SSH security improvements: Difference between revisions

With the passage of time and significant increase in computing power available, a variety of encryption algorithms  

and protocols which were reasonably secure ten or fifteen years ago can no longer be used without an elevated risk of the connection being compromised by a third party. For this reason, Compute Canada is modifying its policies for the use of [[SSH]] in order to require more secure ciphers and increasing the length of the keys used to verify the identity of clusters and users to one another. For some users, this will mean having to update their SSH client software or generate a new public/private keypair, while everyone will have to update the local copy of the key which is used to identify the Compute Canada clusters to which they connect.     

== What Changed? ==

During the summer of 2019, we will make the following SSH security improvements on Compute Canada clusters:

# Disable certain weak encryption algorithms.

# Disable certain weak public key types.

This warning is displayed because the host keys on the cluster (in this case [[Graham]]) changed to increase the data centre's security, and ssh clients remember old host keys to prevent [https://en.wikipedia.org/wiki/Man-in-the-middle_attack "man-in-the-middle" attacks].