Date: Sat, 28 Jul 2018 19:36:01 +0000 From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 230092] [gce] Fix sshd: Remove arcfour ciphers on gce Message-ID: <bug-230092-227-90Ewt3AHss@https.bugs.freebsd.org/bugzilla/> In-Reply-To: <bug-230092-227@https.bugs.freebsd.org/bugzilla/> References: <bug-230092-227@https.bugs.freebsd.org/bugzilla/>
next in thread | previous in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D230092 --- Comment #7 from commit-hook@freebsd.org --- A commit references this bug: Author: cem Date: Sat Jul 28 19:35:49 UTC 2018 New revision: 336836 URL: https://svnweb.freebsd.org/changeset/base/336836 Log: Remove insecure ciphers from GCE sshd configuration They were added for unclear reasons in r277263. The current OpenSSH defaults (7.5+) are reasonable, and do not include the insecure rc4 ciphe= r: chacha20-poly1305@openssh.com, aes128-ctr,aes192-ctr,aes256-ctr, aes128-gcm@openssh.com,aes256-gcm@openssh.com, aes128-cbc,aes192-cbc,aes256-cbc I think I recall there being a reason for a specific list of ciphers on G= CE at the time, but I do not recall what it was, and cannot find any current GCE documentation of such a list. So, just revert the explicit configuration and use sane openssh defaults. PR: 230092 Submitted by: Gustavo Scalet <gustavo.scalet AT collabora.com> MFC after: 3 days Security: yes Changes: head/release/tools/gce.conf --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-230092-227-90Ewt3AHss>