make this more sub :p

diff --git a/src/practical_settings/ssh.tex b/src/practical_settings/ssh.tex
new file mode 100644 (file)
index 0000000..b127ffc
--- /dev/null
+++ b/src/practical_settings/ssh.tex
@@ -0,0 +1,21 @@
+\subsubsection{OpenSSH}
+\paragraph*{sshd_config}
+\begin{lstlisting}[breaklines]
+       # ...
+
+       Protocol 2
+       PermitEmptyPasswords no
+       PermitRootLogin no
+       StrictModes yes
+       HostKey /etc/ssh/ssh_host_rsa_key
+       ServerKeyBits 4096
+       Ciphers aes256-gcm@openssh.com aes128-gcm@openssh.com aes256-ctr aes128-ctr
+       MACs umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160
+       KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1
+\end{lstlisting}
+
+% XXX: curve25519-sha256@libssh.org only available upstream(!)
+Note: Older linux systems won't support SHA2. PuTTY (Windows) does not support RIPE-MD160. Curve25519, AES-GCM and UMAC are only available upstream (OpenSSH 6.1). DSA host keys have been removed on purpose, the DSS standard does not support for DSA keys stronger than 1024bit
+\footnote{\url{https://bugzilla.mindrot.org/show_bug.cgi?id=1647}} 
+which is far below current standards (see section \ref{section:keylengths}). Legacy systems can use this configuration and simply omit unsupported ciphers, key exchange algorithms and MACs.
+\\