GHSA-3m6q-h5gj-7mrw — Gitea has insecure default SSH settings

Affected: Go: code.gitea.io/gitea

## Summary

The built-in SSH server currently advertises a number of key exchange, MAC, and host key algorithms that are considered weak or broken. The defaults should be tightened so a fresh installation passes a baseline SSH security audit out of the box.

## Details

Running `ssh-audit` against a default deployment flags the following as `fail`:

- **Key exchange** - `ecdh-sha2-nistp256` - `ecdh-sha2-nistp384` - `ecdh-sha2-nistp521` - **MAC** - `hmac-sha1` - **Host key** - `ssh-rsa`

## Reproduction

```sh docker run -it --rm positronsecurity/ssh-audit -p 2222 gitea.local ```

## Impact

Default deployments expose algorithms that are known-weak or deprecated upstream. The current workaround requires manually setting several `GITEA__server__SSH_SERVER_*` variables, which most users will never do.

### Workaround

```ini [server] SSH_SERVER_KEY_EXCHANGES = curve25519-sha256, diffie-hellman-group14-sha256 SSH_SERVER_CIPHERS = chacha20-poly1305@openssh.com, aes128-ctr, aes192-ctr, aes256-ctr, aes128-gcm@openssh.com, aes256-gcm@openssh.com SSH_SERVER_MACS = hmac-sha2-256-etm@openssh.com, hmac-sha2-256 ```

There is no exposed option to restrict host key algorithms, so `ssh-rsa` remains advertised.

## Acceptance criteria

- [ ] Default `SSH_SERVER_KEY_EXCHANGES`, `SSH_SERVER_CIPHERS`, and `SSH_SERVER_MACS` updated to the secure list above. - [ ] New `SSH_SERVER_HOST_KEY_ALGORITHMS` option added, with a default that excludes `ssh-rsa`. - [ ] Documentati…

Most recent entries from all

GHSA-3m6q-h5gj-7mrw — Gitea has insecure default SSH settings