Maintain our own OpenSSH configuration

Redhat had their own configuration which could surpass ours,
it will no longer be packaged.

From now on, we keep maintaing the two configuration files with
settings that do not regress to our previous version. Support for
post-quantum algorithms is included, and brute-force protection
remains enabled by default (hardening).  The removal of the MOTD is
due to the fact that PAM now handles it, rather than SSH.

Signed-off-by: Lucas RAVAGNIER <lucas.ravagnier@vates.tech>
Signed-off-by: Philippe Coval <philippe.coval@vates.tech>

Author: Lucas RAVAGNIER

SOURCES/ssh_config

@@ -1,4 +1,9 @@
-#	$OpenBSD: ssh_config,v 1.35 2020/07/17 03:43:42 dtucker Exp $
+# XCP-ng ssh client configuration
+# DO NOT MODIFY THIS FILE, IT WILL BE OVERWRITE AT EVERY UPDATE
+
+
+#	$OpenBSD: ssh_config,v 1.36 2023/08/02 23:04:38 djm Exp $
+# Upstream: https://github.com/openssh/openssh-portable/blob/V_9_9/ssh_config
 
 # This is the ssh client system-wide configuration file.  See
 # ssh_config(5) for more information.  This file provides defaults for
@@ -17,17 +22,26 @@
 # list of available options, their meanings and defaults, please see the
 # ssh_config(5) man page.
 
+# To modify the system-wide ssh client configuration, create *.conf file(s) under
+#  /etc/ssh/ssh_config.d/  which will be automatically included below
+Include /etc/ssh/ssh_config.d/*.conf
+
+Host *
+	# Send locale-related environment variables
+	SendEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
+	SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
+	SendEnv LC_IDENTIFICATION LC_ALL LANGUAGE
+	SendEnv XMODIFIERS
+
 # Host *
 #   ForwardAgent no
 #   ForwardX11 no
 #   PasswordAuthentication yes
 #   HostbasedAuthentication no
 #   GSSAPIAuthentication no
 #   GSSAPIDelegateCredentials no
-#   GSSAPIKeyExchange no
-#   GSSAPITrustDNS no
 #   BatchMode no
-#   CheckHostIP yes
+#   CheckHostIP no
 #   AddressFamily any
 #   ConnectTimeout 0
 #   StrictHostKeyChecking ask
@@ -46,16 +60,4 @@
 #   ProxyCommand ssh -q -W %h:%p gateway.example.com
 #   RekeyLimit 1G 1h
 #   UserKnownHostsFile ~/.ssh/known_hosts.d/%k
-#
-Host *
-        GSSAPIAuthentication yes
-        # Send locale-related environment variables
-        SendEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
-        SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
-        SendEnv LC_IDENTIFICATION LC_ALL LANGUAGE
-        SendEnv XMODIFIERS
-
-        Ciphers aes128-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
-        MACs hmac-sha2-256,hmac-sha2-512,hmac-sha1
-        KexAlgorithms curve25519-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521
-        HostKeyAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,ssh-rsa
+

SOURCES/sshd_config

@@ -1,4 +1,9 @@
+# XCP-ng sshd server configuration.
+# DO NOT MODIFY THIS FILE, IT WILL BE OVERWRITE AT EVERY UPDATE
+
+
 #	$OpenBSD: sshd_config,v 1.104 2021/07/02 05:11:21 dtucker Exp $
+# Upstream: https://github.com/openssh/openssh-portable/blob/V_9_9/sshd_config
 
 # This is the sshd server system-wide configuration file.  See
 # sshd_config(5) for more information.
@@ -19,17 +24,16 @@ Include /etc/ssh/sshd_config.d/*.conf
 #ListenAddress 0.0.0.0
 #ListenAddress ::
 
-HostKey /etc/ssh/ssh_host_rsa_key
-HostKey /etc/ssh/ssh_host_ecdsa_key
-HostKey /etc/ssh/ssh_host_ed25519_key
-
-# Ciphers, MACs, KEX Algorithms & HostKeyAlgorithms
-Ciphers aes128-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
-MACs hmac-sha2-256,hmac-sha2-512,hmac-sha1
-KexAlgorithms curve25519-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521
-HostKeyAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,ssh-rsa
+#HostKey /etc/ssh/ssh_host_rsa_key
+#HostKey /etc/ssh/ssh_host_ecdsa_key
+#HostKey /etc/ssh/ssh_host_ed25519_key
 
+Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr
+MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256
+KexAlgorithms mlkem1024nistp384-sha384,mlkem768x25519-sha256,mlkem768nistp256-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
+HostKeyAlgorithms ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256
 
+# Ciphers and keying
 #RekeyLimit default none
 
 # Logging
@@ -40,8 +44,10 @@ SyslogFacility AUTHPRIV
 
 #LoginGraceTime 2m
 PermitRootLogin yes
+PrintMotd no
 #StrictModes yes
-#MaxAuthTries 6
+# XCP-ng hardening 
+MaxAuthTries 3
 #MaxSessions 10
 
 #PubkeyAuthentication yes
@@ -78,32 +84,29 @@ ChallengeResponseAuthentication no
 #KerberosOrLocalPasswd yes
 #KerberosTicketCleanup yes
 #KerberosGetAFSToken no
-#KerberosUseKuserok yes
 
 # GSSAPI options
 GSSAPIAuthentication no
 GSSAPICleanupCredentials no
-#GSSAPIStrictAcceptorCheck yes
-#GSSAPIKeyExchange no
-#GSSAPIEnablek5users no
 
 # Set this to 'yes' to enable PAM authentication, account processing,
 # and session processing. If this is enabled, PAM authentication will
 # be allowed through the KbdInteractiveAuthentication and
 # PasswordAuthentication.  Depending on your PAM configuration,
 # PAM authentication via KbdInteractiveAuthentication may bypass
-# the setting of "PermitRootLogin without-password".
+# the setting of "PermitRootLogin prohibit-password".
 # If you just want the PAM account and session checks to run without
 # PAM authentication, then enable this but set PasswordAuthentication
 # and KbdInteractiveAuthentication to 'no'.
-# WARNING: 'UsePAM no' is not supported in Fedora and may cause several
-# problems.
 UsePAM yes
 
 #AllowAgentForwarding yes
 #AllowTcpForwarding yes
 #GatewayPorts no
-#X11Forwarding no
+# XCP-ng does not support X11Forwarding
+X11Forwarding no
+# XCP-ng disable Forwarding for hardening
+DisableForwarding yes
 #X11DisplayOffset 10
 #X11UseLocalhost yes
 #PermitTTY yes
@@ -131,14 +134,11 @@ AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
 AcceptEnv XMODIFIERS
 
 # override default of no subsystems
-Subsystem	sftp	/usr/libexec/sftp-server
+Subsystem	sftp	/usr/libexec/openssh/sftp-server
 
 # Example of overriding settings on a per-user basis
 #Match User anoncvs
 #	X11Forwarding no
 #	AllowTcpForwarding no
 #	PermitTTY no
 #	ForceCommand cvs server
-
-PerSourcePenalties=no
-

SPECS/openssh.spec

@@ -1,7 +1,7 @@
 # XCP-ng build condition
 %bcond_without xcpng
 # XCP-ng sub release number
-%define xcpng_subrel 1
+%define xcpng_subrel 2
 
 # Do we want SELinux & Audit
 %if 0%{?!noselinux:1}
@@ -84,6 +84,8 @@ Source20: ssh-host-keys-migration.sh
 Source21: ssh-host-keys-migration.service
 Source22: parallel_test.sh
 Source23: parallel_test.Makefile
+Source24: sshd_config
+Source25: ssh_config
 
 #https://bugzilla.mindrot.org/show_bug.cgi?id=2581
 Patch100: openssh-6.7p1-coverity.patch
@@ -355,7 +357,12 @@ BuildRequires: gnupg2
 %package clients
 Summary: An open source SSH client applications
 Requires: openssh = %{version}-%{release}
+# XCP-ng does not have that, and we don't support it.
+# This is used to set a global policies for all the platform.
+# This is not mandatory as we do the custom config
+%if %{without xcpng}
 Requires: crypto-policies >= 20220824-1
+%endif
 
 %package keysign
 Summary: A helper program used for host-based authentication
@@ -366,7 +373,12 @@ Summary: An open source SSH server daemon
 Requires: openssh = %{version}-%{release}
 Requires(pre): /usr/sbin/useradd
 Requires: pam >= 1.0.1-3
+# XCP-ng does not have that, and we don't support it.
+# This is used to set a global policies for all the platform.
+# This is not mandatory as we do the custom config
+%if %{without xcpng}
 Requires: crypto-policies >= 20220824-1
+%endif
 %{?systemd_requires}
 
