Removed Protocol statement in later versions of sshd, since the code … (#342)
* Removed Protocol statement in later versions of sshd, since the code for SSH-1 has been removed in sshd. Signed-off-by: Farid Joubbi <[email protected]> * Prettified the generated ssh_config. No functional changes, removed spaces and orphan comments. Signed-off-by: Farid Joubbi <[email protected]> * Removed Protocol statement in later versions of sshd, since the code for SSH-1 has been removed in sshd. Signed-off-by: Farid Joubbi <[email protected]> * Removed blank lines and prettified ssh_config. Signed-off-by: Farid Joubbi <[email protected]> * Added note about setting sshd_authenticationmethods if ssh_server_password_login. Signed-off-by: Farid Joubbi <[email protected]> * Backticked true. Signed-off-by: Farid Joubbi <[email protected]>
This commit is contained in:
Farid Joubbi authored and GitHub committed
1 parent
43ec139d24
commit
83e29b01f5
3 files changed
+40
-33
No files matched your search
@@ -2,7 +2,7 @@
|
||||
{{ ansible_managed | comment }}
|
||||
|
||||
# This is the ssh client system-wide configuration file.
|
||||
# See ssh_config(5) for more information on any settings used. Comments will be added only to clarify why a configuration was chosen.
|
||||
# See ssh_config(5) for more information on any settings used.
|
||||
|
||||
{% if ssh_custom_options %}
|
||||
# Custom configuration that overwrites default configuration
|
||||
@@ -26,14 +26,14 @@ Host {{ host.names | join(' ') }}
|
||||
{{ host.options | join('\n') | indent(2) }}
|
||||
|
||||
{% endfor %}
|
||||
|
||||
# Global defaults for all Hosts
|
||||
Host *
|
||||
|
||||
# The port at the destination should be defined
|
||||
Port {{ ssh_client_port }}
|
||||
|
||||
# Identity file configuration. You may restrict available identity files. Otherwise ssh will search for a pattern and use any that matches.
|
||||
# Identity file configuration. You may restrict available identity files.
|
||||
# Otherwise ssh will search for a pattern and use any that matches.
|
||||
#IdentityFile ~/.ssh/identity
|
||||
#IdentityFile ~/.ssh/id_rsa
|
||||
#IdentityFile ~/.ssh/id_dsa
|
||||
@@ -42,9 +42,12 @@ Port {{ ssh_client_port }}
|
||||
# Security configuration
|
||||
# ======================
|
||||
|
||||
# Set the protocol version to 2 for security reasons. Disables legacy support.
|
||||
{# Support for legacy SSHv1 has been completely removed from OpenSSH in version 7.6 -#}
|
||||
{% if sshd_version is version('7.6', '<') %}
|
||||
# Set the protocol version explicitly to 2. Version 1 is obsolete and should not be used.
|
||||
Protocol 2
|
||||
|
||||
{% endif %}
|
||||
# Make sure passphrase querying is enabled
|
||||
BatchMode no
|
||||
|
||||
@@ -54,35 +57,34 @@ CheckHostIP yes
|
||||
# Always ask before adding keys to the `known_hosts` file. Do not set to `yes`.
|
||||
StrictHostKeyChecking ask
|
||||
|
||||
|
||||
# **Ciphers** -- If your clients don't support CTR (eg older versions), cbc will be added
|
||||
# CBC: is true if you want to connect with OpenSSL-base libraries
|
||||
# eg ruby Net::SSH::Transport::CipherFactory requires cbc-versions of the given openssh ciphers to work
|
||||
# -- see: (http://net-ssh.github.com/net-ssh/classes/Net/SSH/Transport/CipherFactory.html)
|
||||
#
|
||||
|
||||
{# This outputs 'Ciphers <list-of-ciphers>' if ssh_ciphers is defined or '#Ciphers' if ssh_ciphers is undefined #}
|
||||
{# This outputs 'Ciphers <list-of-ciphers>' if ssh_ciphers is defined or '#Ciphers' if ssh_ciphers is undefined -#}
