chore: Improvements to the SSH script - #59
Conversation
* Initial plan * Update SSH installer: add post-quantum KEX comments Agent-Logs-Url: https://github.com/Stensel8/Scripts/sessions/1b6c17f6-abae-46d8-aba1-436a1f0aa17b Co-authored-by: Stensel8 <102481635+Stensel8@users.noreply.github.com> --------- Co-authored-by: anthropic-code-agent[bot] <242468646+Claude@users.noreply.github.com> Co-authored-by: Stensel8 <102481635+Stensel8@users.noreply.github.com>
Correcting a logic issue that resulted in a unwanted komma when printing the SSH version.
There was a problem hiding this comment.
Pull request overview
This PR updates the OpenSSH hardened installer to position the configuration as “post-quantum hardened”, adds an ML-KEM hybrid KEX option, and adjusts how OpenSSH version information is displayed.
Changes:
- Update script/config messaging from “FUTURE crypto policy compatible” to “Post-quantum hardened” with expanded rationale text.
- Add
mlkem768x25519-sha256toKexAlgorithmsahead of curve25519 options. - Change version reporting to use
ssh -Voutput (and update summary lines accordingly).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| command -v sshd &>/dev/null \ | ||
| && log_success "sshd found: $(sshd -V 2>&1 | grep -o 'OpenSSH_[^ ]*')" \ | ||
| && log_success "sshd found: $ssh_version=$(ssh -V 2>&1 | awk '{print $1}' | tr -d ',')" \ | ||
| || { log_error "sshd not found"; ((issues++)); } |
There was a problem hiding this comment.
verify() references $ssh_version inside the log string, but that variable is never set in this function. With set -u, this will cause an immediate unbound variable error and make verify unusable. Compute the version into a local variable first (or reuse sshd -V) and then log it without referencing an unset variable.
| show_summary() { | ||
| local ssh_version | ||
| ssh_version=$(sshd -V 2>&1 | grep -o 'OpenSSH_[^ ]*' || echo "unknown") | ||
| ssh_version=$(ssh -V 2>&1 | awk '{print $1}' | tr -d ',') | ||
|
|
There was a problem hiding this comment.
show_summary() uses ssh -V to derive the version. This script only installs openssh-server, and on some distros the SSH client binary may not be present, causing the install flow to abort (due to set -e) right at the end. Prefer reading the version from sshd -V (or guard with command -v ssh and fall back) so the summary cannot break an otherwise successful install.
| KexAlgorithms mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org | ||
| Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com |
There was a problem hiding this comment.
Hard-coding KexAlgorithms to include mlkem768x25519-sha256 will make sshd -t fail on systems where the distro-provided OpenSSH does not yet support ML-KEM (this repo installs from distribution repositories). Consider detecting KEX support (e.g., via ssh -Q kex / sshd -T equivalents) and conditionally including ML-KEM with a safe fallback list, or failing early with a clear message about the minimum required OpenSSH version.
These upgrades modernize and improve the openssh setup script. It adds new algorithms and includes some fixes for logic errors.
Added:
Fixed: