From 8875db4976024de12d81d54b5e2291ba72064a5b Mon Sep 17 00:00:00 2001
From: Masanori Ogino <167209+omasanori@users.noreply.github.com>
Date: Wed, 21 Oct 2020 07:38:54 +0900
Subject: [PATCH] nixos/sshd: update kexAlgorithms, fix links
The `curve25519-sha256` key exchange method is defined in RFC 8731 that
is identical to curve25519-sha256@libssh.org. OpenSSH supports the
method since version 7.4, released on 2016-12-19. It is literally a
violation of the "both in Secure Secure Shell and Mozilla guidelines"
rule, but it provides essentially the same but a future-proof default.
Also, links to the Mozilla OpenSSH guidelines are updated to refer to
the current place.
Signed-off-by: Masanori Ogino <167209+omasanori@users.noreply.github.com>
---
nixos/modules/services/networking/ssh/sshd.nix | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix
index 5365b8b9b10..1b745931c4f 100644
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@@ -269,6 +269,7 @@ in
kexAlgorithms = mkOption {
type = types.listOf types.str;
default = [
+ "curve25519-sha256"
"curve25519-sha256@libssh.org"
"diffie-hellman-group-exchange-sha256"
];
@@ -279,7 +280,7 @@ in
Defaults to recommended settings from both
and
-
+
'';
};
@@ -300,7 +301,7 @@ in
Defaults to recommended settings from both
and
-
+
'';
};
@@ -321,7 +322,7 @@ in
Defaults to recommended settings from both
and
-
+
'';
};