Skip to content

SSH hardening: buffers, algo lists, auth attempts, parsing #1117

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JacobBarthelmeh merged 6 commits into from
Jul 23, 2026
Merged

SSH hardening: buffers, algo lists, auth attempts, parsing #1117

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
61e503c
Add server-side max failed userauth attempt limit
ejohnstown Jul 17, 2026
601b509
Validate algo-list setters, reject none MAC/enc
ejohnstown Jul 17, 2026
8a2d1b6
Zeroize SSH transport buffers before freeing them
ejohnstown Jul 17, 2026
7378dab
DoProtoId: reject protoversion other than 2.0
ejohnstown Jul 22, 2026
a436502
GetString: reject zero-size destination
ejohnstown Jul 22, 2026
60c0e1a
tests: fix unit.c static analysis warnings
ejohnstown Jul 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions configure.ac
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -225,6 +225,11 @@ AC_ARG_ENABLE([smallstack],
[AS_HELP_STRING([--enable-smallstack],[Enable small stack (default: disabled)])],
[ENABLED_SMALLSTACK=$enableval],[ENABLED_SMALLSTACK=no])

# Allow "none" cipher/MAC
AC_ARG_ENABLE([none-cipher],
[AS_HELP_STRING([--enable-none-cipher],[Allow negotiating the insecure "none" cipher/MAC, disabling encryption/integrity (default: disabled)])],
[ENABLED_NONE_CIPHER=$enableval],[ENABLED_NONE_CIPHER=no])

# use PAM lib
AC_ARG_WITH([pam],
[AS_HELP_STRING([--with-pam=PATH],[PATH to directory with the PAM library])],
Expand Down Expand Up @@ -278,6 +283,8 @@ AS_IF([test "x$ENABLED_CERTS" = "xyes"],
[AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_CERTS"])
AS_IF([test "x$ENABLED_SMALLSTACK" = "xyes"],
[AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_SMALL_STACK"])
AS_IF([test "x$ENABLED_NONE_CIPHER" = "xyes"],
[AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_ALLOW_NONE_CIPHER"])
AS_IF([test "x$ENABLED_SSHCLIENT" = "xyes"],
[AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_SSHCLIENT"])
AS_IF([test "x$ENABLED_TPM" = "xyes"],
Expand Down Expand Up @@ -377,6 +384,7 @@ AS_ECHO([" * echoserver shell support: $ENABLED_SHELL"])
AS_ECHO([" * scp: $ENABLED_SCP"])
AS_ECHO([" * sftp: $ENABLED_SFTP"])
AS_ECHO([" * sftp buffer zeroize: $ENABLED_SFTP_ZEROIZE"])
AS_ECHO([" * allow none cipher/MAC: $ENABLED_NONE_CIPHER"])
AS_ECHO([" * sshd: $ENABLED_SSHD"])
AS_ECHO([" * ssh client: $ENABLED_SSHCLIENT"])
AS_ECHO([" * agent: $ENABLED_AGENT"])
Expand Down
Loading
Loading