|
||||
{{ 'Ciphers ' ~ ssh_ciphers|join(',') if ssh_ciphers else 'Ciphers'|comment }}
|
||||
|
||||
# **Hash algorithms** -- Make sure not to use SHA1 for hashing, unless it is really necessary.
|
||||
# Weak HMAC is sometimes required if older package versions are used
|
||||
# eg Ruby's Net::SSH at around 2.2.* doesn't support sha2 for hmac, so this will have to be set true in this case.
|
||||
#
|
||||
|
||||
{# This outputs 'MACs <list-of-macs>' if ssh_macs is defined or '#MACs' if ssh_macs is undefined #}
|
||||
{# This outputs 'MACs <list-of-macs>' if ssh_macs is defined or '#MACs' if ssh_macs is undefined -#}
|
||||
{{ 'MACs ' ~ ssh_macs|join(',') if ssh_macs else 'MACs'|comment }}
|
||||
|
||||
# Alternative setting, if OpenSSH version is below v5.9
|
||||
#MACs hmac-ripemd160
|
||||
|
||||
# **Key Exchange Algorithms** -- Make sure not to use SHA1 for kex, unless it is really necessary
|
||||
# Weak kex is sometimes required if older package versions are used
|
||||
# eg ruby's Net::SSH at around 2.2.* doesn't support sha2 for kex, so this will have to be set true in this case.
|
||||
# based on: https://bettercrypto.org/static/applied-crypto-hardening.pdf
|
||||
|
||||
#
|
||||
{# This outputs 'KexAlgorithms <list-of-algos>' if ssh_kex is defined or '#KexAlgorithms' if ssh_kex is undefined #}
|
||||
{{ 'KexAlgorithms ' ~ ssh_kex|join(',') if ssh_kex else 'KexAlgorithms'|comment }}
|
||||
|
||||
{% if sshd_version is version('5.9', '<') %}
|
||||
# Alternative setting, if OpenSSH version is below v5.9
|
||||
#MACs hmac-ripemd160
|
||||
|
||||
{% endif %}
|
||||
# Disable agent forwarding, since local agent could be accessed through forwarded connection.
|
||||
ForwardAgent no
|
||||
|
||||
@@ -120,6 +122,7 @@ Compression {{ 'yes' if (ssh_client_compression|bool) else 'no' }}
|
||||
#VisualHostKey yes
|
||||
|
||||
{% if sshd_version is version('7.1', '<=') %}
|
||||
# Disable experimental client roaming. This is known to cause potential issues with secrets being disclosed to malicious servers and defaults to being disabled.
|
||||
# Disable experimental client roaming.
|
||||
# This is known to cause potential issues with secrets being disclosed to malicious servers. Disabled by default.
|
||||
UseRoaming {{ 'yes' if ssh_client_roaming else 'no' }}
|
||||
{% endif %}
|
||||
@@ -45,9 +45,12 @@ HostKey {{ key }}
|
||||
# Security configuration
|
||||
# ======================
|
||||
|
||||
{# Support for legacy SSHv1 has been completely removed from OpenSSH in version 7.6 -#}
|
||||
{% if sshd_version is version('7.6', '<') %}
|
||||
# Set the protocol version explicitly to 2. Version 1 is obsolete and should not be used.
|
||||
Protocol 2
|
||||
|
||||
{% endif %}
|
||||
# Make sure sshd checks file modes and ownership before accepting logins. This prevents accidental misconfiguration.
|
||||
StrictModes {{ 'yes' if (sshd_strict_modes|bool) else 'no' }}
|
||||
|
||||
@@ -63,26 +66,26 @@ LogLevel {{ sshd_log_level }}
|
||||
# eg ruby Net::SSH::Transport::CipherFactory requires cbc-versions of the given openssh ciphers to work
|
||||
# -- see: (http://net-ssh.github.com/net-ssh/classes/Net/SSH/Transport/CipherFactory.html)
|
||||
#
|
||||
|
||||
{# This outputs 'Ciphers <list-of-ciphers>' if ssh_ciphers is defined or '#Ciphers' if ssh_ciphers is undefined #}
|
||||
{# This outputs 'Ciphers <list-of-ciphers>' if ssh_ciphers is defined or '#Ciphers' if ssh_ciphers is undefined -#}
|
||||
{{ 'Ciphers ' ~ ssh_ciphers|join(',') if ssh_ciphers else 'Ciphers'|comment }}
|
||||
|
||||
# **Hash algorithms** -- SHA-1 is formally deprecated by NIST in 2011 because of security issues.
|
||||
# Weak HMAC is sometimes required if older package versions are used
|
||||
# eg Ruby's Net::SSH at around 2.2.* doesn't support sha2 for hmac, so this will have to be set true in this case.
|
||||
#
|
||||
|
||||
{# This outputs 'MACs <list-of-macs>' if ssh_macs is defined or '#MACs' if ssh_macs is undefined #}
|
||||
{# This outputs 'MACs <list-of-macs>' if ssh_macs is defined or '#MACs' if ssh_macs is undefined -#}
