diff options
| author | Gusted <williamzijl7@hotmail.com> | 2022-02-10 17:04:16 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-02-10 17:04:16 +0100 |
| commit | 581d29ec1dc7289415d5fd8361aa9a5221ba7ad2 (patch) | |
| tree | 6b39bb0c1ddffe76340e4b26873119e381fa195f /custom/conf/app.example.ini | |
| parent | 0c70b4c211a06e94f2a0a906ed205efcc2932d25 (diff) | |
| download | gitea-581d29ec1dc7289415d5fd8361aa9a5221ba7ad2.tar.gz gitea-581d29ec1dc7289415d5fd8361aa9a5221ba7ad2.zip | |
Update SSH Server crypto settings (#18697)
- Use a better and more curated list of Ciphers and KeyExchanges, these roughly follows OpenSSH's default.
- Remove some cryptography values which were deprecated.
Diffstat (limited to 'custom/conf/app.example.ini')
| -rw-r--r-- | custom/conf/app.example.ini | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/custom/conf/app.example.ini b/custom/conf/app.example.ini index f16b1d6a40..26de6dcd80 100644 --- a/custom/conf/app.example.ini +++ b/custom/conf/app.example.ini @@ -113,15 +113,15 @@ RUN_MODE = ; prod ;; ;; For the built-in SSH server, choose the ciphers to support for SSH connections, ;; for system SSH this setting has no effect -;SSH_SERVER_CIPHERS = aes128-ctr, aes192-ctr, aes256-ctr, aes128-gcm@openssh.com, arcfour256, arcfour128 +;SSH_SERVER_CIPHERS = chacha20-poly1305@openssh.com, aes128-ctr, aes192-ctr, aes256-ctr, aes128-gcm@openssh.com, aes256-gcm@openssh.com ;; ;; For the built-in SSH server, choose the key exchange algorithms to support for SSH connections, ;; for system SSH this setting has no effect -;SSH_SERVER_KEY_EXCHANGES = diffie-hellman-group1-sha1, diffie-hellman-group14-sha1, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521, curve25519-sha256@libssh.org +;SSH_SERVER_KEY_EXCHANGES = curve25519-sha256@libssh.org, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521, diffie-hellman-group14-sha1 ;; ;; For the built-in SSH server, choose the MACs to support for SSH connections, ;; for system SSH this setting has no effect -;SSH_SERVER_MACS = hmac-sha2-256-etm@openssh.com, hmac-sha2-256, hmac-sha1, hmac-sha1-96 +;SSH_SERVER_MACS = hmac-sha2-256-etm@openssh.com, hmac-sha2-256, hmac-sha1 ;; ;; For the built-in SSH server, choose the keypair to offer as the host key ;; The private key should be at SSH_SERVER_HOST_KEY and the public SSH_SERVER_HOST_KEY.pub |