Fixed recommendation output function from suppressing some algorithms inappropriately.

README.md

@@ -158,6 +158,7 @@ For convenience, a web front-end on top of the command-line tool is available at
 
 ## ChangeLog
 ### v2.3.1-dev (???)
+ - Fixed bug in recommendation output which suppressed some algorithms inappropriately.
  - Flag `ssh-rsa-cert-v01@openssh.com` as a failure due to SHA-1 hash.
  - Now parses public key sizes for `rsa-sha2-256-cert-v01@openssh.com` and `rsa-sha2-512-cert-v01@openssh.com` host key types.
  - Built-in policies now include CA key requirements (if certificates are in use).

src/ssh_audit/algorithms.py

@@ -189,27 +189,15 @@ class Algorithms:
                 add_count = len(rec[sshv][alg_type]['add'])
                 del_count = len(rec[sshv][alg_type]['del'])
                 chg_count = len(rec[sshv][alg_type]['chg'])
-                new_alg_count = len(alg_list) + add_count - del_count
+
-                if new_alg_count < 1 and del_count > 0:
+                if add_count == 0:
-                    mf = min(rec[sshv][alg_type]['del'].values())
+                    del rec[sshv][alg_type]['add']
-                    new_del = {}
+                if del_count == 0:
-                    for k, cf in rec[sshv][alg_type]['del'].items():
+                    del rec[sshv][alg_type]['del']
-                        if cf != mf:
+                if chg_count == 0:
-                            new_del[k] = cf
+                    del rec[sshv][alg_type]['chg']
-                    if del_count != len(new_del):
+                if len(rec[sshv][alg_type]) == 0:
-                        rec[sshv][alg_type]['del'] = new_del
-                        new_alg_count += del_count - len(new_del)
-                if new_alg_count < 1:
                     del rec[sshv][alg_type]
-                else:
-                    if add_count == 0:
-                        del rec[sshv][alg_type]['add']
-                    if del_count == 0:
-                        del rec[sshv][alg_type]['del']
-                    if chg_count == 0:
-                        del rec[sshv][alg_type]['chg']
-                    if len(rec[sshv][alg_type]) == 0:
-                        del rec[sshv][alg_type]
             if len(rec[sshv]) == 0:
                 del rec[sshv]
         return software, rec

test/docker/expected_results/dropbear_2019.78_test1.txt

@@ -71,13 +71,16 @@
 (rec) -ecdh-sha2-nistp256            -- kex algorithm to remove 
 (rec) -ecdh-sha2-nistp384            -- kex algorithm to remove 
 (rec) -ecdh-sha2-nistp521            -- kex algorithm to remove 
+(rec) -ecdsa-sha2-nistp256           -- key algorithm to remove 
 (rec) -hmac-sha1-96                  -- mac algorithm to remove 
 (rec) -ssh-dss                       -- key algorithm to remove 
+(rec) -ssh-rsa                       -- key algorithm to remove 
 (rec) +diffie-hellman-group16-sha512 -- kex algorithm to append 
 (rec) +twofish128-ctr                -- enc algorithm to append 
 (rec) +twofish256-ctr                -- enc algorithm to append 
 (rec) -diffie-hellman-group14-sha1   -- kex algorithm to remove 
 (rec) -hmac-sha1                     -- mac algorithm to remove 
+(rec) -hmac-sha2-256                 -- mac algorithm to remove 
 
 # additional info
 (nfo) For hardening guides on common OSes, please see: <https://www.ssh-audit.com/hardening_guides.html>

test/docker/expected_results/openssh_4.0p1_test1.txt

@@ -133,6 +133,9 @@
 (rec) -hmac-sha1-96                       -- mac algorithm to remove 
 (rec) -rijndael-cbc@lysator.liu.se        -- enc algorithm to remove 
 (rec) -ssh-dss                            -- key algorithm to remove 
+(rec) -ssh-rsa                            -- key algorithm to remove 
+(rec) -diffie-hellman-group14-sha1        -- kex algorithm to remove 
+(rec) -hmac-sha1                          -- mac algorithm to remove 
 