|
||||
{{ 'MACs ' ~ ssh_macs|join(',') if ssh_macs else 'MACs'|comment }}
|
||||
|
||||
{% if sshd_version is version('5.9', '<') %}
|
||||
# Alternative setting, if OpenSSH version is below v5.9
|
||||
#MACs hmac-ripemd160
|
||||
|
||||
{% endif %}
|
||||
# **Key Exchange Algorithms** -- SHA-1 is formally deprecated by NIST in 2011 because of security issues.
|
||||
# Weak kex is sometimes required if older package versions are used
|
||||
# eg ruby's Net::SSH at around 2.2.* doesn't support sha2 for kex, so this will have to be set true in this case.
|
||||
# based on: https://bettercrypto.org/static/applied-crypto-hardening.pdf
|
||||
|
||||
#
|
||||
{# This outputs 'KexAlgorithms <list-of-algos>' if ssh_kex is defined or '#KexAlgorithms' if ssh_kex is undefined #}
|
||||
{{ 'KexAlgorithms ' ~ ssh_kex|join(',') if ssh_kex else 'KexAlgorithms'|comment }}
|
||||
|
||||
@@ -114,17 +117,17 @@ IgnoreRhosts yes
|
||||
IgnoreUserKnownHosts yes
|
||||
HostbasedAuthentication no
|
||||
|
||||
# Enable PAM to enforce system wide rules.
|
||||
{% if ssh_pam_support %}
|
||||
# Enable PAM to enforce system wide rules.
|
||||
UsePAM {{ 'yes' if (ssh_use_pam|bool) else 'no' }}
|
||||
{% endif %}
|
||||
|
||||
# Set AuthenticationMethods per default to publickey
|
||||
# AuthenticationMethods was introduced in OpenSSH 6.2 - https://www.openssh.com/txt/release-6.2
|
||||
{% endif %}
|
||||
{# Set AuthenticationMethods per default to publickey -#}
|
||||
{# AuthenticationMethods was introduced in OpenSSH 6.2 - https://www.openssh.com/txt/release-6.2 -#}
|
||||
{% if sshd_version is version('6.2', '>=') %}
|
||||
AuthenticationMethods {{ sshd_authenticationmethods }}
|
||||
{% endif %}
|
||||
|
||||
{% endif %}
|
||||
# Disable password-based authentication, it can allow for potentially easier brute-force attacks.
|
||||
PasswordAuthentication {{ 'yes' if (ssh_server_password_login|bool) else 'no' }}
|
||||
PermitEmptyPasswords no
|
||||
@@ -142,28 +145,28 @@ KerberosTicketCleanup yes
|
||||
GSSAPIAuthentication {{ 'yes' if ssh_gssapi_support else 'no' }}
|
||||
GSSAPICleanupCredentials yes
|
||||
|
||||
{% if ssh_deny_users %}
|
||||
# In case you don't use PAM (`UsePAM no`), you can alternatively restrict users and groups here.
|
||||
# For key-based authentication this is not necessary, since all keys must be explicitely enabled.
|
||||
{% if ssh_deny_users %}
|
||||
DenyUsers {{ ssh_deny_users }}
|
||||
{% endif %}
|
||||
|
||||
{% endif %}
|
||||
{% if ssh_allow_users %}
|
||||
AllowUsers {{ ssh_allow_users }}
|
||||
{% endif %}
|
||||
|
||||
{% endif %}
|
||||
{% if ssh_deny_groups %}
|
||||
DenyGroups {{ ssh_deny_groups }}
|
||||
{% endif %}
|
||||
|
||||
{% endif %}
|
||||
{% if ssh_allow_groups %}
|
||||
AllowGroups {{ ssh_allow_groups }}
|
||||
{% endif %}
|
||||
|
||||
{% endif %}
|
||||
{% if ssh_authorized_keys_file %}
|
||||
AuthorizedKeysFile {{ ssh_authorized_keys_file }}
|
||||
{% endif %}
|
||||
|
||||
{% endif %}
|
||||
{% if ssh_trusted_user_ca_keys_file %}
|
||||
TrustedUserCAKeys {{ ssh_trusted_user_ca_keys_file }}
|
||||
{% if ssh_authorized_principals_file %}
|
||||
@@ -178,7 +181,8 @@ AuthorizedPrincipalsFile {{ ssh_authorized_principals_file }}
|
||||
TCPKeepAlive no
|
||||
|
||||
# Manage `ClientAlive..` signals via interval and maximum count.
|
||||
# This will periodically check up to a `..CountMax` number of times within `..Interval` timeframe, and abort the connection once these fail.
|
||||
# This will periodically check up to a `..CountMax` number of times within `..Interval` timeframe,
|
||||
# and abort the connection once these fail.
|
||||
ClientAliveInterval {{ ssh_client_alive_interval }}
|
||||
ClientAliveCountMax {{ ssh_client_alive_count }}
|
||||
|
||||
@@ -238,8 +242,8 @@ Banner {{ ssh_banner_path if (ssh_banner|bool) else 'none' }}
|
||||
|
||||
{% if ansible_facts.os_family == 'Debian' %}
|
||||
DebianBanner {{ 'yes' if (ssh_print_debian_banner|bool) else 'no' }}
|
||||
{% endif %}
|
||||
|
||||
{% endif %}
|
||||
# Reject keys that are explicitly blacklisted
|
||||
RevokedKeys /etc/ssh/revoked_keys
|
||||
|
||||
|
||||
Reference in new issue
Block a user