From f0f453c916e279980df981c1e1dee0d167dc124e Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Mon, 15 Apr 2024 19:07:52 +0200 Subject: Adding upstream version 3.1.0. Signed-off-by: Daniel Baumann --- test/docker/policies/policy_test1.txt | 10 +++++++++ test/docker/policies/policy_test10.txt | 39 ++++++++++++++++++++++++++++++++++ test/docker/policies/policy_test11.txt | 35 ++++++++++++++++++++++++++++++ test/docker/policies/policy_test12.txt | 35 ++++++++++++++++++++++++++++++ test/docker/policies/policy_test13.txt | 38 +++++++++++++++++++++++++++++++++ test/docker/policies/policy_test14.txt | 38 +++++++++++++++++++++++++++++++++ test/docker/policies/policy_test2.txt | 10 +++++++++ test/docker/policies/policy_test3.txt | 10 +++++++++ test/docker/policies/policy_test4.txt | 10 +++++++++ test/docker/policies/policy_test5.txt | 10 +++++++++ test/docker/policies/policy_test6.txt | 12 +++++++++++ test/docker/policies/policy_test7.txt | 39 ++++++++++++++++++++++++++++++++++ test/docker/policies/policy_test8.txt | 39 ++++++++++++++++++++++++++++++++++ test/docker/policies/policy_test9.txt | 39 ++++++++++++++++++++++++++++++++++ 14 files changed, 364 insertions(+) create mode 100644 test/docker/policies/policy_test1.txt create mode 100644 test/docker/policies/policy_test10.txt create mode 100644 test/docker/policies/policy_test11.txt create mode 100644 test/docker/policies/policy_test12.txt create mode 100644 test/docker/policies/policy_test13.txt create mode 100644 test/docker/policies/policy_test14.txt create mode 100644 test/docker/policies/policy_test2.txt create mode 100644 test/docker/policies/policy_test3.txt create mode 100644 test/docker/policies/policy_test4.txt create mode 100644 test/docker/policies/policy_test5.txt create mode 100644 test/docker/policies/policy_test6.txt create mode 100644 test/docker/policies/policy_test7.txt create mode 100644 test/docker/policies/policy_test8.txt create mode 100644 test/docker/policies/policy_test9.txt (limited to 'test/docker/policies') diff --git a/test/docker/policies/policy_test1.txt b/test/docker/policies/policy_test1.txt new file mode 100644 index 0000000..11d8e5c --- /dev/null +++ b/test/docker/policies/policy_test1.txt @@ -0,0 +1,10 @@ +# +# Docker policy: test1 +# + +name = "Docker policy: test1" +version = 1 +host keys = ssh-rsa, ssh-dss +key exchanges = diffie-hellman-group-exchange-sha256, diffie-hellman-group-exchange-sha1, diffie-hellman-group14-sha1, diffie-hellman-group1-sha1 +ciphers = aes128-ctr, aes192-ctr, aes256-ctr, arcfour256, arcfour128, aes128-cbc, 3des-cbc, blowfish-cbc, cast128-cbc, aes192-cbc, aes256-cbc, arcfour, rijndael-cbc@lysator.liu.se +macs = hmac-md5, hmac-sha1, umac-64@openssh.com, hmac-ripemd160, hmac-ripemd160@openssh.com, hmac-sha1-96, hmac-md5-96 diff --git a/test/docker/policies/policy_test10.txt b/test/docker/policies/policy_test10.txt new file mode 100644 index 0000000..82c821e --- /dev/null +++ b/test/docker/policies/policy_test10.txt @@ -0,0 +1,39 @@ +# +# Docker policy: test10 +# + +# The name of this policy (displayed in the output during scans). Must be in quotes. +name = "Docker poliicy: test10" + +# The version of this policy (displayed in the output during scans). Not parsed, and may be any value, including strings. +version = 1 + +# The banner that must match exactly. Commented out to ignore banners, since minor variability in the banner is sometimes normal. +# banner = "SSH-2.0-OpenSSH_5.6" + +# The header that must match exactly. Commented out to ignore headers, since variability in the header is sometimes normal. +# header = "[]" + +# The compression options that must match exactly (order matters). Commented out to ignore by default. +# compressions = none, zlib@openssh.com + +# RSA host key sizes. +hostkey_size_rsa-sha2-256 = 3072 +hostkey_size_rsa-sha2-512 = 3072 +hostkey_size_ssh-rsa = 3072 +hostkey_size_ssh-rsa-cert-v01@openssh.com = 4096 + +# RSA CA key sizes. +cakey_size_ssh-rsa-cert-v01@openssh.com = 4096 + +# The host key types that must match exactly (order matters). +host keys = ssh-rsa, ssh-rsa-cert-v01@openssh.com + +# The key exchange algorithms that must match exactly (order matters). +key exchanges = diffie-hellman-group-exchange-sha256, diffie-hellman-group-exchange-sha1, diffie-hellman-group14-sha1, diffie-hellman-group1-sha1 + +# The ciphers that must match exactly (order matters). +ciphers = aes128-ctr, aes192-ctr, aes256-ctr, arcfour256, arcfour128, aes128-cbc, 3des-cbc, blowfish-cbc, cast128-cbc, aes192-cbc, aes256-cbc, arcfour, rijndael-cbc@lysator.liu.se + +# The MACs that must match exactly (order matters). +macs = hmac-md5, hmac-sha1, umac-64@openssh.com, hmac-ripemd160, hmac-ripemd160@openssh.com, hmac-sha1-96, hmac-md5-96 diff --git a/test/docker/policies/policy_test11.txt b/test/docker/policies/policy_test11.txt new file mode 100644 index 0000000..d0fa4ae --- /dev/null +++ b/test/docker/policies/policy_test11.txt @@ -0,0 +1,35 @@ +# +# Docker policy: test11 +# + +# The name of this policy (displayed in the output during scans). Must be in quotes. +name = "Docker policy: test11" + +# The version of this policy (displayed in the output during scans). Not parsed, and may be any value, including strings. +version = 1 + +# The banner that must match exactly. Commented out to ignore banners, since minor variability in the banner is sometimes normal. +# banner = "SSH-2.0-OpenSSH_8.0" + +# The header that must match exactly. Commented out to ignore headers, since variability in the header is sometimes normal. +# header = "[]" + +# The compression options that must match exactly (order matters). Commented out to ignore by default. +# compressions = none, zlib@openssh.com + +# RSA host key sizes. +hostkey_size_rsa-sha2-256 = 3072 +hostkey_size_rsa-sha2-512 = 3072 +hostkey_size_ssh-rsa = 3072 + +# The host key types that must match exactly (order matters). +host keys = rsa-sha2-512, rsa-sha2-256, ssh-rsa, ecdsa-sha2-nistp256, ssh-ed25519 + +# The key exchange algorithms that must match exactly (order matters). +key exchanges = curve25519-sha256, curve25519-sha256@libssh.org, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521, diffie-hellman-group-exchange-sha256, diffie-hellman-group16-sha512, diffie-hellman-group18-sha512, diffie-hellman-group14-sha256, diffie-hellman-group14-sha1 + +# The ciphers that must match exactly (order matters). +ciphers = chacha20-poly1305@openssh.com, aes128-ctr, aes192-ctr, aes256-ctr, aes128-gcm@openssh.com, aes256-gcm@openssh.com + +# The MACs that must match exactly (order matters). +macs = umac-64-etm@openssh.com, umac-128-etm@openssh.com, hmac-sha2-256-etm@openssh.com, hmac-sha2-512-etm@openssh.com, hmac-sha1-etm@openssh.com, umac-64@openssh.com, umac-128@openssh.com, hmac-sha2-256, hmac-sha2-512, hmac-sha1 diff --git a/test/docker/policies/policy_test12.txt b/test/docker/policies/policy_test12.txt new file mode 100644 index 0000000..0b8a30b --- /dev/null +++ b/test/docker/policies/policy_test12.txt @@ -0,0 +1,35 @@ +# +# Docker policy: test12 +# + +# The name of this policy (displayed in the output during scans). Must be in quotes. +name = "Docker policy: test12" + +# The version of this policy (displayed in the output during scans). Not parsed, and may be any value, including strings. +version = 1 + +# The banner that must match exactly. Commented out to ignore banners, since minor variability in the banner is sometimes normal. +# banner = "SSH-2.0-OpenSSH_8.0" + +# The header that must match exactly. Commented out to ignore headers, since variability in the header is sometimes normal. +# header = "[]" + +# The compression options