256,ssh-rsa
|
|
|
6caa973 |
-.Ed
|
|
|
6caa973 |
+The default is handled system-wide by
|
|
|
6caa973 |
+.Xr crypto-policies 7 .
|
|
|
fdbd5bc |
+To see the defaults and how to modify this default, see manual page
|
|
|
6caa973 |
+.Xr update-crypto-policies 8 .
|
|
|
6caa973 |
.Pp
|
|
|
6caa973 |
The list of available key types may also be obtained using
|
|
|
51f5c1c |
.Qq ssh -Q PubkeyAcceptedKeyTypes .
|