ssh config allows weak ciphers and MACs

[jostockley]

The ssh configuration in cflinuxfs2 allows the use of Arcfour (RC4) encryption algorithms and 96-bit MAC algorithms, which are considered weak.
Ideally ssh config should at least be consistent with that of BOSH stemcells.
The attached file show the difference between the ssh running in the HAproxy VM and the ssh running on port 2222 in the container. I used the nmap script ssh2-enum-algos against BOSH CF HAproxy VM.
nmap-ssh.log

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/151464314

The labels on this github issue will be updated when the story is started.

[sclevine]

Hi @jostockley, nice catch.

I worry that changing this has the potential to break running apps during an upgrade. We'll investigate. We can almost certainly make the change for cflinuxfs3.

[sclevine]

Closing as cflinuxfs2 will hit EOL in a few months, and cflinuxfs3 has an updated cipher set.