Support configurable SSHD algorithms to disable weak/legacy defaults

[plamen-bardarov]

Issue

The diego-sshd process supports flags to allow-list host key algorithms, MACs, KEXs, and ciphers. However, the Cloud Controller does not currently provide a mechanism to pass these parameters when building the LRP action.

Context

When building the action for sshd in the application's LRP, the crypto algorithms are not configured, causing the process to fall back to defaults. This allows potentially vulnerable or deprecated algorithms to remain active.

For example, ssh-rsa (which uses the insecure SHA-1 hash) is allowed by default, failing modern security compliance scans.

cloud_controller/diego/main_lrp_action_builder.rb#L103-L116

        action(::Diego::Bbs::Models::RunAction.new(
                 user: user,
                 path: '/tmp/lifecycle/diego-sshd',
                 args: [
                   "-address=#{sprintf('0.0.0.0:%<port>d', port: DEFAULT_SSH_PORT)}",
                   "-hostKey=#{ssh_key.private_key}",
                   "-authorizedKey=#{ssh_key.authorized_key}",
                   '-inheritDaemonEnv',
                   '-logLevel=fatal'
                 ],
                 env: environment_variables,
                 resource_limits: ::Diego::Bbs::Models::ResourceLimits.new(nofile: process.file_descriptors),
                 log_source: SSHD_LOG_SOURCE
               ))

Related PRs

• Diego Configurable host key algorithms in ssh proxy/daemon  diego-release#1087

Proposed solutions

Add configuration for allowed_ciphers, allowed_macs, allowed_key_exchanges and allowed_host_key_algorithms here:

capi-release/jobs/cloud_controller_ng/spec

Lines 283 to 298 in d32560e

	app_ssh.host_key_fingerprint:
	description: >-
	Fingerprint of the host key of the SSH proxy that brokers connections to
	application instances.
	Supported fingerprint formats: SHA256 (recommended), SHA1 and MD5
	Example fingerprints by format:
	SHA256: 0KmvfcwFCnwQRviOJEwZtnz5qoi76BVb8dm3/vgilCI
	SHA1: b8:80:2c:8c:d7:25:ad:2a:b4:8c:02:34:52:06:f7:ba:1f:0d:02:de
	MD5: d2:d6:b9:d7:f9:c4:15:70:de:af:c7:36:88:3a:60:12
	default: ~
	app_ssh.port:
	description: "External port for SSH access to application instances"
	default: 2222
	app_ssh.oauth_client_id:
	description: "The oauth client ID of the SSH proxy"
	default: ssh-proxy