 # additional info
 (nfo) For hardening guides on common OSes, please see: <https://www.ssh-audit.com/hardening_guides.html>

test/docker/expected_results/openssh_5.6p1_test1.txt

@@ -141,7 +141,10 @@
 (rec) -hmac-sha1-96                         -- mac algorithm to remove 
 (rec) -rijndael-cbc@lysator.liu.se          -- enc algorithm to remove 
 (rec) -ssh-dss                              -- key algorithm to remove 
+(rec) -ssh-rsa                              -- key algorithm to remove 
 (rec) -diffie-hellman-group14-sha1          -- kex algorithm to remove 
+(rec) -hmac-sha1                            -- mac algorithm to remove 
+(rec) -umac-64@openssh.com                  -- mac algorithm to remove 
 
 # additional info
 (nfo) For hardening guides on common OSes, please see: <https://www.ssh-audit.com/hardening_guides.html>

test/docker/expected_results/openssh_5.6p1_test2.txt

@@ -35,7 +35,8 @@
 (key) ssh-rsa (1024-bit)                    -- [fail] using weak hashing algorithm
                                             `- [warn] using small 1024-bit modulus
                                             `- [info] available since OpenSSH 2.5.0, Dropbear SSH 0.28
-(key) ssh-rsa-cert-v01@openssh.com (1024-bit cert/1024-bit CA) -- [fail] using small 1024-bit modulus
+(key) ssh-rsa-cert-v01@openssh.com (1024-bit cert/1024-bit CA) -- [fail] using weak hashing algorithm
+                                                               `- [warn] using small 1024-bit modulus
                                                                `- [info] available since OpenSSH 5.6
 
 # encryption algorithms (ciphers)
@@ -121,7 +122,6 @@
 
 # algorithm recommendations (for OpenSSH 5.6)
 (rec) !diffie-hellman-group-exchange-sha256 -- kex algorithm to change (increase modulus size to 2048 bits or larger) 
-(rec) !ssh-rsa-cert-v01@openssh.com         -- key algorithm to change (increase modulus size to 2048 bits or larger) 
 (rec) -3des-cbc                             -- enc algorithm to remove 
 (rec) -aes128-cbc                           -- enc algorithm to remove 
 (rec) -aes192-cbc                           -- enc algorithm to remove 
@@ -140,7 +140,10 @@
 (rec) -hmac-sha1-96                         -- mac algorithm to remove 
 (rec) -rijndael-cbc@lysator.liu.se          -- enc algorithm to remove 
 (rec) -ssh-rsa                              -- key algorithm to remove 
+(rec) -ssh-rsa-cert-v01@openssh.com         -- key algorithm to remove 
 (rec) -diffie-hellman-group14-sha1          -- kex algorithm to remove 
+(rec) -hmac-sha1                            -- mac algorithm to remove 
+(rec) -umac-64@openssh.com                  -- mac algorithm to remove 
 
 # additional info
 (nfo) For hardening guides on common OSes, please see: <https://www.ssh-audit.com/hardening_guides.html>

test/docker/expected_results/openssh_5.6p1_test3.txt

@@ -35,7 +35,8 @@
 (key) ssh-rsa (1024-bit)                    -- [fail] using weak hashing algorithm
                                             `- [warn] using small 1024-bit modulus
                                             `- [info] available since OpenSSH 2.5.0, Dropbear SSH 0.28
-(key) ssh-rsa-cert-v01@openssh.com (1024-bit cert/3072-bit CA) -- [fail] using small 1024-bit modulus
+(key) ssh-rsa-cert-v01@openssh.com (1024-bit cert/3072-bit CA) -- [fail] using weak hashing algorithm
+                                                               `- [warn] using small 1024-bit modulus
                                                                `- [info] available since OpenSSH 5.6
 
 # encryption algorithms (ciphers)
@@ -121,7 +122,6 @@
 
 # algorithm recommendations (for OpenSSH 5.6)
 (rec) !diffie-hellman-group-exchange-sha256 -- kex algorithm to change (increase modulus size to 2048 bits or larger) 
-(rec) !ssh-rsa-cert-v01@openssh.com         -- key algorithm to change (increase modulus size to 2048 bits or larger) 
 (rec) -3des-cbc                             -- enc algorithm to remove 
 (rec) -aes128-cbc                           -- enc algorithm to remove 
 (rec) -aes192-cbc                           -- enc algorithm to remove 
@@ -140,7 +140,10 @@
 (rec) -hmac-sha1-96                         -- mac algorithm to remove 
 (rec) -rijndael-cbc@lysator.liu.se          -- enc algorithm to remove 
 (rec) -ssh-rsa                              -- key algorithm to remove 
+(rec) -ssh-rsa-cert-v01@openssh.com         -- key algorithm to remove 
 (rec) -diffie-hellman-group14-sha1          -- kex algorithm to remove 
+(rec) -hmac-sha1                            -- mac algorithm to remove 
+(rec) -umac-64@openssh.com                  -- mac algorithm to remove 
 