that must match exactly (order matters). Commented out to ignore by default. +# compressions = none, zlib@openssh.com + +# RSA host key sizes. +hostkey_size_rsa-sha2-256 = 4096 +hostkey_size_rsa-sha2-512 = 4096 +hostkey_size_ssh-rsa = 4096 + +# The host key types that must match exactly (order matters). +host keys = rsa-sha2-512, rsa-sha2-256, ssh-rsa, ecdsa-sha2-nistp256, ssh-ed25519 + +# The key exchange algorithms that must match exactly (order matters). +key exchanges = curve25519-sha256, curve25519-sha256@libssh.org, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521, diffie-hellman-group-exchange-sha256, diffie-hellman-group16-sha512, diffie-hellman-group18-sha512, diffie-hellman-group14-sha256, diffie-hellman-group14-sha1 + +# The ciphers that must match exactly (order matters). +ciphers = chacha20-poly1305@openssh.com, aes128-ctr, aes192-ctr, aes256-ctr, aes128-gcm@openssh.com, aes256-gcm@openssh.com + +# The MACs that must match exactly (order matters). +macs = umac-64-etm@openssh.com, umac-128-etm@openssh.com, hmac-sha2-256-etm@openssh.com, hmac-sha2-512-etm@openssh.com, hmac-sha1-etm@openssh.com, umac-64@openssh.com, umac-128@openssh.com, hmac-sha2-256, hmac-sha2-512, hmac-sha1 diff --git a/test/docker/policies/policy_test13.txt b/test/docker/policies/policy_test13.txt new file mode 100644 index 0000000..0f43e2a --- /dev/null +++ b/test/docker/policies/policy_test13.txt @@ -0,0 +1,38 @@ +# +# Docker policy: test13 +# + +# The name of this policy (displayed in the output during scans). Must be in quotes. +name = "Docker policy: test13" + +# The version of this policy (displayed in the output during scans). Not parsed, and may be any value, including strings. +version = 1 + +# The banner that must match exactly. Commented out to ignore banners, since minor variability in the banner is sometimes normal. +# banner = "SSH-2.0-OpenSSH_8.0" + +# The header that must match exactly. Commented out to ignore headers, since variability in the header is sometimes normal. +# header = "[]" + +# The compression options that must match exactly (order matters). Commented out to ignore by default. +# compressions = none, zlib@openssh.com + +# RSA host key sizes. +hostkey_size_rsa-sha2-256 = 3072 +hostkey_size_rsa-sha2-512 = 3072 +hostkey_size_ssh-rsa = 3072 + +# Group exchange DH modulus sizes. +dh_modulus_size_diffie-hellman-group-exchange-sha256 = 4096 + +# The host key types that must match exactly (order matters). +host keys = rsa-sha2-512, rsa-sha2-256, ssh-rsa, ecdsa-sha2-nistp256, ssh-ed25519 + +# The key exchange algorithms that must match exactly (order matters). +key exchanges = curve25519-sha256, curve25519-sha256@libssh.org, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521, diffie-hellman-group-exchange-sha256, diffie-hellman-group16-sha512, diffie-hellman-group18-sha512, diffie-hellman-group14-sha256, diffie-hellman-group14-sha1 + +# The ciphers that must match exactly (order matters). +ciphers = chacha20-poly1305@openssh.com, aes128-ctr, aes192-ctr, aes256-ctr, aes128-gcm@openssh.com, aes256-gcm@openssh.com + +# The MACs that must match exactly (order matters). +macs = umac-64-etm@openssh.com, umac-128-etm@openssh.com, hmac-sha2-256-etm@openssh.com, hmac-sha2-512-etm@openssh.com, hmac-sha1-etm@openssh.com, umac-64@openssh.com, umac-128@openssh.com, hmac-sha2-256, hmac-sha2-512, hmac-sha1 diff --git a/test/docker/policies/policy_test14.txt b/test/docker/policies/policy_test14.txt new file mode 100644 index 0000000..51b366d --- /dev/null +++ b/test/docker/policies/policy_test14.txt @@ -0,0 +1,38 @@ +# +# Docker policy: test14 +# + +# The name of this policy (displayed in the output during scans). Must be in quotes. +name = "Docker policy: test14" + +# The version of this policy (displayed in the output during scans). Not parsed, and