TechPrufer
Get started
Microsoft
Microsoft logoMicrosoft · Feature trail

SSH Algorithm Support in Azure DevOps

3 posts · Jul 2016 – Jun 2020

What this trail covers

Azure DevOps Services and Server now support SHA-2 class key exchange algorithms (diffie-hellman-group-exchange-sha256) for SSH connections, addressing compatibility issues with newer OpenSSH clients that default to disabling SHA-1. This change was rolled out to Azure DevOps Services on March 6, 2020, and is being brought to Azure DevOps Server 2019 via an April 2020 patch, with Azure DevOps Server 2018 to follow. This post announces the general availability of SSH support for Git repos in both

All Microsoft trails
  1. June patches for Azure DevOps Server and Team Foundation ServerThis post details the June 2020 patches for Azure DevOps Server and Team Foundation Server, which include fixes for security vulnerabilities. Specifically, it addresses CVE-2020-1327 by ensuring Azure DevOps Server sanitizes user inputs and adds support for SHA2 in SSH on Azure DevOps. The post provides specific patch versions and installation instructions for Azure DevOps Server 2019.1.1, Azure DevOps Server 2019.0.1, TFS 2018 Update 3.2, and TFS 2017 Update 3.1, along with methods for verifying the installation.
  2. Supporting SHA-2 algorithm in SSH on Azure DevOpsEnabled support for 'diffie-hellman-group-exchange-sha256' SSH key exchange algorithm in Azure DevOps Services and Server, resolving compatibility issues with OpenSSH 8.2+ clients that disabled SHA-1 by default. This change was deployed to Azure DevOps Services on March 6, 2020, and is planned for Azure DevOps Server 2019 (April 2020 patch) and Azure DevOps Server 2018 (in the coming months).
  3. Azure DevOps Services to require TLS 1.2 (Updated)This post announces the deprecation of TLS 1.0 and TLS 1.1 for Azure DevOps Services, requiring connections to use TLS 1.2 by March 31, 2020. It details the reasons for this change (protocol downgrade attacks and TLS vulnerabilities), outlines the impact on older clients (.NET Framework, older OS versions), and provides a temporary disablement window (March 10, 2020) to help systems fail and prompt upgrades. It includes PowerShell scripts to enable TLS 1.2 on Windows clients and links to further documentation. The post was later updated to postpone the change indefinitely due to customer feedback.
  4. SSH support for Git repos is now availableThis post announces the general availability of SSH support for Git repositories in both TFS and Team Services. It provides instructions on how to upload a public SSH key to the user's security settings in Team Services to enable SSH authentication for connecting to Git repos. This is particularly beneficial for developers working on Linux or Mac environments.