Security Enhancement: Allow stronger SSH keys for Git-based theme/component installation

Contribute Feature

AI-generated summary

JBdama highlights a security limitation in Discourse’s Git-based theme/component installation process, where it generates 2048-bit RSA SSH keys, which are now considered outdated. They propose enhancing the feature to: 1) default to generating Ed25519 keys, which are more secure and faster, and 2) allow administrators to configure key algorithm and strength (e.g., rsa:3072, rsa:4096, or ed25519) via discourse.conf. This change would align Discourse with modern security best practices and improve compatibility with stricter Git hosts like Gitea.

1

Problem:
When installing a theme or component from a private Git repository using the “Install from a git repository” option, Discourse automatically generates a 2048-bit RSA SSH keypair for the user to add as a deploy key.

Our private Git server (Gitea, though this would affect any security-conscious Git host) has a security policy that rejects 2048-bit RSA keys, requiring a minimum of 3072 bits. This is in line with modern security best practices, as 2048-bit RSA is now considered the minimum standard and is being phased out (NIST recommends transitioning to stronger algorithms by 2030).

Feature Request:
I would like to request an enhancement to this feature to provide more secure and flexible key generation options. Ideally, the interface could:

  1. Generate a stronger key by default: Move to generating Ed25519 keys, which are more secure, faster, and have better compatibility with modern security policies than 2048-bit RSA.

  2. Provide a configuration option: Allow administrators to specify the preferred SSH key algorithm and strength (e.g., in discourse.conf) with options like rsa:3072, rsa:4096, or ed25519.

Thank you for considering this enhancement. I believe it would be a valuable improvement for the security and professionalism of the Discourse platform.

4 Likes