#! /usr/bin/patch -p0
# $Header: /global/src/etc/cl-manage-scripts/patches/RCS/P-sshd_config-Kex-Ciphers-MACs-undo_U12,v 1.1 2025/03/21 15:19:26 mas90 Exp $
# This patch to ensure that ssh logins can (safely) be host based (as only uses known hosts in /etc/ssh/) is believe no longer to be needed, so has been undone - RT#94078
# patch-file hasno = ^MACs
# patch-file distmatches = Ubuntu.12
# Process using /usr/bin/cl-patch-file unless matching the above
--- /etc/ssh/sshd_config	2004-09-21 05:56:59.000000000 +0100
+++ /etc/ssh/sshd_config	2004-12-14 14:35:02.190587968 +0000
@@ -200,5 +200,5 @@
 # Recommendations from https://stribika.github.io/2015/01/04/secure-secure-shell.html - RT#94078
-KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
-Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
-# (e.g.) laira has no -etm, so needs one of: hmac-sha2-512 hmac-sha2-256 hmac-ripemd160
-MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160
+# NOT U12 ... KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
+# NOT U12 ... Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
+# (e.g.) laira has no -etm, so needs one of: hmac-sha2-512 hmac-sha2-256 hmac-ripemd160
+# NOT U12 ... MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160
