Disable SHA-1 specifically (Being seen as vulnerable)

[Jcoetsee]

Hi there, the software at times is being triggered as vulnerable because of its ability to use SHA1 algorithms, Is anybody familiar with what exactly needs to be disabled were to remediate something like this?

[drakkan]

Hi,

we need to support old hash algorithms for compatibility with old clients but you can disable the use of these algorithms if you don't have compatibility problems, they are all configurable, take a look here.

If you can share your vulnerability report I can give a more precise answer but I guess this was already discussed in the past

#661
#368
#646

[Jcoetsee]

Thanks for this, what is the exact location of this configuration file ?

[drakkan]

Thanks for this, what is the exact location of this configuration file ?

On Linux /etc/sftpgo/sftpgo.json, on Windows C:\ProgramData\SFTPGo\sftpgo.json.

[Jcoetsee]

Appreciate the feedback and the help, don't want to mess this up so want to ask, what exactly is the format of those line items, and is the area I should be focused on specifically the "Kex_algorithms" section?

The default in the config file is as per below, so what would a "configured" output of this look like if you can give me an example, please?

"kex_algorithms": [],

[drakkan]

Appreciate the feedback and the help, don't want to mess this up so want to ask, what exactly is the format of those line items, and is the area I should be focused on specifically the "Kex_algorithms" section?

The default in the config file is as per below, so what would a "configured" output of this look like if you can give me an example, please?

"kex_algorithms": [],

From the linked doc

kex_algorithms, list of strings. Available KEX (Key Exchange) algorithms in preference order. Leave empty to use default values. The supported values are: curve25519-sha256@libssh.org, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521, diffie-hellman-group14-sha1, diffie-hellman-group1-sha1. Default values: curve25519-sha256@libssh.org, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521, diffie-hellman-group14-sha1

so I suppose you want something like this:

"kex_algorithms": ["curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521"],

the configuration file is in json format by default. You need to restart the SFTPGo service to apply the change