feat: OpenSshServerMixin takes flagged algorithms out of what sshd offers #29

2026-10-11T21:12:44Z

christianmanivong commented

2026-10-11 21:12:44 +00:00

Adds ssh_server.py: OpenSshServerMixin.harden_ssh_server (sshd -T → plan → drop-in or sshd_config rewrite → sshd -t → reload → verify → rollback) and the pure plan_ssh_hardening with its safeguards (never the last algorithm of a list, never the last one the managing client speaks). 21 tests against a fake host. Version 4.5.0. For NetOrk/netork#1027.

Adds `ssh_server.py`: `OpenSshServerMixin.harden_ssh_server` (sshd -T → plan → drop-in or sshd_config rewrite → sshd -t → reload → verify → rollback) and the pure `plan_ssh_hardening` with its safeguards (never the last algorithm of a list, never the last one the managing client speaks). 21 tests against a fake host. Version 4.5.0. For NetOrk/netork#1027.

christianmanivong added 1 commit 2026-10-11 21:12:44 +00:00

feat: OpenSshServerMixin takes flagged algorithms out of what sshd offers

CI / test (3.10) (push) Successful in 23s

Details

CI / test (3.11) (push) Successful in 22s

Details

CI / test (3.12) (push) Successful in 23s

Details

CI / test (3.10) (pull_request) Successful in 23s

Details

CI / test (3.11) (pull_request) Successful in 22s

Details

CI / test (3.12) (pull_request) Successful in 23s

Details

23c352aa8a

ssh-audit names algorithms an SSH server should stop offering. Taking them
out is the same on every OpenSSH host, so it lives here once: a driver
mixes in OpenSshServerMixin and supplies run_command.

harden_ssh_server reads the lists sshd really uses (sshd -T), removes the
requested algorithms and writes the rest to
/etc/ssh/sshd_config.d/00-netork-ssh-hardening.conf -- or, where
sshd_config has no Include of that directory, rewrites sshd_config after
a copy. It never removes the last algorithm of a list, nor, given the
managing client's lists, the last one that client speaks. sshd -t must
accept the result and sshd -T must show it; after the reload the caller's
verify opens a new session, and if that fails the still-open one puts the
previous state back and reloads again.

Bumps to 4.5.0. NetOrk/netork#1027

christianmanivong merged commit d43e15e8db into main

2026-10-11 21:14:07 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: NAPALM/napalm-device-types#29