From 163ef9de163884d558e9ddc7c552b0af9213dc27 Mon Sep 17 00:00:00 2001 From: reachableceo Date: Mon, 27 Jul 2026 10:12:38 -0500 Subject: [PATCH] fix(security): repair KexAlgorithms leading-space in sshd hardening MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The KexAlgorithms line in ssh-audit-hardening.conf began with a space. In sshd_config a leading whitespace marks a line continuation, so the entire directive was absorbed as arguments to the (non-existent) previous directive. The effective kexalgorithms collapsed to only the two trailing GSSAPI entries (gss-curve25519-sha256-, gss-group16-sha512-), which no normal OpenSSH client can negotiate. Result: after secharden-ssh deployed this file, every SSH connection to the host died in [preauth] with no usable key exchange algorithm. sshd -t still returned 0, so the breakage was completely silent. Drop the leading space so the directive is parsed as intended. This restores normal client compatibility while keeping the hardened algorithm set. 🤖 Generated with [Crush](https://github.com/charmassociates/crush) Assisted-by: GLM-5 via Crush --- Project-Tests/remote.sh | 0 Project-Tests/vm-validation.sh | 0 ProjectCode/ConfigFiles/SSH/Configs/ssh-audit-hardening.conf | 2 +- 3 files changed, 1 insertion(+), 1 deletion(-) mode change 100644 => 100755 Project-Tests/remote.sh mode change 100644 => 100755 Project-Tests/vm-validation.sh diff --git a/Project-Tests/remote.sh b/Project-Tests/remote.sh old mode 100644 new mode 100755 diff --git a/Project-Tests/vm-validation.sh b/Project-Tests/vm-validation.sh old mode 100644 new mode 100755 diff --git a/ProjectCode/ConfigFiles/SSH/Configs/ssh-audit-hardening.conf b/ProjectCode/ConfigFiles/SSH/Configs/ssh-audit-hardening.conf index 150fc83..694dcea 100644 --- a/ProjectCode/ConfigFiles/SSH/Configs/ssh-audit-hardening.conf +++ b/ProjectCode/ConfigFiles/SSH/Configs/ssh-audit-hardening.conf @@ -1,6 +1,6 @@ # Restrict key exchange, cipher, and MAC algorithms, as per sshaudit.com # hardening guide. - KexAlgorithms sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,gss-curve25519-sha256-,diffie-hellman-group16-sha512,gss-group16-sha512-,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256 +KexAlgorithms sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,gss-curve25519-sha256-,diffie-hellman-group16-sha512,gss-group16-sha512-,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256 Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-gcm@openssh.com,aes128-ctr