christianmanivong
23c352aa8a
CI / test (3.10) (push) Successful in 23s
CI / test (3.11) (push) Successful in 22s
CI / test (3.12) (push) Successful in 23s
CI / test (3.10) (pull_request) Successful in 23s
CI / test (3.11) (pull_request) Successful in 22s
CI / test (3.12) (pull_request) Successful in 23s
ssh-audit names algorithms an SSH server should stop offering. Taking them out is the same on every OpenSSH host, so it lives here once: a driver mixes in OpenSshServerMixin and supplies run_command. harden_ssh_server reads the lists sshd really uses (sshd -T), removes the requested algorithms and writes the rest to /etc/ssh/sshd_config.d/00-netork-ssh-hardening.conf -- or, where sshd_config has no Include of that directory, rewrites sshd_config after a copy. It never removes the last algorithm of a list, nor, given the managing client's lists, the last one that client speaks. sshd -t must accept the result and sshd -T must show it; after the reload the caller's verify opens a new session, and if that fails the still-open one puts the previous state back and reloads again. Bumps to 4.5.0. NetOrk/netork#1027