From 3e20f7c62234549bd2672c2d388de7f531c8d852 Mon Sep 17 00:00:00 2001 From: Joe Testa Date: Wed, 12 Aug 2020 15:26:18 -0400 Subject: [PATCH] Fixed optional host key values. --- policies/openssh_7_7.txt | 3 +++ policies/openssh_7_8.txt | 3 +++ policies/openssh_7_9.txt | 3 +++ policies/openssh_8_0.txt | 3 +++ policies/openssh_8_1.txt | 3 +++ policies/openssh_8_2.txt | 3 +++ policies/openssh_8_3.txt | 3 +++ policies/ubuntu_server_16_04.txt | 2 +- policies/ubuntu_server_18_04.txt | 2 +- policies/ubuntu_server_20_04.txt | 2 +- 10 files changed, 24 insertions(+), 3 deletions(-) diff --git a/policies/openssh_7_7.txt b/policies/openssh_7_7.txt index 57773ce..41d5ba5 100644 --- a/policies/openssh_7_7.txt +++ b/policies/openssh_7_7.txt @@ -11,6 +11,9 @@ dh_modulus_size_diffie-hellman-group-exchange-sha256 = 2048 # The host key types that must match exactly (order matters). host keys = ssh-ed25519 +# Host key types that may optionally appear. +optional host keys = ssh-ed25519-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com + # The key exchange algorithms that must match exactly (order matters). key exchanges = curve25519-sha256, curve25519-sha256@libssh.org, diffie-hellman-group16-sha512, diffie-hellman-group18-sha512, diffie-hellman-group-exchange-sha256 diff --git a/policies/openssh_7_8.txt b/policies/openssh_7_8.txt index 046ed72..d2505b5 100644 --- a/policies/openssh_7_8.txt +++ b/policies/openssh_7_8.txt @@ -11,6 +11,9 @@ dh_modulus_size_diffie-hellman-group-exchange-sha256 = 2048 # The host key types that must match exactly (order matters). host keys = ssh-ed25519 +# Host key types that may optionally appear. +optional host keys = ssh-ed25519-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com + # The key exchange algorithms that must match exactly (order matters). key exchanges = curve25519-sha256, curve25519-sha256@libssh.org, diffie-hellman-group16-sha512, diffie-hellman-group18-sha512, diffie-hellman-group-exchange-sha256 diff --git a/policies/openssh_7_9.txt b/policies/openssh_7_9.txt index 5477b82..0d164d3 100644 --- a/policies/openssh_7_9.txt +++ b/policies/openssh_7_9.txt @@ -11,6 +11,9 @@ dh_modulus_size_diffie-hellman-group-exchange-sha256 = 2048 # The host key types that must match exactly (order matters). host keys = ssh-ed25519 +# Host key types that may optionally appear. +optional host keys = ssh-ed25519-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com + # The key exchange algorithms that must match exactly (order matters). key exchanges = curve25519-sha256, curve25519-sha256@libssh.org, diffie-hellman-group16-sha512, diffie-hellman-group18-sha512, diffie-hellman-group-exchange-sha256 diff --git a/policies/openssh_8_0.txt b/policies/openssh_8_0.txt index 3dad2b1..5843323 100644 --- a/policies/openssh_8_0.txt +++ b/policies/openssh_8_0.txt @@ -11,6 +11,9 @@ dh_modulus_size_diffie-hellman-group-exchange-sha256 = 2048 # The host key types that must match exactly (order matters). host keys = ssh-ed25519 +# Host key types that may optionally appear. +optional host keys = ssh-ed25519-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com + # The key exchange algorithms that must match exactly (order matters). key exchanges = curve25519-sha256, curve25519-sha256@libssh.org, diffie-hellman-group16-sha512, diffie-hellman-group18-sha512, diffie-hellman-group-exchange-sha256 diff --git a/policies/openssh_8_1.txt b/policies/openssh_8_1.txt index 6cdfc3c..e25baf0 100644 --- a/policies/openssh_8_1.txt +++ b/policies/openssh_8_1.txt @@ -11,6 +11,9 @@ dh_modulus_size_diffie-hellman-group-exchange-sha256 = 2048 # The host key types that must match exactly (order matters). host keys = ssh-ed25519 +# Host key types that may optionally appear. +optional host keys = sk-ssh-ed25519@openssh.com, ssh-ed25519-cert-v01@openssh.com, sk-ssh-ed25519-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com + # The key exchange algorithms that must match exactly (order matters). key exchanges = curve25519-sha256, curve25519-sha256@libssh.org, diffie-hellman-group16-sha512, diffie-hellman-group18-sha512, diffie-hellman-group-exchange-sha256 diff --git a/policies/openssh_8_2.txt b/policies/openssh_8_2.txt index 569d3a6..142c1bd 100644 --- a/policies/openssh_8_2.txt +++ b/policies/openssh_8_2.txt @@ -15,6 +15,9 @@ dh_modulus_size_diffie-hellman-group-exchange-sha256 = 2048 # The host key types that must match exactly (order matters). host keys = rsa-sha2-512, rsa-sha2-256, ssh-ed25519 +# Host key types that may optionally appear. +optional host keys = sk-ssh-ed25519@openssh.com, ssh-ed25519-cert-v01@openssh.com, sk-ssh-ed25519-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com + # The key exchange algorithms that must match exactly (order matters). key exchanges = curve25519-sha256, curve25519-sha256@libssh.org, diffie-hellman-group16-sha512, diffie-hellman-group18-sha512, diffie-hellman-group-exchange-sha256 diff --git a/policies/openssh_8_3.txt b/policies/openssh_8_3.txt index b1f5064..b936460 100644 --- a/policies/openssh_8_3.txt +++ b/policies/openssh_8_3.txt @@ -15,6 +15,9 @@ dh_modulus_size_diffie-hellman-group-exchange-sha256 = 2048 # The host key types that must match exactly (order matters). host keys = rsa-sha2-512, rsa-sha2-256, ssh-ed25519 +# Host key types that may optionally appear. +optional host keys = sk-ssh-ed25519@openssh.com, ssh-ed25519-cert-v01@openssh.com, sk-ssh-ed25519-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com + # The key exchange algorithms that must match exactly (order matters). key exchanges = curve25519-sha256, curve25519-sha256@libssh.org, diffie-hellman-group16-sha512, diffie-hellman-group18-sha512, diffie-hellman-group-exchange-sha256 diff --git a/policies/ubuntu_server_16_04.txt b/policies/ubuntu_server_16_04.txt index 5bb2e8b..8fe618c 100644 --- a/policies/ubuntu_server_16_04.txt +++ b/policies/ubuntu_server_16_04.txt @@ -12,7 +12,7 @@ dh_modulus_size_diffie-hellman-group-exchange-sha256 = 2048 host keys = ssh-ed25519 # Host key types that may optionally appear. -optional host keys = sk-ssh-ed25519@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com +optional host keys = ssh-ed25519-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com # The key exchange algorithms that must match exactly (order matters). key exchanges = curve25519-sha256@libssh.org, diffie-hellman-group-exchange-sha256 diff --git a/policies/ubuntu_server_18_04.txt b/policies/ubuntu_server_18_04.txt index cf936f4..a9b6bd6 100644 --- a/policies/ubuntu_server_18_04.txt +++ b/policies/ubuntu_server_18_04.txt @@ -12,7 +12,7 @@ dh_modulus_size_diffie-hellman-group-exchange-sha256 = 2048 host keys = ssh-ed25519 # Host key types that may optionally appear. -optional host keys = sk-ssh-ed25519@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com +optional host keys = ssh-ed25519-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com # The key exchange algorithms that must match exactly (order matters). key exchanges = curve25519-sha256, curve25519-sha256@libssh.org, diffie-hellman-group16-sha512, diffie-hellman-group18-sha512, diffie-hellman-group-exchange-sha256 diff --git a/policies/ubuntu_server_20_04.txt b/policies/ubuntu_server_20_04.txt index b1d4a57..49db45c 100644 --- a/policies/ubuntu_server_20_04.txt +++ b/policies/ubuntu_server_20_04.txt @@ -16,7 +16,7 @@ dh_modulus_size_diffie-hellman-group-exchange-sha256 = 2048 host keys = rsa-sha2-512, rsa-sha2-256, ssh-ed25519 # Host key types that may optionally appear. -optional host keys = sk-ssh-ed25519@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com +optional host keys = sk-ssh-ed25519@openssh.com, ssh-ed25519-cert-v01@openssh.com, sk-ssh-ed25519-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com # The key exchange algorithms that must match exactly (order matters). key exchanges = curve25519-sha256, curve25519-sha256@libssh.org, diffie-hellman-group16-sha512, diffie-hellman-group18-sha512, diffie-hellman-group-exchange-sha256