 %package keycat
@@ -641,9 +653,18 @@ install -d $RPM_BUILD_ROOT%{_libexecdir}/openssh
 install -m644 %{SOURCE2} $RPM_BUILD_ROOT/etc/pam.d/sshd
 install -m644 %{SOURCE6} $RPM_BUILD_ROOT/etc/pam.d/ssh-keycat
 install -m644 %{SOURCE7} $RPM_BUILD_ROOT/etc/sysconfig/sshd
+# XCP-ng has its own rules; let's not package rules that could conflict with them.
+%if %{without xcpng}
 install -m644 ssh_config_redhat $RPM_BUILD_ROOT%{_sysconfdir}/ssh/ssh_config.d/50-redhat.conf
 install -m644 sshd_config_redhat_cp $RPM_BUILD_ROOT%{_sysconfdir}/ssh/sshd_config.d/40-redhat-crypto-policies.conf
 install -m644 sshd_config_redhat $RPM_BUILD_ROOT%{_sysconfdir}/ssh/sshd_config.d/50-redhat.conf
+%else
+# XCP-ng ships its own hardened sshd_config/ssh_config in place of the
+# upstream defaults; these fully replace them and are
+# reinstalled on every package upgrade.
+install -m644 %{SOURCE25} $RPM_BUILD_ROOT%{_sysconfdir}/ssh/ssh_config
+install -m600 %{SOURCE24} $RPM_BUILD_ROOT%{_sysconfdir}/ssh/sshd_config
+%endif
 install -d -m755 $RPM_BUILD_ROOT/%{_unitdir}
 install -m644 %{SOURCE9} $RPM_BUILD_ROOT/%{_unitdir}/sshd@.service
 install -m644 %{SOURCE10} $RPM_BUILD_ROOT/%{_unitdir}/sshd.socket
@@ -760,9 +781,18 @@ fi
 %attr(0644,root,root) %{_mandir}/man1/ssh.1*
 %attr(0755,root,root) %{_bindir}/scp
 %attr(0644,root,root) %{_mandir}/man1/scp.1*
+%if %{with xcpng}
+# Not marked %%config on purpose: this is the XCP-ng policy file and
+# must be unconditionally overwritten on every upgrade
+%attr(0644,root,root) %{_sysconfdir}/ssh/ssh_config
+%else
 %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ssh/ssh_config
+%endif
 %dir %attr(0755,root,root) %{_sysconfdir}/ssh/ssh_config.d/
+# XCP-ng has its own rules; let's not package rules that could conflict with them.
+%if %{without xcpng}
 %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ssh/ssh_config.d/50-redhat.conf
+%endif
 %attr(0644,root,root) %{_mandir}/man5/ssh_config.5*
 %attr(0755,root,root) %{_bindir}/ssh-agent
 %attr(0755,root,root) %{_bindir}/ssh-add
@@ -795,10 +825,19 @@ fi
 %attr(0644,root,root) %{_mandir}/man5/moduli.5*
 %attr(0644,root,root) %{_mandir}/man8/sshd.8*
 %attr(0644,root,root) %{_mandir}/man8/sftp-server.8*
+%if %{with xcpng}
+# Not marked %%config on purpose: this is the XCP-ng policy file and
+# must be unconditionally overwritten on every upgrade
+%attr(0600,root,root) %{_sysconfdir}/ssh/sshd_config
+%else
 %attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/sshd_config
+%endif
 %dir %attr(0700,root,root) %{_sysconfdir}/ssh/sshd_config.d/
+# XCP-ng has its own rules; let's not package rules that could conflict with them.
+%if %{without xcpng}
 %attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/sshd_config.d/40-redhat-crypto-policies.conf
 %attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/sshd_config.d/50-redhat.conf
+%endif
 %attr(0644,root,root) %config(noreplace) /etc/pam.d/sshd
 %attr(0640,root,root) %config(noreplace) /etc/sysconfig/sshd
 %attr(0644,root,root) %{_unitdir}/sshd.service
@@ -827,6 +866,11 @@ fi
 %attr(0755,root,root) %{_libdir}/sshtest/sk-dummy.so
 
 %changelog
+* Mon Aug 31 2026 Lucas Ravagnier <lucas.ravagnier@vates.tech> - 9.9p1-30.2
+- XCP-ng must not package redhat confs and must apply its own.
+- Create first xcpng conf with pq (post-quantum) support,
+  protection from bruteforce is by default.
+
 * Wed Aug 26 2026 Lucas Ravagnier <lucas.ravagnier@vates.tech> - 9.9p1-30.1
 - CVE-2026-59998 is only a documentation update.
 - Fix of CVE-2026-60000