may be any value, including strings. +version = 1 + +# The banner that must match exactly. Commented out to ignore banners, since minor variability in the banner is sometimes normal. +# banner = "SSH-2.0-OpenSSH_8.0" + +# The header that must match exactly. Commented out to ignore headers, since variability in the header is sometimes normal. +# header = "[]" + +# The compression options that must match exactly (order matters). Commented out to ignore by default. +# compressions = none, zlib@openssh.com + +# RSA host key sizes. +hostkey_size_rsa-sha2-256 = 3072 +hostkey_size_rsa-sha2-512 = 3072 +hostkey_size_ssh-rsa = 3072 + +# Group exchange DH modulus sizes. +dh_modulus_size_diffie-hellman-group-exchange-sha256 = 8192 + +# The host key types that must match exactly (order matters). +host keys = rsa-sha2-512, rsa-sha2-256, ssh-rsa, ecdsa-sha2-nistp256, ssh-ed25519 + +# The key exchange algorithms that must match exactly (order matters). +key exchanges = curve25519-sha256, curve25519-sha256@libssh.org, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521, diffie-hellman-group-exchange-sha256, diffie-hellman-group16-sha512, diffie-hellman-group18-sha512, diffie-hellman-group14-sha256, diffie-hellman-group14-sha1 + +# The ciphers that must match exactly (order matters). +ciphers = chacha20-poly1305@openssh.com, aes128-ctr, aes192-ctr, aes256-ctr, aes128-gcm@openssh.com, aes256-gcm@openssh.com + +# The MACs that must match exactly (order matters). +macs = umac-64-etm@openssh.com, umac-128-etm@openssh.com, hmac-sha2-256-etm@openssh.com, hmac-sha2-512-etm@openssh.com, hmac-sha1-etm@openssh.com, umac-64@openssh.com, umac-128@openssh.com, hmac-sha2-256, hmac-sha2-512, hmac-sha1 diff --git a/test/docker/policies/policy_test2.txt b/test/docker/policies/policy_test2.txt new file mode 100644 index 0000000..2b7821c --- /dev/null +++ b/test/docker/policies/policy_test2.txt @@ -0,0 +1,10 @@ +# +# Docker policy: test2 +# + +name = "Docker policy: test2" +version = 1 +host keys = ssh-rsa, ssh-dss +key exchanges = kex_alg1, kex_alg2 +ciphers = aes128-ctr, aes192-ctr, aes256-ctr, arcfour256, arcfour128, aes128-cbc, 3des-cbc, blowfish-cbc, cast128-cbc, aes192-cbc, aes256-cbc, arcfour, rijndael-cbc@lysator.liu.se +macs = hmac-md5, hmac-sha1, umac-64@openssh.com, hmac-ripemd160, hmac-ripemd160@openssh.com, hmac-sha1-96, hmac-md5-96 diff --git a/test/docker/policies/policy_test3.txt b/test/docker/policies/policy_test3.txt new file mode 100644 index 0000000..f4ff3a0 --- /dev/null +++ b/test/docker/policies/policy_test3.txt @@ -0,0 +1,10 @@ +# +# Docker policy: test3 +# + +name = "Docker policy: test3" +version = 1 +host keys = ssh-rsa, ssh-dss, key_alg1 +key exchanges = diffie-hellman-group-exchange-sha256, diffie-hellman-group-exchange-sha1, diffie-hellman-group14-sha1, diffie-hellman-group1-sha1 +ciphers = aes128-ctr, aes192-ctr, aes256-ctr, arcfour256, arcfour128, aes128-cbc, 3des-cbc, blowfish-cbc, cast128-cbc, aes192-cbc, aes256-cbc, arcfour, rijndael-cbc@lysator.liu.se +macs = hmac-md5, hmac-sha1, umac-64@openssh.com, hmac-ripemd160, hmac-ripemd160@openssh.com, hmac-sha1-96, hmac-md5-96 diff --git a/test/docker/policies/policy_test4.txt b/test/docker/policies/policy_test4.txt new file mode 100644 index 0000000..500d96f --- /dev/null +++ b/test/docker/policies/policy_test4.txt @@ -0,0 +1,10 @@ +# +# Docker policy: test4 +# + +name = "Docker policy: test4" +version = 1 +host keys = ssh-rsa, ssh-dss +key exchanges = diffie-hellman-group-exchange-sha256, diffie-hellman-group-exchange-sha1, diffie-hellman-group14-sha1, diffie-hellman-group1-sha1 +ciphers = cipher_alg1, cipher_alg2 +macs = hmac-md5, hmac-sha1, umac-64@openssh.com, hmac-ripemd160, hmac-ripemd160@openssh.com, hmac-sha1-96, hmac-md5-96 diff --git a/test/docker/policies/policy_test5.txt