From 8875db4976024de12d81d54b5e2291ba72064a5b Mon Sep 17 00:00:00 2001 From: Masanori Ogino <167209+omasanori@users.noreply.github.com> Date: Wed, 21 Oct 2020 07:38:54 +0900 Subject: [PATCH] nixos/sshd: update kexAlgorithms, fix links The `curve25519-sha256` key exchange method is defined in RFC 8731 that is identical to curve25519-sha256@libssh.org. OpenSSH supports the method since version 7.4, released on 2016-12-19. It is literally a violation of the "both in Secure Secure Shell and Mozilla guidelines" rule, but it provides essentially the same but a future-proof default. Also, links to the Mozilla OpenSSH guidelines are updated to refer to the current place. Signed-off-by: Masanori Ogino <167209+omasanori@users.noreply.github.com> --- nixos/modules/services/networking/ssh/sshd.nix | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix index 5365b8b9b10..1b745931c4f 100644 --- a/nixos/modules/services/networking/ssh/sshd.nix +++ b/nixos/modules/services/networking/ssh/sshd.nix @@ -269,6 +269,7 @@ in kexAlgorithms = mkOption { type = types.listOf types.str; default = [ + "curve25519-sha256" "curve25519-sha256@libssh.org" "diffie-hellman-group-exchange-sha256" ]; @@ -279,7 +280,7 @@ in Defaults to recommended settings from both and - + ''; }; @@ -300,7 +301,7 @@ in Defaults to recommended settings from both and - + ''; }; @@ -321,7 +322,7 @@ in Defaults to recommended settings from both and - + ''; };