Update detection of applicable ciphers/kex/mac to use OpenSSH version instead of OS version

dev-sec / ssh-baseline

DevSec SSH Baseline - InSpec Profile

https://dev-sec.io/baselines/ssh/

Apache License 2.0

283 stars 78 forks source link

Closed schurzi closed 2 years ago

schurzi commented 2 years ago

Because of historical reasons (RHEL 6 did some special things) we use OS version to detect the best usable SSH Ciphers/Kex/Mac.

Instead we should use OpenSSH version to determine available ciphers.