Skip to content
This repository was archived by the owner on Dec 26, 2020. It is now read-only.

Commit eaab080

Browse files
atomic111atomic111
authored
Merge pull request #139 from dev-sec/macs_kex_ciphers
Macs kex ciphers
2 parents 92a23e1 + 9bf929b commit eaab080

File tree

8 files changed

+192
-149
lines changed

8 files changed

+192
-149
lines changed

‎.travis.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@ script:
5454
- 'docker run --detach --volume="${PWD}":/etc/ansible/roles/ansible-ssh-hardening:ro ${run_opts} rndmh3ro/docker-${distro}-ansible:${version} "${init}" > "${container_id}"'
5555

5656
# Test role.
57+
- 'docker exec "$(cat ${container_id})" ansible-playbook /etc/ansible/roles/ansible-ssh-hardening/default_custom.yml'
5758
- 'docker exec "$(cat ${container_id})" ansible-playbook /etc/ansible/roles/ansible-ssh-hardening/default.yml'
5859

5960
# Verify role

‎default.yml‎

Lines changed: 1 addition & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with custom settings
2+
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
33
hosts: localhost
44
pre_tasks:
55
- package: name="{{item}}" state=installed
@@ -19,48 +19,3 @@
1919

2020
roles:
2121
- ansible-ssh-hardening
22-
vars:
23-
network_ipv6_enable: true
24-
ssh_allow_root_with_key: true
25-
ssh_allow_tcp_forwarding: true
26-
ssh_gateway_ports: true
27-
ssh_allow_agent_forwarding: true
28-
ssh_server_permit_environment_vars: ['PWD','HTTP_PROXY']
29-
ssh_client_alive_interval: 100
30-
ssh_client_alive_count: 10
31-
ssh_client_password_login: true
32-
ssh_client_cbc_required: true
33-
ssh_client_weak_kex: true
34-
ssh_challengeresponseauthentication: true
35-
ssh_compression: true
36-
ssh_allow_users: 'root kitchen vagrant'
37-
ssh_allow_groups: 'root kitchen vagrant'
38-
ssh_deny_users: 'foo bar'
39-
ssh_deny_groups: 'foo bar'
40-
ssh_authorized_keys_file: '/etc/ssh/authorized_keys/%u'
41-
ssh_max_auth_retries: 10
42-
ssh_permit_tunnel: true
43-
ssh_print_motd: true
44-
ssh_print_last_log: true
45-
ssh_banner: true
46-
ssh_server_password_login: true
47-
ssh_server_weak_hmac: true
48-
sftp_enabled: true
49-
ssh_server_match_group:
50-
- group: 'root'
51-
rules: 'AllowTcpForwarding yes'
52-
ssh_server_match_user:
53-
- user: 'root'
54-
rules: 'AllowTcpForwarding yes'
55-
ssh_remote_hosts:
56-
- names: ['example.com', 'example2.com']
57-
options: ['Port 2222', 'ForwardAgent yes']
58-
- names: ['example3.com']
59-
options: ['StrictHostKeyChecking no']
60-
ssh_use_dns: true
61-
ssh_use_pam: true
62-
63-
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
64-
hosts: localhost
65-
roles:
66-
- ansible-ssh-hardening

‎default_custom.yml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
---
2+
- name: wrapper playbook for kitchen testing "ansible-ssh-hardening" with custom settings
3+
hosts: localhost
4+
pre_tasks:
5+
- package: name="{{item}}" state=installed
6+
with_items:
7+
- "openssh-clients"
8+
- "openssh-server"
9+
ignore_errors: true
10+
- apt: name="{{item}}" state=installed update_cache=true
11+
with_items:
12+
- "openssh-client"
13+
- "openssh-server"
14+
ignore_errors: true
15+
- file: path="/var/run/sshd" state=directory
16+
- name: create ssh host keys
17+
command: "ssh-keygen -A"
18+
when: not ((ansible_os_family in ['Oracle Linux', 'RedHat']) and ansible_distribution_major_version < '7')
19+
20+
roles:
21+
- ansible-ssh-hardening
22+
vars:
23+
network_ipv6_enable: true
24+
ssh_allow_root_with_key: true
25+
ssh_allow_tcp_forwarding: true
26+
ssh_gateway_ports: true
27+
ssh_allow_agent_forwarding: true
28+
ssh_server_permit_environment_vars: ['PWD','HTTP_PROXY']
29+
ssh_client_alive_interval: 100
30+
ssh_client_alive_count: 10
31+
ssh_client_password_login: true
32+
ssh_client_cbc_required: true
33+
ssh_client_weak_kex: true
34+
ssh_challengeresponseauthentication: true
35+
ssh_compression: true
36+
ssh_allow_users: 'root kitchen vagrant'
37+
ssh_allow_groups: 'root kitchen vagrant'
38+
ssh_deny_users: 'foo bar'
39+
ssh_deny_groups: 'foo bar'
40+
ssh_authorized_keys_file: '/etc/ssh/authorized_keys/%u'
41+
ssh_max_auth_retries: 10
42+
ssh_permit_tunnel: true
43+
ssh_print_motd: true
44+
ssh_print_last_log: true
45+
ssh_banner: true
46+
ssh_server_password_login: true
47+
ssh_server_weak_hmac: true
48+
sftp_enabled: true
49+
ssh_server_enabled: false
50+
ssh_server_match_group:
51+
- group: 'root'
52+
rules: 'AllowTcpForwarding yes'
53+
ssh_server_match_user:
54+
- user: 'root'
55+
rules: 'AllowTcpForwarding yes'
56+
ssh_remote_hosts:
57+
- names: ['example.com', 'example2.com']
58+
options: ['Port 2222', 'ForwardAgent yes']
59+
- names: ['example3.com']
60+
options: ['StrictHostKeyChecking no']
61+
ssh_use_dns: true
62+
ssh_use_pam: true