 # additional info
 (nfo) For hardening guides on common OSes, please see: <https://www.ssh-audit.com/hardening_guides.html>

test/docker/expected_results/openssh_5.6p1_test4.txt

@@ -34,7 +34,8 @@
 # host-key algorithms
 (key) ssh-rsa (3072-bit)                    -- [fail] using weak hashing algorithm
                                             `- [info] available since OpenSSH 2.5.0, Dropbear SSH 0.28
-(key) ssh-rsa-cert-v01@openssh.com (3072-bit cert/1024-bit CA) -- [fail] using small 1024-bit modulus
+(key) ssh-rsa-cert-v01@openssh.com (3072-bit cert/1024-bit CA) -- [fail] using weak hashing algorithm
+                                                               `- [warn] using small 1024-bit modulus
                                                                `- [info] available since OpenSSH 5.6
 
 # encryption algorithms (ciphers)
@@ -120,7 +121,6 @@
 
 # algorithm recommendations (for OpenSSH 5.6)
 (rec) !diffie-hellman-group-exchange-sha256 -- kex algorithm to change (increase modulus size to 2048 bits or larger) 
-(rec) !ssh-rsa-cert-v01@openssh.com         -- key algorithm to change (increase modulus size to 2048 bits or larger) 
 (rec) -3des-cbc                             -- enc algorithm to remove 
 (rec) -aes128-cbc                           -- enc algorithm to remove 
 (rec) -aes192-cbc                           -- enc algorithm to remove 
@@ -139,7 +139,10 @@
 (rec) -hmac-sha1-96                         -- mac algorithm to remove 
 (rec) -rijndael-cbc@lysator.liu.se          -- enc algorithm to remove 
 (rec) -ssh-rsa                              -- key algorithm to remove 
+(rec) -ssh-rsa-cert-v01@openssh.com         -- key algorithm to remove 
 (rec) -diffie-hellman-group14-sha1          -- kex algorithm to remove 
+(rec) -hmac-sha1                            -- mac algorithm to remove 
+(rec) -umac-64@openssh.com                  -- mac algorithm to remove 
 
 # additional info
 (nfo) For hardening guides on common OSes, please see: <https://www.ssh-audit.com/hardening_guides.html>

test/docker/expected_results/openssh_5.6p1_test5.txt

@@ -34,7 +34,8 @@
 # host-key algorithms
 (key) ssh-rsa (3072-bit)                    -- [fail] using weak hashing algorithm
                                             `- [info] available since OpenSSH 2.5.0, Dropbear SSH 0.28
-(key) ssh-rsa-cert-v01@openssh.com (3072-bit cert/3072-bit CA) -- [info] available since OpenSSH 5.6
+(key) ssh-rsa-cert-v01@openssh.com (3072-bit cert/3072-bit CA) -- [fail] using weak hashing algorithm
+                                                               `- [info] available since OpenSSH 5.6
 
 # encryption algorithms (ciphers)
 (enc) aes128-ctr                            -- [info] available since OpenSSH 3.7, Dropbear SSH 0.52
@@ -137,7 +138,10 @@
 (rec) -hmac-sha1-96                         -- mac algorithm to remove 
 (rec) -rijndael-cbc@lysator.liu.se          -- enc algorithm to remove 
 (rec) -ssh-rsa                              -- key algorithm to remove 
+(rec) -ssh-rsa-cert-v01@openssh.com         -- key algorithm to remove 
 (rec) -diffie-hellman-group14-sha1          -- kex algorithm to remove 
+(rec) -hmac-sha1                            -- mac algorithm to remove 
+(rec) -umac-64@openssh.com                  -- mac algorithm to remove 
 
 # additional info
 (nfo) For hardening guides on common OSes, please see: <https://www.ssh-audit.com/hardening_guides.html>