Skip to content

Commit

Permalink
Add algorithms using RSA with SHA2
Browse files Browse the repository at this point in the history
The recommendation for clients is very outdated not mentioning any RSA-SHA2 algorithms that are standardized for 4 years and the old RSA-SHA1 disabled in OpenSSH upstream causing interoperability problems for people following these guides

https://datatracker.ietf.org/doc/html/rfc8332
https://www.openssh.com/txt/release-8.8

Resolves: mozilla#119
  • Loading branch information
Jakuje authored May 25, 2022
1 parent af4f93e commit f539a26
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions docs/guidelines/openssh.md
Original file line number Diff line number Diff line change
Expand Up @@ -225,7 +225,7 @@ File: `~/.ssh/config`
# Ensure KnownHosts are unreadable if leaked - it is otherwise easier to know which hosts your keys have access to.
HashKnownHosts yes
# Host keys the client accepts - order here is honored by OpenSSH
HostKeyAlgorithms [email protected],ssh-[email protected],ssh-ed25519,ssh-rsa,[email protected],[email protected],[email protected],ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256
HostKeyAlgorithms [email protected],[email protected],rsa-sha2-256-[email protected],ssh-ed25519,rsa-sha2-512,rsa-sha2-256,[email protected],[email protected],[email protected],ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256
KexAlgorithms [email protected],ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
MACs [email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,[email protected]
Expand All @@ -242,7 +242,7 @@ File: `~/.ssh/config`
# Ensure KnownHosts are unreadable if leaked - it is otherwise easier to know which hosts your keys have access to.
HashKnownHosts yes
# Host keys the client accepts - order here is honored by OpenSSH
HostKeyAlgorithms [email protected],[email protected],ssh-ed25519,ssh-rsa,[email protected],[email protected],[email protected],ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256
HostKeyAlgorithms [email protected],[email protected],[email protected],[email protected],ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa,[email protected],[email protected],[email protected],ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256
```

## Key generation
Expand Down

0 comments on commit f539a26

Please sign in to comment.