‎defaults/main.yml‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,10 @@ ssh_server_permit_environment_vars: false
127127
ssh_ps53: 'yes'
128128
ssh_ps59: 'sandbox'
129129

130+
ssh_macs: []
131+
ssh_ciphers: []
132+
ssh_kex: []
133+
130134
ssh_macs_53_default:
131135
- hmac-ripemd160
132136
- hmac-sha1
@@ -141,11 +145,16 @@ ssh_macs_59_weak: "{{ ssh_macs_59_default + ['hmac-sha1'] }}"
141145
ssh_macs_66_default:
142146
- hmac-sha2-512-etm@openssh.com
143147
- hmac-sha2-256-etm@openssh.com
144-
- hmac-ripemd160-etm@openssh.com
145148
- umac-128-etm@openssh.com
146149
- hmac-sha2-512
147150
- hmac-sha2-256
148-
- hmac-ripemd160
151+
152+
ssh_macs_76_default:
153+
- hmac-sha2-512-etm@openssh.com
154+
- hmac-sha2-256-etm@openssh.com
155+
- umac-128-etm@openssh.com
156+
- hmac-sha2-512
157+
- hmac-sha2-256
149158

150159
ssh_macs_66_weak: "{{ ssh_macs_66_default + ['hmac-sha1'] }}"
151160

‎tasks/crypto.yml‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
---
2+
3+
- name: set hostkeys according to openssh-version
4+
set_fact:
5+
ssh_host_key_files: ['/etc/ssh/ssh_host_rsa_key', '/etc/ssh/ssh_host_ecdsa_key', '/etc/ssh/ssh_host_ed25519_key']
6+
when: sshd_version.stdout >= '6.3' and not ssh_host_key_files
7+
8+
- name: set hostkeys according to openssh-version
9+
set_fact:
10+
ssh_host_key_files: ['/etc/ssh/ssh_host_rsa_key', '/etc/ssh/ssh_host_ecdsa_key']
11+
when: sshd_version.stdout >= '6.0' and not ssh_host_key_files
12+
13+
- name: set hostkeys according to openssh-version
14+
set_fact:
15+
ssh_host_key_files: ['/etc/ssh/ssh_host_rsa_key']
16+
when: sshd_version.stdout >= '5.3' and not ssh_host_key_files
17+
18+
###
19+
20+
- name: set weak macs according to openssh-version if openssh >= 7.6
21+
set_fact:
22+
ssh_macs: "{{ssh_macs_76_default}}"
23+
when: sshd_version.stdout >= '7.6' and not ssh_macs
24+
25+
- name: set weak macs according to openssh-version if openssh >= 6.6
26+
set_fact:
27+
ssh_macs: "{{ssh_macs_66_weak}}"
28+
when: sshd_version.stdout >= '6.6' and ssh_server_weak_hmac and not ssh_macs
29+
30+
- name: set macs according to openssh-version if openssh >= 6.6
31+
set_fact:
32+
ssh_macs: "{{ssh_macs_66_default}}"
33+
when: sshd_version.stdout >= '6.6' and not ssh_macs
34+
35+
- name: set weak macs according to openssh-version
36+
set_fact:
37+
ssh_macs: "{{ssh_macs_59_weak}}"
38+
when: sshd_version.stdout >= '5.9' and ssh_server_weak_hmac and not ssh_macs
39+
40+
- name: set macs according to openssh-version
41+
set_fact:
42+
ssh_macs: "{{ssh_macs_59_default}}"
43+
when: sshd_version.stdout >= '5.9' and not ssh_macs
44+
45+
- name: set macs according to openssh-version
46+
set_fact:
47+
ssh_macs: "{{ssh_macs_53_default}}"
48+
when: sshd_version.stdout >= '5.3' and not ssh_macs
49+
50+
- name: set macs according to openssh-version
51+
set_fact:
52+
ssh_macs: "{{ssh_macs_53_default}}"
53+
when: sshd_version.stdout >= '5.3' and not ssh_macs
