[TakGN]

99-hardening.conf left sshd's Compression at its default, which in OpenSSH means zlib after login. It buys nothing on these links, and OpenSSH before 10.6 has two decompression bugs behind it:

• CVE-2026-106582: an LZ77 dictionary coder is used even though the "Crossing the Streams" findings advise against it.
• CVE-2026-106585: decompressed data is not checked against the maximum packet length.

Ubuntu 24.04's 9.6p1 has both fixes backported. Debian 13's 10.0p1 does not, and Debian has marked both minor with no backport planned. This adds Compression no next to the other sshd settings, so on every box the hardening role manages, a logged-in peer cannot reach the zlib code at all.

What else this affects: nothing in the repo asks for SSH compression. ansible.cfg's ssh_args, scripts/ and CI don't pass -C or Compression, so Ansible, kubectl-tunnel.sh and CI's runs are unchanged.

Rollout: through site.yml from CI, one box at a time (production_rollout). The task already validates the file with sshd -t before writing it, and only reloads sshd, so established sessions stay up. The existing post-check then logs in afresh before the run moves on.

Checks: ansible-playbook --syntax-check on site.yml and cve.yml, yamllint ., and ansible-lint (production profile, 0 failures, 0 warnings).

🤖 Generated with Claude Code

[claude]

Claude review

The change is one line: Compression no in the sshd drop-in 99-hardening.conf, placed in the global section ahead of any Match block. The task validates it with sshd -t before writing and only reloads sshd. The post-hardening SSH login check still runs after the reload. I found nothing in the repo that asks for SSH compression: ansible.cfg, scripts/ and the CI workflows don't pass -C or Compression. A client that does ask for it still connects and just gets no compression. The change only covers boxes in managed_boxes. sf and sf2 don't get this drop-in, which matches the PR description and AGENTS.md. I didn't verify the CVE IDs or the OpenSSH version claims in the comment; they come from the PR text.

No issues found.

_{claude-sonnet-5-5 at high effort · requested by TakGN · re-run with @claude review [sonnet|opus|fable] [low|medium|high|xhigh|max]}