SSH algorithms (outside view)

Remove weak algorithms from the SSH offer

Debian / Ubuntu

# Keep this session open and test a fresh login from a SECOND session before closing it.
# Coexists with the on-box ssh_weak_ciphers drop-in (00-umbermark-ssh_weak_ciphers.conf): sshd keeps the FIRST value it reads per keyword, so whichever sorts first wins; this one is a superset, so that is harmless.
# A leading '-' removes entries from OpenSSH's default list (OpenSSH 7.5+). On older sshd, `sshd -t` fails and the drop-in is removed again.
# rsa-sha2-256/512 and ssh-ed25519 host keys stay available. If a host only has DSA or very old RSA keys, run `ssh-keygen -A` first to create the missing key types.
# Very old SSH clients that only speak SHA-1 algorithms will stop connecting.
if grep -q '^Include /etc/ssh/sshd_config.d' /etc/ssh/sshd_config; then
install -m 0644 /dev/stdin /etc/ssh/sshd_config.d/00-umbermark-external_ssh_weak_algorithms.conf <<'EOF'
Ciphers -*-cbc,arcfour*
MACs -hmac-md5*,hmac-sha1*,umac-64*
KexAlgorithms -*sha1*
HostKeyAlgorithms -ssh-rsa,ssh-dss
EOF
sshd -t && systemctl reload ssh
if ! sshd -t >/dev/null 2>&1; then rm -f /etc/ssh/sshd_config.d/00-umbermark-external_ssh_weak_algorithms.conf; echo 'sshd -t failed: drop-in removed, nothing changed'; fi
else
echo 'sshd_config has no Include for sshd_config.d (older distro). Put these directives at the TOP of /etc/ssh/sshd_config instead, then run: sshd -t'
fi

RHEL / Rocky / Alma / Fedora

# RHEL 8+/Rocky/Alma/Fedora: sshd's algorithms come from the crypto-policy, not sshd_config.
# This adds a subpolicy that applies to SSH only (the @SSH scope) and removes HMAC-SHA1 there.
# Stock DEFAULT otherwise already leaves out CBC ciphers and SHA-1 key exchange; verify that afterwards.
# Keep this session open and test a fresh login from a SECOND session before closing it.
# The module is appended to whatever policy is active now (never replaces it); FIPS hosts are left alone.
if command -v update-crypto-policies >/dev/null 2>&1; then
cur=$(update-crypto-policies --show)
case "$cur" in
FIPS*)
echo 'FIPS policy active: leave the crypto-policy to your FIPS process; not changed'
;;
*)
install -m 0644 /dev/stdin /etc/crypto-policies/policies/modules/UMBERMARK-SSH.pmod <<'EOF'
mac@SSH = -HMAC-SHA1
EOF
case "$cur" in *UMBERMARK-SSH*) new="$cur" ;; *) new="$cur:UMBERMARK-SSH" ;; esac
update-crypto-policies --set "$new"
sshd -t && systemctl restart sshd
if ! sshd -t >/dev/null 2>&1; then update-crypto-policies --set "$cur"; echo 'sshd -t failed: crypto-policy reset to previous value'; fi
;;
esac
# Afterwards, `update-crypto-policies --show` should print your previous policy followed by :UMBERMARK-SSH and
# `sshd -T | grep -iE '^(ciphers|macs|kexalgorithms) '` should list nothing the check flags.
# If it still does, add another scoped line to the .pmod, e.g. `cipher@SSH = -*-CBC`, and re-run this step.
else
echo 'update-crypto-policies not found: this host does not use system crypto-policies; set Ciphers/MACs/KexAlgorithms in sshd_config instead'
fi