54+
55+
###
56+
57+
- name: set weak ciphers according to openssh-version if openssh >= 6.6
58+
set_fact:
59+
ssh_ciphers: "{{ssh_ciphers_66_weak}}"
60+
when: sshd_version.stdout >= '6.6' and ssh_server_cbc_required and not ssh_ciphers
61+
62+
- name: set ciphers according to openssh-version if openssh >= 6.6
63+
set_fact:
64+
ssh_ciphers: "{{ssh_ciphers_66_default}}"
65+
when: sshd_version.stdout >= '6.6' and not ssh_ciphers
66+
67+
- name: set weak ciphers according to openssh-version
68+
set_fact:
69+
ssh_ciphers: "{{ssh_ciphers_53_weak}}"
70+
when: sshd_version.stdout >= '5.3' and ssh_server_cbc_required and not ssh_ciphers
71+
72+
- name: set ciphers according to openssh-version
73+
set_fact:
74+
ssh_ciphers: "{{ssh_ciphers_53_default}}"
75+
when: sshd_version.stdout >= '5.3' and not ssh_ciphers
76+
77+
###
78+
79+
- name: set weak kex according to openssh-version if openssh >= 6.6
80+
set_fact:
81+
ssh_kex: "{{ssh_kex_66_weak}}"
82+
when: sshd_version.stdout >= '6.6' and ssh_server_weak_hmac and not ssh_kex
83+
84+
- name: set kex according to openssh-version if openssh >= 6.6
85+
set_fact:
86+
ssh_kex: "{{ssh_kex_66_default}}"
87+
when: sshd_version.stdout >= '6.6' and not ssh_kex
88+
89+
- name: set weak kex according to openssh-version
90+
set_fact:
91+
ssh_kex: "{{ssh_kex_59_weak}}"
92+
when: sshd_version.stdout >= '5.9' and ssh_server_weak_hmac and not ssh_kex
93+
94+
- name: set kex according to openssh-version
95+
set_fact:
96+
ssh_kex: "{{ssh_kex_59_default}}"
97+
when: sshd_version.stdout >= '5.9' and not ssh_kex
98+

‎tasks/main.yml‎

Lines changed: 1 addition & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -15,20 +15,7 @@
1515
register: sshd_version
1616
check_mode: no
1717

18-
- name: set hostkeys according to openssh-version
19-
set_fact:
20-
ssh_host_key_files: ['/etc/ssh/ssh_host_rsa_key', '/etc/ssh/ssh_host_ecdsa_key', '/etc/ssh/ssh_host_ed25519_key']
21-
when: sshd_version.stdout >= '6.3' and not ssh_host_key_files
22-
23-
- name: set hostkeys according to openssh-version
24-
set_fact:
25-
ssh_host_key_files: ['/etc/ssh/ssh_host_rsa_key', '/etc/ssh/ssh_host_ecdsa_key']
26-
when: sshd_version.stdout >= '6.0' and not ssh_host_key_files
27-
28-
- name: set hostkeys according to openssh-version
29-
set_fact:
30-
ssh_host_key_files: ['/etc/ssh/ssh_host_rsa_key']
31-
when: sshd_version.stdout >= '5.3' and not ssh_host_key_files
18+
- include: crypto.yml
3219

3320
- name: create revoked_keys and set permissions to root/600
3421
template: src='revoked_keys.j2' dest='/etc/ssh/revoked_keys' mode=0600 owner="{{ ssh_owner }}" group="{{ ssh_group }}"

‎templates/openssh.conf.j2‎

Lines changed: 10 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -45,68 +45,34 @@ CheckHostIP yes
4545
# Always ask before adding keys to the `known_hosts` file. Do not set to `yes`.
4646
StrictHostKeyChecking ask
4747

