Skip to content

Configurable SSH cipher suite #913

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 7 commits into from
Oct 21, 2017
Merged

Configurable SSH cipher suite #913

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
139a538
Configurable SSH cipher suite
spacetourist Feb 12, 2017
9286f58
Merge branch 'master' into master
lafriks Oct 18, 2017
5865a28
Update configuration file comment
lafriks Oct 18, 2017
372a1c7
Add default in settings loading code
lafriks Oct 18, 2017
c3a8c48
Fix fmt and log messsage
lafriks Oct 18, 2017
99633ae
Remove default from code as this could probably might not be good idea
lafriks Oct 18, 2017
3b66029
Merge branch 'master' into master
bkcsoft Oct 21, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions conf/app.ini
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,6 +110,8 @@ SSH_PORT = 22
SSH_LISTEN_PORT = %(SSH_PORT)s
; Root path of SSH directory, default is '~/.ssh', but you have to use '/home/git/.ssh'.
SSH_ROOT_PATH =
; Choose the ciphers to support for SSH connections
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please make it clear that this only affects Built-In SSH-server

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more. 

; For built-in SSH server only, choose the ciphers to support for SSH connections,
; for system SSH this setting has no effect

SSH_SERVER_CIPHERS = aes128-ctr, aes192-ctr, aes256-ctr, [email protected], arcfour256, arcfour128
; Directory to create temporary files when test publick key using ssh-keygen,
; default is system temporary directory.
SSH_KEY_TEST_PATH =
Expand Down
2 changes: 2 additions & 0 deletions modules/setting/setting.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,7 @@ var (
ListenHost string `ini:"SSH_LISTEN_HOST"`
ListenPort int `ini:"SSH_LISTEN_PORT"`
RootPath string `ini:"SSH_ROOT_PATH"`
ServerCiphers []string `ini:"SSH_SERVER_CIPHERS"`
KeyTestPath string `ini:"SSH_KEY_TEST_PATH"`
KeygenPath string `ini:"SSH_KEYGEN_PATH"`
MinimumKeySizeCheck bool `ini:"-"`
Expand Down Expand Up @@ -618,6 +619,7 @@ please consider changing to GITEA_CUSTOM`)
}

SSH.RootPath = path.Join(homeDir, ".ssh")
SSH.ServerCiphers = sec.Key("SSH_SERVER_CIPHERS").Strings(",")
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Requires a default value?

SSH.KeyTestPath = os.TempDir()
if err = Cfg.Section("server").MapTo(&SSH); err != nil {
log.Fatal(4, "Failed to map SSH settings: %v", err)
Expand Down
5 changes: 4 additions & 1 deletion modules/ssh/ssh.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,8 +151,11 @@ func listen(config *ssh.ServerConfig, host string, port int) {
}

// Listen starts a SSH server listens on given port.
func Listen(host string, port int) {
func Listen(host string, port int, ciphers []string) {
config := &ssh.ServerConfig{
Config: ssh.Config{
Ciphers: ciphers,
},
PublicKeyCallback: func(conn ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) {
pkey, err := models.SearchPublicKeyByContent(strings.TrimSpace(string(ssh.MarshalAuthorizedKey(key))))
if err != nil {
Expand Down
4 changes: 2 additions & 2 deletions routers/init.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,7 +75,7 @@ func GlobalInit() {
checkRunMode()

if setting.InstallLock && setting.SSH.StartBuiltinServer {
ssh.Listen(setting.SSH.ListenHost, setting.SSH.ListenPort)
log.Info("SSH server started on %s:%v", setting.SSH.ListenHost, setting.SSH.ListenPort)
ssh.Listen(setting.SSH.ListenHost, setting.SSH.ListenPort, setting.SSH.ServerCiphers)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please use tabs for indentation

log.Info("SSH server started on %s:%v. Cipher list (%v)", setting.SSH.ListenHost, setting.SSH.ListenPort, setting.SSH.ServerCiphers)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ListenPort should use %d not %v

}
}