I was interested in how OneDev implemented the SSH service. I found out that it is based on Apache MINA sshd. It would be very helpful to have a way of setting the used security options. But maybe that is too much effort. Because after all the goal is a secure configuration.

Maybe we can at least remove some unsecure ciphers / key exchange algos? ssh-audit is a great tool to get a general understanding. Here is an example command and a small part of the result.

Thanks for working on OneDev!

docker run -it positronsecurity/ssh-audit -p 6011 onedev.example.com