48+
4849
# **Ciphers** -- If your clients don't support CTR (eg older versions), cbc will be added
4950
# CBC: is true if you want to connect with OpenSSL-base libraries
5051
# eg ruby Net::SSH::Transport::CipherFactory requires cbc-versions of the given openssh ciphers to work
5152
# -- see: (http://net-ssh.github.com/net-ssh/classes/Net/SSH/Transport/CipherFactory.html)
5253
#
53-
{% if ssh_client_cbc_required -%}
54-
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') or (ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version >= '7') or (ansible_distribution == 'FreeBSD' and ansible_distribution_version >= '11') -%}
55-
Ciphers {{ ssh_ciphers_66_weak | join(',') }}
56-
{% else -%}
57-
Ciphers {{ ssh_ciphers_53_weak | join(',') }}
58-
{% endif %}
59-
{% else -%}
60-
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') or (ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version >= '7') or (ansible_distribution == 'FreeBSD' and ansible_distribution_version >= '11') -%}
61-
Ciphers {{ ssh_ciphers_66_default | join(',') }}
62-
{% else -%}
63-
Ciphers {{ ssh_ciphers_53_default | join(',') }}
64-
{% endif %}
65-
{% endif %}
54+
55+
{# This outputs "Ciphers <list-of-ciphers>" if ssh_ciphers is defined or "#Ciphers" if ssh_ciphers is undefined #}
56+
{{ "Ciphers "+ssh_ciphers| join(',') if ssh_ciphers else "Ciphers"|comment }}
6657

6758
# **Hash algorithms** -- Make sure not to use SHA1 for hashing, unless it is really necessary.
6859
# Weak HMAC is sometimes required if older package versions are used
6960
# eg Ruby's Net::SSH at around 2.2.* doesn't support sha2 for hmac, so this will have to be set true in this case.
7061
#
71-
{% if ssh_client_weak_hmac -%}
72-
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') or (ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version >= '7') or (ansible_distribution == 'FreeBSD' and ansible_distribution_version >= '11') -%}
73-
MACs {{ ssh_macs_66_weak | join(',') }}
74-
{% elif ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version <= '6' -%}
75-
MACs {{ ssh_macs_53_default | join(',') }}
76-
{% endif %}
77-
{% else -%}
78-
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') or (ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version >= '7') or (ansible_distribution == 'FreeBSD' and ansible_distribution_version >= '11') -%}
79-
MACs {{ ssh_macs_66_default | join(',') }}
80-
{% elif ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version <= '6' -%}
81-
MACs {{ ssh_macs_53_default | join(',') }}
82-
{% else -%}
83-
MACs {{ ssh_macs_59_default | join(',') }}
84-
{% endif %}
85-
{% endif %}
62+
63+
{# This outputs "MACs <list-of-macs>" if ssh_macs is defined or "#MACs" if ssh_macs is undefined #}
64+
{{ "MACs "+ssh_macs| join(',') if ssh_macs else "MACs"|comment }}
8665

8766
# Alternative setting, if OpenSSH version is below v5.9
8867
#MACs hmac-ripemd160
8968

9069
# **Key Exchange Algorithms** -- Make sure not to use SHA1 for kex, unless it is really necessary
9170
# Weak kex is sometimes required if older package versions are used
9271
# eg ruby's Net::SSH at around 2.2.* doesn't support sha2 for kex, so this will have to be set true in this case.
93-
#
94-
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') or (ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version >= '7') or (ansible_distribution == 'FreeBSD' and ansible_distribution_version >= '11') -%}
95-
{% if ssh_client_weak_kex -%}
96-
KexAlgorithms {{ ssh_kex_66_weak | join(',') }}
97-
{% else -%}
98-
KexAlgorithms {{ ssh_kex_66_default | join(',') }}
99-
{% endif %}
100-
{% else -%}
101-
{% if ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version <= '6' -%}
102-
#KexAlgorithms
103-
{% elif ssh_client_weak_kex -%}
104-
KexAlgorithms {{ ssh_kex_59_weak | join(',') }}
105-
{% else -%}
106-
KexAlgorithms {{ ssh_kex_59_default | join(',') }}
107-
{% endif %}
108-
{% endif %}
72+
# based on: https://bettercrypto.org/static/applied-crypto-hardening.pdf
10973

74+
{# This outputs "KexAlgorithms <list-of-algos>" if ssh_kex is defined or "#KexAlgorithms" if ssh_kex is undefined #}
75+
{{ "KexAlgorithms "+ssh_kex| join(',') if ssh_kex else "KexAlgorithms"|comment }}
11076

11177
# Disable agent forwarding, since local agent could be accessed through forwarded connection.
11278
ForwardAgent no

0 commit comments

Comments
 (0)