sshserver.pl: add option to disable KEX algorithms in sshd

Cherry-picked from #21199

Closes #21220
This commit is contained in:
Viktor Szakats 2026-04-02 17:03:16 +02:00
parent 741ee57375
commit c98d0a2e9a
No known key found for this signature in database

View File

@ -525,6 +525,7 @@ else {
# KerberosOrLocalPasswd : OpenSSH 1.2.1 and later [1]
# KerberosTgtPassing : OpenSSH 1.2.1 and later [1]
# KerberosTicketCleanup : OpenSSH 1.2.1 and later [1]
# KexAlgorithms : OpenSSH 5.7.0 and later (7.0.0 for '+' support, 7.5.0 for '-' support)
# KeyRegenerationInterval : OpenSSH 1.2.1 till 7.3
# ListenAddress : OpenSSH 1.2.1 and later
# LoginGraceTime : OpenSSH 1.2.1 and later
@ -622,6 +623,9 @@ push @cfgarr, 'HostbasedAuthentication no';
push @cfgarr, 'HostbasedUsesNameFromPacketOnly no';
push @cfgarr, 'IgnoreRhosts yes';
push @cfgarr, 'IgnoreUserKnownHosts yes';
if(($sshdid =~ /OpenSSH/) && ($sshdvernum >= 750) && $ENV{'CURL_TEST_SSH_DISABLE_KEX'}) {
push @cfgarr, 'KexAlgorithms -' . $ENV{'CURL_TEST_SSH_DISABLE_KEX'};
}
push @cfgarr, 'LoginGraceTime 30';
push @cfgarr, "LogLevel $loglevel";
push @cfgarr, 'MaxStartups 5';