Mirrors/sftpgo
1
0
Fork 0
mirror of https://github.com/drakkan/sftpgo.git synced 2025-12-06 22:30:56 +03:00
Code Issues Packages Projects Releases Wiki Activity

ssh: remove moduli, log negotiated algorithms

Browse Source 
Fixes #1324

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
This commit is contained in:
Nicola Murino
2024-02-24 20:35:09 +01:00
parent a577d8b3cd
commit f7d9e56cac
14 changed files with 198 additions and 285 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
internal/vfs/sftpfs.go
View File

@@ -956,17 +956,13 @@ func (c *sftpConnection) openConnNoLock() error {
if c.config.Password.GetPayload() != "" {
clientConfig.Auth = append(clientConfig.Auth, ssh.Password(c.config.Password.GetPayload()))
}
// add more ciphers, KEXs and MACs, they are negotiated according to the order
clientConfig.Ciphers = []string{"aes128-gcm@openssh.com", "aes256-gcm@openssh.com", "chacha20-poly1305@openssh.com",
"aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "aes192-cbc", "aes256-cbc"}
clientConfig.KeyExchanges = []string{"curve25519-sha256", "curve25519-sha256@libssh.org",
"ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521",
"diffie-hellman-group14-sha256", "diffie-hellman-group-exchange-sha256",
"diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha1",
"diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"}
clientConfig.MACs = []string{"hmac-sha2-256-etm@openssh.com", "hmac-sha2-256",
"hmac-sha2-512-etm@openssh.com", "hmac-sha2-512",
"hmac-sha1", "hmac-sha1-96"}
supportedAlgos := ssh.SupportedAlgorithms()
insecureAlgos := ssh.InsecureAlgorithms()
// add all available ciphers, KEXs and MACs, they are negotiated according to the order
clientConfig.Ciphers = append(supportedAlgos.Ciphers, ssh.InsecureCipherAES128CBC,
ssh.InsecureCipherAES192CBC, ssh.InsecureCipherAES256CBC)
clientConfig.KeyExchanges = append(supportedAlgos.KeyExchanges, insecureAlgos.KeyExchanges...)
clientConfig.MACs = append(supportedAlgos.MACs, insecureAlgos.MACs...)
sshClient, err := ssh.Dial("tcp", c.config.Endpoint, clientConfig)
if err != nil {
return fmt.Errorf("sftpfs: unable to connect: %w", err)