b/test/docker/policies/policy_test5.txt new file mode 100644 index 0000000..6285814 --- /dev/null +++ b/test/docker/policies/policy_test5.txt @@ -0,0 +1,10 @@ +# +# Docker policy: test5 +# + +name = "Docker policy: test5" +version = 1 +host keys = ssh-rsa, ssh-dss +key exchanges = diffie-hellman-group-exchange-sha256, diffie-hellman-group-exchange-sha1, diffie-hellman-group14-sha1, diffie-hellman-group1-sha1 +ciphers = aes128-ctr, aes192-ctr, aes256-ctr, arcfour256, arcfour128, aes128-cbc, 3des-cbc, blowfish-cbc, cast128-cbc, aes192-cbc, aes256-cbc, arcfour, rijndael-cbc@lysator.liu.se +macs = hmac-md5, hmac-sha1, umac-64@openssh.com, hmac-ripemd160, hmac-ripemd160@openssh.com, hmac_alg1, hmac-md5-96 diff --git a/test/docker/policies/policy_test6.txt b/test/docker/policies/policy_test6.txt new file mode 100644 index 0000000..0a4aacb --- /dev/null +++ b/test/docker/policies/policy_test6.txt @@ -0,0 +1,12 @@ +# +# Docker policy: test6 +# + +name = "Docker policy: test6" +version = 1 +banner = "SSH-2.0-OpenSSH_8.0" +compressions = none, zlib@openssh.com +host keys = rsa-sha2-512, rsa-sha2-256, ssh-rsa, ecdsa-sha2-nistp256, ssh-ed25519 +key exchanges = curve25519-sha256, curve25519-sha256@libssh.org, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521, diffie-hellman-group-exchange-sha256, diffie-hellman-group16-sha512, diffie-hellman-group18-sha512, diffie-hellman-group14-sha256, diffie-hellman-group14-sha1 +ciphers = chacha20-poly1305@openssh.com, aes128-ctr, aes192-ctr, aes256-ctr, aes128-gcm@openssh.com, aes256-gcm@openssh.com +macs = umac-64-etm@openssh.com, umac-128-etm@openssh.com, hmac-sha2-256-etm@openssh.com, hmac-sha2-512-etm@openssh.com, hmac-sha1-etm@openssh.com, umac-64@openssh.com, umac-128@openssh.com, hmac-sha2-256, hmac-sha2-512, hmac-sha1 diff --git a/test/docker/policies/policy_test7.txt b/test/docker/policies/policy_test7.txt new file mode 100644 index 0000000..05cd27f --- /dev/null +++ b/test/docker/policies/policy_test7.txt @@ -0,0 +1,39 @@ +# +# Docker policy: test7 +# + +# The name of this policy (displayed in the output during scans). Must be in quotes. +name = "Docker poliicy: test7" + +# The version of this policy (displayed in the output during scans). Not parsed, and may be any value, including strings. +version = 1 + +# The banner that must match exactly. Commented out to ignore banners, since minor variability in the banner is sometimes normal. +# banner = "SSH-2.0-OpenSSH_5.6" + +# The header that must match exactly. Commented out to ignore headers, since variability in the header is sometimes normal. +# header = "[]" + +# The compression options that must match exactly (order matters). Commented out to ignore by default. +# compressions = none, zlib@openssh.com + +# RSA host key sizes. +hostkey_size_rsa-sha2-256 = 3072 +hostkey_size_rsa-sha2-512 = 3072 +hostkey_size_ssh-rsa = 3072 +hostkey_size_ssh-rsa-cert-v01@openssh.com = 3072 + +# RSA CA key sizes. +cakey_size_ssh-rsa-cert-v01@openssh.com = 1024 + +# The host key types that must match exactly (order matters). +host keys = ssh-rsa, ssh-rsa-cert-v01@openssh.com + +# The key exchange algorithms that must match exactly (order matters). +key exchanges = diffie-hellman-group-exchange-sha256, diffie-hellman-group-exchange-sha1, diffie-hellman-group14-sha1, diffie-hellman-group1-sha1 + +# The ciphers that must match exactly (order matters). +ciphers = aes128-ctr, aes192-ctr, aes256-ctr, arcfour256, arcfour128, aes128-cbc, 3des-cbc, blowfish-cbc, cast128-cbc, aes192-cbc, aes256-cbc, arcfour, rijndael-cbc@lysator.liu.se + +# The MACs that must match exactly (order matters). +macs = hmac-md5, hmac-sha1, umac-64@openssh.com, hmac-ripemd160, hmac-ripemd160@openssh.com, hmac-sha1-96, hmac-md5-96 diff --git a/test/docker/policies/policy_test8.txt b/test/docker/policies/policy_test8.txt new