From 29ee683069ed10c808191dc50a4a3b0372ec1563 Mon Sep 17 00:00:00 2001 From: Benjamin Date: Sat, 27 Mar 2021 17:00:58 +0100 Subject: [PATCH] Fix ssh kex sntrup761x25519-sha512@openssh.com for openssh >= 8.5 fix #433 Signed-off-by: Benjamin Signed-off-by: Benjamin Boehm --- roles/ssh_hardening/tasks/crypto_kex.yml | 5 +++++ roles/ssh_hardening/vars/main.yml | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/roles/ssh_hardening/tasks/crypto_kex.yml b/roles/ssh_hardening/tasks/crypto_kex.yml index 193236f2..1161d611 100644 --- a/roles/ssh_hardening/tasks/crypto_kex.yml +++ b/roles/ssh_hardening/tasks/crypto_kex.yml @@ -13,3 +13,8 @@ set_fact: ssh_kex: '{{ ssh_kex_80_default }}' when: sshd_version is version('8.0', '>=') + +- name: Set kex according to openssh-version if openssh >= 8.5 + set_fact: + ssh_kex: '{{ ssh_kex_85_default }}' + when: sshd_version is version('8.5', '>=') diff --git a/roles/ssh_hardening/vars/main.yml b/roles/ssh_hardening/vars/main.yml index 99b7004c..26e95f9a 100644 --- a/roles/ssh_hardening/vars/main.yml +++ b/roles/ssh_hardening/vars/main.yml @@ -50,3 +50,8 @@ ssh_kex_80_default: - sntrup4591761x25519-sha512@tinyssh.org - curve25519-sha256@libssh.org - diffie-hellman-group-exchange-sha256 + +ssh_kex_85_default: + - sntrup761x25519-sha512@openssh.com + - curve25519-sha256@libssh.org + - diffie-hellman-group-exchange-sha256