IETF Logo Mail Archive

Re: [Curdle] [saag] Time for SSH3?

Paul Wouters <paul.wouters@aiven.io> Thu, 21 December 2023 14:02 UTC

Return-Path: <paul.wouters@aiven.io>
X-Original-To: curdle@ietfa.amsl.com
Delivered-To: curdle@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82169C15107A for <curdle@ietfa.amsl.com>; Thu, 21 Dec 2023 06:02:30 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -7.107
X-Spam-Level:
X-Spam-Status: No, score=-7.107 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=aiven.io
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TQdxAjSCNkIu for <curdle@ietfa.amsl.com>; Thu, 21 Dec 2023 06:02:26 -0800 (PST)
Received: from mail-lf1-x12d.google.com (mail-lf1-x12d.google.com [IPv6:2a00:1450:4864:20::12d]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7A645C151066 for <curdle@ietf.org>; Thu, 21 Dec 2023 06:02:22 -0800 (PST)
Received: by mail-lf1-x12d.google.com with SMTP id 2adb3069b0e04-50e3295978aso1103862e87.1 for <curdle@ietf.org>; Thu, 21 Dec 2023 06:02:22 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aiven.io; s=google; t=1703167340; x=1703772140; darn=ietf.org; h=to:in-reply-to:cc:references:message-id:date:subject:mime-version :from:content-transfer-encoding:from:to:cc:subject:date:message-id :reply-to; bh=oIevSiLk0Mjdm6hcSoH7ALDnOHK+vOj2UevKIOGzM3c=; b=jkzyMzNuifbFVKx8NZkc8wV7L/pxvcrcW9UsBB7mgypkwdwLZOQg1Qg/cMo+lHnNDd 74JLQAmQvrZPJucZ2QhIwUDWvj90kSGYmwqvMzp3q+fdHmwhxiLT7hEh7nrr09eOOeQv lbVenRqZrJyj+b+EyAc0mKKWPNseIawhIt3LY=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1703167340; x=1703772140; h=to:in-reply-to:cc:references:message-id:date:subject:mime-version :from:content-transfer-encoding:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=oIevSiLk0Mjdm6hcSoH7ALDnOHK+vOj2UevKIOGzM3c=; b=Vro1cZt0HvW/8Cur8oB6sNIIwv63GVyfCdPSFTbCjYJmCt1R5IhqKJAnwEubiNZfmI gkhuCFts78GWOoDKlIKb/MOtrhy6dzwGUwWZpKIszw0YaIOOuzoH/IzoxPk0Dn1P+aYs xQP8RS0hR99XdGXVZE48qSm5z2lDFmWe7mnHF8aC5hyc7JaLcyTNZ9sp2o1BR719sCiW Qs2gT9EQXkamnsm3w61Js5bfj+04oZBJ34tbUNdge94YW+fG07VX8zX6BTLFahuQIX0E uvc/QP0fVc8LYdz3QqhGO7qByXsbWos0LoisEGjktMfaFOeefRXFVUt99ca+bsszfEHN qlVQ==
X-Gm-Message-State: AOJu0Yxd9wmiUnrI1SY8cxkOgYH5in2AR+9R33LrXrtlpVwQrp4P7XPE 1wscm/WUghGNsq+p5DkUuqYLWO0t9/EjvVNW1IvrjDgNAMfghGnTcQzABVrq1gifWyIBeoj5i1h oqZ0ON1KhQNKsYvimzxQVOAsz7K8klLRoacVQyavxgNr0VKlnlnxQ6fxvG5BPTpoNOPVx
X-Google-Smtp-Source: AGHT+IHehypSibUv7HR1rdCwOeQYfb/upenrWiFv7PZkwCwfhUKXtH1U457DekF+TOy6E5TM2vjj7g==
X-Received: by 2002:ac2:5199:0:b0:50e:33fc:d3da with SMTP id u25-20020ac25199000000b0050e33fcd3damr3955169lfi.129.1703167340177; Thu, 21 Dec 2023 06:02:20 -0800 (PST)
Received: from smtpclient.apple ([74.122.52.94]) by smtp.gmail.com with ESMTPSA id h1-20020a0cf8c1000000b0067f07683decsm641061qvo.99.2023.12.21.06.02.19 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 21 Dec 2023 06:02:19 -0800 (PST)
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
From: Paul Wouters <paul.wouters@aiven.io>
Mime-Version: 1.0 (1.0)
Date: Thu, 21 Dec 2023 09:02:07 -0500
Message-Id: <AF53D51E-18C5-4152-A068-05627950FECF@aiven.io>
References: <20231221054354.GB125701@mit.edu>
Cc: Peter Gutmann <pgut001@cs.auckland.ac.nz>, Matt Johnston <matt@ucc.asn.au>, John Mattsson <john.mattsson=40ericsson.com@dmarc.ietf.org>, saag <saag@ietf.org>, curdle@ietf.org
In-Reply-To: <20231221054354.GB125701@mit.edu>
To: Theodore Ts'o <tytso@mit.edu>
X-Mailer: iPhone Mail (21B101)
Archived-At: <https://mailarchive.ietf.org/arch/msg/curdle/iTrq6ZvmPGrj4GwOeQK2sOFR3Nw>
Subject: Re: [Curdle] [saag] Time for SSH3?
X-BeenThere: curdle@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: "List for discussion of potential new security area wg." <curdle.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/curdle>, <mailto:curdle-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/curdle/>
List-Post: <mailto:curdle@ietf.org>
List-Help: <mailto:curdle-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/curdle>, <mailto:curdle-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 21 Dec 2023 14:02:30 -0000

On Dec 21, 2023, at 00:44, Theodore Ts'o <tytso@mit.edu> wrote:
> 
> [1] https://www.ssh-audit.com/hardening_guides.html

This guide does the wrong things for the RHEL entries that I checked by modifying crypto-policies that are not meant to be edited. If you want stricter crypto, run: update-crypto-policies —set FUTURE      (or FIPS)


I have not checked the other OSes listed but based on the RHEL entries I would not recommend these hardening techniques.

Paul

v2.29.0 | Report a Bug | By Email | System Status