{"push_id":671089366,"size":1,"distinct_size":1,"ref":"refs/heads/production","head":"598389d08a95bfdb07148fa1a5f6708ed981ef2f","before":"595a6332a17d90cbfa97ef3180d2a57e41297f4d","commits":[{"sha":"598389d08a95bfdb07148fa1a5f6708ed981ef2f","author":{"email":"8e79053491d241fb481775fcc825bd3fb828477f@wikimedia.org","name":"dzahn"},"message":"sshd: set Message Authentication Code ciphers\n\nExcplicitely define the MAC ciphers used.\n\nNo MD5, no SHA1. No ripemd\n\nOnly use Encrypt-then-MAC.\n\nquote from http://stribika.github.io/2015/01/04/secure-secure-shell.html\n\n<quote>\nHere are the available MAC choices:\n\n1.  hmac-md5\n2.  hmac-md5-96\n3.  hmac-ripemd160\n4.  hmac-sha1\n5.  hmac-sha1-96\n6.  hmac-sha2-256\n7.  hmac-sha2-512\n8.  umac-64\n9.  umac-128\n10. hmac-md5-etm\n11. hmac-md5-96-etm\n12. hmac-ripemd160-etm\n13. hmac-sha1-etm\n14. hmac-sha1-96-etm\n15. hmac-sha2-256-etm\n16. hmac-sha2-512-etm\n17. umac-64-etm\n18. umac-128-etm\n\nThe selection considerations:\n\nSecurity of the hash algorithm: No MD5 and SHA1. ...\n\nEncrypt-then-MAC: Since there are no downgrade attacks, you can add them to the end of the list.\nYou can also do this on a host by host basis so you know which ones are less safe.\n\nTag size: At least 128 bits. This eliminates umac-64-etm.\nKey size: At least 128 bits. This doesn’t eliminate anything at this point.\n\n</quote>\n\nChange-Id: Iddeaafda0080b46a175e6e383c90fad4d73b28a9","distinct":true,"url":"https://api.github.com/repos/wikimedia/operations-puppet/commits/598389d08a95bfdb07148fa1a5f6708ed981ef2f"}]}