sabotage-linux/sabotage — pull request #216 by JillTyrell (2014-05-14 13:06:25+00:00)
Title: openssh: flensing sshd_conf and services.

The default OpenSSH Cipher/MAC selection makes overpaid security auditors running test suites against servers very nervous and regardless of merit of these concerns, there's very little needed beyond RSA/SHA/AES for speaking to the world at large, so it's safe to drop support for everything else. The new djb suite is also included, as EC still looks like an interesting opportunity and djb is one of the few people safe to say hasn't been bought and paid for by unsavory people.

Given that for the most part OpenSSH defaults to sane choices, there's actually very little that mere mortals will need to edit. The conf has been reduced to reflect this, presenting what hopefully is all that needs to be immediately available for users and what has to be specified over default.