Gitea has insecure default SSH settings

Summary

The built-in SSH server currently advertises a number of key exchange, MAC, and host key algorithms that are considered weak or broken. The defaults should be tightened so a fresh installation passes a baseline SSH security audit out of the box.

Details

Running ssh-audit against a default deployment flags the following as fail:

• Key exchange
  • ecdh-sha2-nistp256
  • ecdh-sha2-nistp384
  • ecdh-sha2-nistp521
• MAC
  • hmac-sha1
• Host key
  • ssh-rsa

Reproduction

docker run -it --rm positronsecurity/ssh-audit -p 2222 gitea.local

Impact

Default deployments expose algorithms that are known-weak or deprecated upstream. The current workaround requires manually setting several GITEA__server__SSH_SERVER_* variables, which most users will never do.

Workaround

[server]
SSH_SERVER_KEY_EXCHANGES = curve25519-sha256, diffie-hellman-group14-sha256
SSH_SERVER_CIPHERS       = chacha20-poly1305@openssh.com, aes128-ctr, aes192-ctr, aes256-ctr, aes128-gcm@openssh.com, aes256-gcm@openssh.com
SSH_SERVER_MACS          = hmac-sha2-256-etm@openssh.com, hmac-sha2-256

There is no exposed option to restrict host key algorithms, so ssh-rsa remains advertised.

Acceptance criteria

• Default SSH_SERVER_KEY_EXCHANGES, SSH_SERVER_CIPHERS, and SSH_SERVER_MACS updated to the secure list above.
• New SSH_SERVER_HOST_KEY_ALGORITHMS option added, with a default that excludes ssh-rsa.
• Documentation updated to reflect the new defaults.
• ssh-audit against a fresh install reports no [fail] entries.