[KARAF-3622] Enhance SSH configuration mechanism

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.0.3
• Fix Version/s: 4.1.0, 4.0.8
• Component/s: karaf
• Labels: security
• Assignee: Freeman Yue Fang
• Reporter: Ancoron Luciferis
• Created: 19/Mar/15 13:10
• Updated: 15/Sep/18 16:35
• Resolved: 04/Nov/16 06:56

Description

Currently, the SSH configuration for the remote shell provides only limited access to the configuration capabilities of the library being used (Apache MINA/SSHD).

E.g., it is currently not possible to configure a better HMAC than SHA1, although the SSHD core library version 0.12+ supports at least "hmac-sha2-512" and "hmac-sha2-256".

Also, the key exchange mechanism is currently not configurable at all, which makes it impossible to enforce highly secure connection establishment from the server side.