From cccbdc09f35399276745e5370e6c7a906e4d8a5c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Lesimple?= Date: Mon, 1 Jul 2024 14:36:05 +0000 Subject: [PATCH] chg: Debian12, Ubuntu20+: enable sntrup KEX by default --- etc/ssh/sshd_config.debian12 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/ssh/sshd_config.debian12 b/etc/ssh/sshd_config.debian12 index f3c26f2..de83c02 100644 --- a/etc/ssh/sshd_config.debian12 +++ b/etc/ssh/sshd_config.debian12 @@ -65,7 +65,7 @@ MACs umac-128-etm@openssh.com,umac-64-etm@openssh.com,hmac-sha2-512-etm@openssh. # the most secure dh-based kex. # we avoid algorithms based on the disputed NIST curves, and anything based # on sha1. -KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group-exchange-sha256 +KexAlgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group-exchange-sha256 # force rekey every 512M of data or 6 hours of connection, whichever comes first RekeyLimit 512M 6h