file mode 100644 index 0000000..6268585 --- /dev/null +++ b/test/docker/policies/policy_test8.txt @@ -0,0 +1,39 @@ +# +# Docker policy: test8 +# + +# The name of this policy (displayed in the output during scans). Must be in quotes. +name = "Docker poliicy: test8" + +# The version of this policy (displayed in the output during scans). Not parsed, and may be any value, including strings. +version = 1 + +# The banner that must match exactly. Commented out to ignore banners, since minor variability in the banner is sometimes normal. +# banner = "SSH-2.0-OpenSSH_5.6" + +# The header that must match exactly. Commented out to ignore headers, since variability in the header is sometimes normal. +# header = "[]" + +# The compression options that must match exactly (order matters). Commented out to ignore by default. +# compressions = none, zlib@openssh.com + +# RSA host key sizes. +hostkey_size_rsa-sha2-256 = 3072 +hostkey_size_rsa-sha2-512 = 3072 +hostkey_size_ssh-rsa = 3072 +hostkey_size_ssh-rsa-cert-v01@openssh.com = 3072 + +# RSA CA key sizes. +cakey_size_ssh-rsa-cert-v01@openssh.com = 2048 + +# The host key types that must match exactly (order matters). +host keys = ssh-rsa, ssh-rsa-cert-v01@openssh.com + +# The key exchange algorithms that must match exactly (order matters). +key exchanges = diffie-hellman-group-exchange-sha256, diffie-hellman-group-exchange-sha1, diffie-hellman-group14-sha1, diffie-hellman-group1-sha1 + +# The ciphers that must match exactly (order matters). +ciphers = aes128-ctr, aes192-ctr, aes256-ctr, arcfour256, arcfour128, aes128-cbc, 3des-cbc, blowfish-cbc, cast128-cbc, aes192-cbc, aes256-cbc, arcfour, rijndael-cbc@lysator.liu.se + +# The MACs that must match exactly (order matters). +macs = hmac-md5, hmac-sha1, umac-64@openssh.com, hmac-ripemd160, hmac-ripemd160@openssh.com, hmac-sha1-96, hmac-md5-96 diff --git a/test/docker/policies/policy_test9.txt b/test/docker/policies/policy_test9.txt new file mode 100644 index 0000000..63652ce --- /dev/null +++ b/test/docker/policies/policy_test9.txt @@ -0,0 +1,39 @@ +# +# Docker policy: test9 +# + +# The name of this policy (displayed in the output during scans). Must be in quotes. +name = "Docker poliicy: test9" + +# The version of this policy (displayed in the output during scans). Not parsed, and may be any value, including strings. +version = 1 + +# The banner that must match exactly. Commented out to ignore banners, since minor variability in the banner is sometimes normal. +# banner = "SSH-2.0-OpenSSH_5.6" + +# The header that must match exactly. Commented out to ignore headers, since variability in the header is sometimes normal. +# header = "[]" + +# The compression options that must match exactly (order matters). Commented out to ignore by default. +# compressions = none, zlib@openssh.com + +# RSA host key sizes. +hostkey_size_rsa-sha2-256 = 3072 +hostkey_size_rsa-sha2-512 = 3072 +hostkey_size_ssh-rsa = 3072 +hostkey_size_ssh-rsa-cert-v01@openssh.com = 4096 + +# RSA CA key sizes. +cakey_size_ssh-rsa-cert-v01@openssh.com = 1024 + +# The host key types that must match exactly (order matters). +host keys = ssh-rsa, ssh-rsa-cert-v01@openssh.com + +# The key exchange algorithms that must match exactly (order matters). +key exchanges = diffie-hellman-group-exchange-sha256, diffie-hellman-group-exchange-sha1, diffie-hellman-group14-sha1, diffie-hellman-group1-sha1 + +# The ciphers that must match exactly (order matters). +ciphers = aes128-ctr, aes192-ctr, aes256-ctr, arcfour256, arcfour128, aes128-cbc, 3des-cbc, blowfish-cbc, cast128-cbc, aes192-cbc, aes256-cbc, arcfour, rijndael-cbc@lysator.liu.se + +# The MACs that must match exactly (order matters). +macs = hmac-md5, hmac-sha1, umac-64@openssh.com, hmac-ripemd160, hmac-ripemd160@openssh.com, hmac-sha1-96, hmac-md5-96 -- cgit v1.2.3