From a75e2c028ba5ccb376742abf45ffc415a0090ead Mon Sep 17 00:00:00 2001 From: schurzi Date: Sun, 20 Dec 2020 20:46:57 +0100 Subject: [PATCH] change inclusion of os specific defaults (#353) * change inclusion of os specific defaults we now include the os specific options into a separate variable and merge this with the default ansible namespace, when the corresponding keys do not already exist (eg. are defined by default oder by user) Signed-off-by: Martin Schurz * simplify check for os specific variables Signed-off-by: Martin Schurz * add test for variable override Signed-off-by: Martin Schurz * move tests to verify stage Signed-off-by: Martin Schurz * correct grep Signed-off-by: Martin Schurz * linting Signed-off-by: Martin Schurz * fix typo Signed-off-by: Martin Schurz * Revert "Merge pull request #351 from sprat/fix-umask" This reverts commit 9e8e0bc8fb207014a6d1cb4d68c98029b110aabe, reversing changes made to 98c7553016fe217e783d2376f07d29e703fa97b6. Signed-off-by: Martin Schurz * move immutable ssh vars to internal vars Signed-off-by: Martin Schurz * move vars to OS files Signed-off-by: Martin Schurz * change default handling for all roles Signed-off-by: Martin Schurz * fix issues Signed-off-by: Martin Schurz * add documentation Signed-off-by: Martin Schurz * Update main.yml Co-authored-by: Sebastian Gumprich --- molecule/os_hardening/verify.yml | 14 +++++ molecule/ssh_hardening/molecule.yml | 1 - roles/mysql_hardening/tasks/main.yml | 25 ++++++-- .../tasks/mysql_secure_installation.yml | 2 +- roles/os_hardening/defaults/main.yml | 3 - roles/os_hardening/tasks/hardening.yml | 24 ++++--- .../os_hardening/templates/etc/login.defs.j2 | 2 +- roles/os_hardening/vars/Amazon.yml | 35 +++++++++++ roles/os_hardening/vars/Archlinux.yml | 2 +- roles/os_hardening/vars/Debian.yml | 2 +- roles/os_hardening/vars/Fedora.yml | 6 +- roles/os_hardening/vars/Oracle Linux.yml | 28 --------- roles/os_hardening/vars/RedHat-6.yml | 7 --- roles/os_hardening/vars/RedHat.yml | 2 +- roles/os_hardening/vars/Suse.yml | 2 +- roles/ssh_hardening/defaults/main.yml | 63 ------------------- roles/ssh_hardening/tasks/hardening.yml | 26 ++++++-- roles/ssh_hardening/vars/Archlinux.yml | 8 +++ roles/ssh_hardening/vars/Debian.yml | 10 +++ roles/ssh_hardening/vars/Fedora.yml | 12 ++++ roles/ssh_hardening/vars/FreeBSD.yml | 10 +++ roles/ssh_hardening/vars/OpenBSD.yml | 7 ++- roles/ssh_hardening/vars/Oracle Linux.yml | 9 --- roles/ssh_hardening/vars/RedHat.yml | 12 ++++ roles/ssh_hardening/vars/RedHat_8.yml | 12 ++++ roles/ssh_hardening/vars/SmartOS.yml | 8 +++ roles/ssh_hardening/vars/Suse.yml | 8 +++ roles/ssh_hardening/vars/main.yml | 52 +++++++++++++++ 28 files changed, 253 insertions(+), 139 deletions(-) delete mode 100644 roles/os_hardening/vars/Oracle Linux.yml delete mode 100644 roles/os_hardening/vars/RedHat-6.yml delete mode 100644 roles/ssh_hardening/vars/Oracle Linux.yml create mode 100644 roles/ssh_hardening/vars/main.yml diff --git a/molecule/os_hardening/verify.yml b/molecule/os_hardening/verify.yml index b67b5594..8c19ecb7 100644 --- a/molecule/os_hardening/verify.yml +++ b/molecule/os_hardening/verify.yml @@ -56,3 +56,17 @@ fail: msg: "Inspec failed to validate" when: test_results.rc != 0 + + # test if variable can be overridden + - name: workaround for https://github.com/ansible/ansible/issues/66304 + set_fact: + ansible_virtualization_type: "docker" + os_env_umask: "027 #override" + + - include_role: + name: os_hardening + + - name: verify os_env_umask + shell: + cmd: "grep '027 #override' /etc/login.defs" + changed_when: false diff --git a/molecule/ssh_hardening/molecule.yml b/molecule/ssh_hardening/molecule.yml index 27576b24..f78cbf4a 100644 --- a/molecule/ssh_hardening/molecule.yml +++ b/molecule/ssh_hardening/molecule.yml @@ -63,4 +63,3 @@ scenario: - idempotence - verify - destroy - diff --git a/roles/mysql_hardening/tasks/main.yml b/roles/mysql_hardening/tasks/main.yml index 99587de4..deee84ca 100644 --- a/roles/mysql_hardening/tasks/main.yml +++ b/roles/mysql_hardening/tasks/main.yml @@ -1,13 +1,26 @@ --- -- name: set OS dependent variables - include_vars: '{{ item }}' +- name: Fetch OS dependent variables + include_vars: + file: '{{ item }}' + name: 'os_vars' with_first_found: - - '{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml' - - '{{ ansible_facts.distribution }}.yml' - - '{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml' - - '{{ ansible_facts.os_family }}.yml' + - files: + - '{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml' + - '{{ ansible_facts.distribution }}.yml' + - '{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml' + - '{{ ansible_facts.os_family }}.yml' + skip: true tags: always +# we only override variables with our default if they have not been specified already. +# by default the lookup functions finds all varnames containing the string, therefore +# we add ^ and $ to denote start and end of string, so this returns only exact maches. +- name: Set OS dependent variables, if not already defined by user + set_fact: + '{{ item.key }}': '{{ item.value }}' + when: "not lookup('varnames', '^' + item.key + '$')" + with_dict: '{{ os_vars }}' + - include: configure.yml when: mysql_hardening_enabled | bool tags: diff --git a/roles/mysql_hardening/tasks/mysql_secure_installation.yml b/roles/mysql_hardening/tasks/mysql_secure_installation.yml index 6361d478..f63e0af5 100644 --- a/roles/mysql_hardening/tasks/mysql_secure_installation.yml +++ b/roles/mysql_hardening/tasks/mysql_secure_installation.yml @@ -43,4 +43,4 @@ query: - DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1') login_unix_socket: "{{ login_unix_socket | default(omit) }}" - when: mysql_remove_remote_root \ No newline at end of file + when: mysql_remove_remote_root diff --git a/roles/os_hardening/defaults/main.yml b/roles/os_hardening/defaults/main.yml index 6cb3a361..28617b57 100644 --- a/roles/os_hardening/defaults/main.yml +++ b/roles/os_hardening/defaults/main.yml @@ -271,9 +271,6 @@ os_filesystem_whitelist: [] # the Ansible role dependency mechanism. os_hardening_enabled: true -# Set the umask you want to apply, or leave empty to use the defaults. -os_env_umask: '' - # Set to false to disable installing and configuring auditd. os_auditd_enabled: true os_auditd_max_log_file_action: keep_logs diff --git a/roles/os_hardening/tasks/hardening.yml b/roles/os_hardening/tasks/hardening.yml index 281b587a..3fb495ad 100644 --- a/roles/os_hardening/tasks/hardening.yml +++ b/roles/os_hardening/tasks/hardening.yml @@ -1,18 +1,26 @@ --- -- name: Set OS family dependent variables - include_vars: '{{ ansible_facts.os_family }}.yml' - tags: always - -- name: Set OS dependent variables - include_vars: '{{ item }}' +- name: Fetch OS dependent variables + include_vars: + file: '{{ item }}' + name: 'os_vars' with_first_found: - files: - - '{{ ansible_facts.distribution }}-{{ ansible_facts.distribution_major_version }}.yml' + - '{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml' - '{{ ansible_facts.distribution }}.yml' - - '{{ ansible_facts.os_family }}-{{ ansible_facts.distribution_major_version }}.yml' + - '{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml' + - '{{ ansible_facts.os_family }}.yml' skip: true tags: always +# we only override variables with our default, if they have not been specified already +# by default the lookup functions finds all varnames containing the string, therefore +# we add ^ and $ to denote start and end of string, so this returns only exact maches +- name: Set OS dependent variables, if not already defined by user + set_fact: + '{{ item.key }}': '{{ item.value }}' + when: "not lookup('varnames', '^' + item.key + '$')" + with_dict: '{{ os_vars }}' + - import_tasks: auditd.yml tags: auditd when: os_auditd_enabled | bool diff --git a/roles/os_hardening/templates/etc/login.defs.j2 b/roles/os_hardening/templates/etc/login.defs.j2 index a6d5e216..cc4c275e 100644 --- a/roles/os_hardening/templates/etc/login.defs.j2 +++ b/roles/os_hardening/templates/etc/login.defs.j2 @@ -92,7 +92,7 @@ KILLCHAR 025 # Prefix these values with `0` to get octal, `0x` to get hexadecimal. # `022` is the "historical" value in Debian for UMASK # `027`, or even `077`, could be considered better for privacy. -UMASK {{ os_env_umask | default(os_env_umask_default, true) }} +UMASK {{ os_env_umask }} # Enable setting of the umask group bits to be the same as owner bits (examples: `022` -> `002`, `077` -> `007`) for non-root users, if the uid is the same as gid, and username is the same as the primary group name. # If set to yes, userdel will remove the user´s group if it contains no more members, and useradd will create by default a group with the name of the user. diff --git a/roles/os_hardening/vars/Amazon.yml b/roles/os_hardening/vars/Amazon.yml index f7900a34..8629cc0b 100644 --- a/roles/os_hardening/vars/Amazon.yml +++ b/roles/os_hardening/vars/Amazon.yml @@ -1,4 +1,39 @@ --- + +os_packages_pam_ccreds: 'pam_ccreds' +os_packages_pam_passwdqc: 'pam_passwdqc' +os_packages_pam_cracklib: 'pam_cracklib' +os_nologin_shell_path: '/sbin/nologin' + +# Different distros use different standards for /etc/shadow perms, e.g. +# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640. +# You must provide key/value pairs for owner, group, and mode if overriding. +os_shadow_perms: + owner: root + group: root + mode: '0000' + +os_passwd_perms: + owner: root + group: root + mode: '0644' + +os_env_umask: '077' + +os_auth_uid_min: 1000 +os_auth_gid_min: 1000 +os_auth_sys_uid_min: 201 +os_auth_sys_uid_max: 999 +os_auth_sys_gid_min: 201 +os_auth_sys_gid_max: 999 + +# defaults for useradd +os_useradd_mail_dir: /var/spool/mail +os_useradd_create_home: true + +modprobe_package: 'module-init-tools' +auditd_package: 'audit' + # system accounts that do not get their login disabled and pasword changed os_always_ignore_users: ['root', 'sync', 'shutdown', 'halt', 'ec2-user'] diff --git a/roles/os_hardening/vars/Archlinux.yml b/roles/os_hardening/vars/Archlinux.yml index 1bf8c2a7..99f05d1b 100644 --- a/roles/os_hardening/vars/Archlinux.yml +++ b/roles/os_hardening/vars/Archlinux.yml @@ -12,7 +12,7 @@ os_passwd_perms: group: root mode: '0644' -os_env_umask_default: '027' +os_env_umask: '027' os_auth_uid_min: 1000 os_auth_gid_min: 1000 diff --git a/roles/os_hardening/vars/Debian.yml b/roles/os_hardening/vars/Debian.yml index cc3d5a9a..7d4e2a06 100644 --- a/roles/os_hardening/vars/Debian.yml +++ b/roles/os_hardening/vars/Debian.yml @@ -18,7 +18,7 @@ os_passwd_perms: group: root mode: '0644' -os_env_umask_default: '027' +os_env_umask: '027' os_auth_uid_min: 1000 os_auth_gid_min: 1000 diff --git a/roles/os_hardening/vars/Fedora.yml b/roles/os_hardening/vars/Fedora.yml index de446ae7..c8cd1d09 100644 --- a/roles/os_hardening/vars/Fedora.yml +++ b/roles/os_hardening/vars/Fedora.yml @@ -18,7 +18,7 @@ os_passwd_perms: group: root mode: '0644' -os_env_umask_default: '027' +os_env_umask: '027' os_auth_uid_min: 1000 os_auth_gid_min: 1000 @@ -27,5 +27,9 @@ os_auth_sys_uid_max: 999 os_auth_sys_gid_min: 201 os_auth_sys_gid_max: 999 +# defaults for useradd +os_useradd_mail_dir: /var/spool/mail +os_useradd_create_home: true + modprobe_package: 'module-init-tools' auditd_package: 'audit' diff --git a/roles/os_hardening/vars/Oracle Linux.yml b/roles/os_hardening/vars/Oracle Linux.yml deleted file mode 100644 index 2678b138..00000000 --- a/roles/os_hardening/vars/Oracle Linux.yml +++ /dev/null @@ -1,28 +0,0 @@ ---- - -os_packages_pam_ccreds: 'pam_ccreds' -os_packages_pam_passwdqc: 'pam_passwdqc' -os_packages_pam_cracklib: 'pam_cracklib' -os_nologin_shell_path: '/sbin/nologin' - -# Different distros use different standards for /etc/shadow perms, e.g. -# RHEL derivatives use root:root 0000, whereas Debian-based use root:shadow 0640. -# You must provide key/value pairs for owner, group, and mode if overriding. -os_shadow_perms: - owner: root - group: root - mode: '0000' - -os_passwd_perms: - owner: root - group: root - mode: '0644' - -os_env_umask_default: '077' - -os_auth_uid_min: 1000 -os_auth_gid_min: 1000 -os_auth_sys_uid_min: 201 -os_auth_sys_uid_max: 999 -os_auth_sys_gid_min: 201 -os_auth_sys_gid_max: 999 diff --git a/roles/os_hardening/vars/RedHat-6.yml b/roles/os_hardening/vars/RedHat-6.yml deleted file mode 100644 index eec7efdd..00000000 --- a/roles/os_hardening/vars/RedHat-6.yml +++ /dev/null @@ -1,7 +0,0 @@ ---- - -sysctl_rhel_config: - # ExecShield protection against buffer overflows - kernel.exec-shield: 1 - # Syncookies is used to prevent SYN-flooding attacks. - net.ipv4.tcp_syncookies: 1 diff --git a/roles/os_hardening/vars/RedHat.yml b/roles/os_hardening/vars/RedHat.yml index 2a48c1b2..dc20124d 100644 --- a/roles/os_hardening/vars/RedHat.yml +++ b/roles/os_hardening/vars/RedHat.yml @@ -18,7 +18,7 @@ os_passwd_perms: group: root mode: '0644' -os_env_umask_default: '077' +os_env_umask: '077' os_auth_uid_min: 1000 os_auth_gid_min: 1000 diff --git a/roles/os_hardening/vars/Suse.yml b/roles/os_hardening/vars/Suse.yml index 8f46c982..152af1fe 100644 --- a/roles/os_hardening/vars/Suse.yml +++ b/roles/os_hardening/vars/Suse.yml @@ -18,7 +18,7 @@ os_passwd_perms: group: root mode: '0644' -os_env_umask_default: '027' +os_env_umask: '027' os_auth_uid_min: 1000 os_auth_gid_min: 1000 diff --git a/roles/ssh_hardening/defaults/main.yml b/roles/ssh_hardening/defaults/main.yml index d45f76dc..178ddf81 100644 --- a/roles/ssh_hardening/defaults/main.yml +++ b/roles/ssh_hardening/defaults/main.yml @@ -79,9 +79,6 @@ ssh_allow_agent_forwarding: false # sshd # false to disable X11 Forwarding. Set to true to allow X11 Forwarding. ssh_x11_forwarding: false # sshd -# true if SSH has PAM support -ssh_pam_support: true - # false to disable pam authentication. ssh_use_pam: true # sshd @@ -91,9 +88,6 @@ sshd_authenticationmethods: 'publickey' # true if SSH support GSSAPI ssh_gssapi_support: false -# true if SSH support Kerberos -ssh_kerberos_support: true - # if specified, login is disallowed for user names that match one of the patterns. ssh_deny_users: '' # sshd @@ -192,62 +186,9 @@ ssh_macs: [] ssh_ciphers: [] ssh_kex: [] -ssh_macs_53_default: - - hmac-ripemd160 - - hmac-sha1 - -ssh_macs_53_el_6_5_default: - - hmac-sha2-512 - - hmac-sha2-256 - -ssh_macs_59_default: - - hmac-sha2-512 - - hmac-sha2-256 - - hmac-ripemd160 - -ssh_macs_66_default: - - hmac-sha2-512-etm@openssh.com - - hmac-sha2-256-etm@openssh.com - - umac-128-etm@openssh.com - - hmac-sha2-512 - - hmac-sha2-256 - -ssh_macs_76_default: - - hmac-sha2-512-etm@openssh.com - - hmac-sha2-256-etm@openssh.com - - umac-128-etm@openssh.com - - hmac-sha2-512 - - hmac-sha2-256 - -ssh_ciphers_53_default: - - aes256-ctr - - aes192-ctr - - aes128-ctr - -ssh_ciphers_66_default: - - chacha20-poly1305@openssh.com - - aes256-gcm@openssh.com - - aes128-gcm@openssh.com - - aes256-ctr - - aes192-ctr - - aes128-ctr - -ssh_kex_59_default: - - diffie-hellman-group-exchange-sha256 - -ssh_kex_66_default: - - curve25519-sha256@libssh.org - - diffie-hellman-group-exchange-sha256 - -ssh_kex_80_default: - - sntrup4591761x25519-sha512@tinyssh.org - - curve25519-sha256@libssh.org - - diffie-hellman-group-exchange-sha256 - # directory where to store ssh_password policy ssh_custom_selinux_dir: '/etc/selinux/local-policies' -sshd_moduli_file: '/etc/ssh/moduli' sshd_moduli_minimum: 2048 # disable ChallengeResponseAuthentication @@ -271,7 +212,3 @@ sshd_syslog_facility: 'AUTH' sshd_log_level: 'VERBOSE' sshd_strict_modes: true - -# disable CRYPTO_POLICY to take settings from sshd configuration -# see: https://access.redhat.com/solutions/4410591 -sshd_disable_crypto_policy: true diff --git a/roles/ssh_hardening/tasks/hardening.yml b/roles/ssh_hardening/tasks/hardening.yml index 50aa2689..32ae1b16 100644 --- a/roles/ssh_hardening/tasks/hardening.yml +++ b/roles/ssh_hardening/tasks/hardening.yml @@ -1,11 +1,25 @@ --- -- name: set OS dependent variables - include_vars: '{{ item }}' +- name: Fetch OS dependent variables + include_vars: + file: '{{ item }}' + name: 'os_vars' with_first_found: - - '{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml' - - '{{ ansible_facts.distribution }}.yml' - - '{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml' - - '{{ ansible_facts.os_family }}.yml' + - files: + - '{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml' + - '{{ ansible_facts.distribution }}.yml' + - '{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml' + - '{{ ansible_facts.os_family }}.yml' + skip: true + tags: always + +# we only override variables with our default, if they have not been specified already +# by default the lookup functions finds all varnames containing the string, therefore +# we add ^ and $ to denote start and end of string, so this returns only exact maches +- name: Set OS dependent variables, if not already defined by user + set_fact: + '{{ item.key }}': '{{ item.value }}' + when: "not lookup('varnames', '^' + item.key + '$')" + with_dict: '{{ os_vars }}' - name: get openssh-version command: ssh -V diff --git a/roles/ssh_hardening/vars/Archlinux.yml b/roles/ssh_hardening/vars/Archlinux.yml index 6f6f99f7..3feb288e 100644 --- a/roles/ssh_hardening/vars/Archlinux.yml +++ b/roles/ssh_hardening/vars/Archlinux.yml @@ -5,6 +5,14 @@ sshd_service_name: sshd ssh_owner: root ssh_group: root +# true if SSH support Kerberos +ssh_kerberos_support: true + +# true if SSH has PAM support +ssh_pam_support: true + +sshd_moduli_file: '/etc/ssh/moduli' + # CRYPTO_POLICY is not supported on Archlinux # and the package check only works in Ansible >2.10 sshd_disable_crypto_policy: false diff --git a/roles/ssh_hardening/vars/Debian.yml b/roles/ssh_hardening/vars/Debian.yml index 062c2049..1aae36c3 100644 --- a/roles/ssh_hardening/vars/Debian.yml +++ b/roles/ssh_hardening/vars/Debian.yml @@ -7,3 +7,13 @@ ssh_group: root ssh_selinux_packages: - policycoreutils-python - checkpolicy + +# true if SSH support Kerberos +ssh_kerberos_support: true + +# true if SSH has PAM support +ssh_pam_support: true + +sshd_moduli_file: '/etc/ssh/moduli' + +sshd_disable_crypto_policy: false diff --git a/roles/ssh_hardening/vars/Fedora.yml b/roles/ssh_hardening/vars/Fedora.yml index 76558666..31f84e61 100644 --- a/roles/ssh_hardening/vars/Fedora.yml +++ b/roles/ssh_hardening/vars/Fedora.yml @@ -7,3 +7,15 @@ ssh_group: root ssh_selinux_packages: - python3-policycoreutils - checkpolicy + +# true if SSH support Kerberos +ssh_kerberos_support: true + +# true if SSH has PAM support +ssh_pam_support: true + +sshd_moduli_file: '/etc/ssh/moduli' + +# disable CRYPTO_POLICY to take settings from sshd configuration +# see: https://access.redhat.com/solutions/4410591 +sshd_disable_crypto_policy: true diff --git a/roles/ssh_hardening/vars/FreeBSD.yml b/roles/ssh_hardening/vars/FreeBSD.yml index 4a69f241..af56b0d3 100644 --- a/roles/ssh_hardening/vars/FreeBSD.yml +++ b/roles/ssh_hardening/vars/FreeBSD.yml @@ -4,3 +4,13 @@ ssh_host_keys_dir: '/etc/ssh' sshd_service_name: sshd ssh_owner: root ssh_group: wheel + +# true if SSH support Kerberos +ssh_kerberos_support: true + +# true if SSH has PAM support +ssh_pam_support: true + +sshd_moduli_file: '/etc/ssh/moduli' + +sshd_disable_crypto_policy: false diff --git a/roles/ssh_hardening/vars/OpenBSD.yml b/roles/ssh_hardening/vars/OpenBSD.yml index 546ce774..e6ac1e2d 100644 --- a/roles/ssh_hardening/vars/OpenBSD.yml +++ b/roles/ssh_hardening/vars/OpenBSD.yml @@ -5,7 +5,12 @@ sshd_service_name: sshd ssh_owner: root ssh_group: wheel -ssh_gssapi_support: false +# true if SSH support Kerberos ssh_kerberos_support: false + +# true if SSH has PAM support ssh_pam_support: false + sshd_moduli_file: '/etc/moduli' + +sshd_disable_crypto_policy: false diff --git a/roles/ssh_hardening/vars/Oracle Linux.yml b/roles/ssh_hardening/vars/Oracle Linux.yml deleted file mode 100644 index 36f0ee0d..00000000 --- a/roles/ssh_hardening/vars/Oracle Linux.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -sshd_path: /usr/sbin/sshd -ssh_host_keys_dir: '/etc/ssh' -sshd_service_name: sshd -ssh_owner: root -ssh_group: root -ssh_selinux_packages: - - policycoreutils-python - - checkpolicy diff --git a/roles/ssh_hardening/vars/RedHat.yml b/roles/ssh_hardening/vars/RedHat.yml index 36f0ee0d..35a1fba4 100644 --- a/roles/ssh_hardening/vars/RedHat.yml +++ b/roles/ssh_hardening/vars/RedHat.yml @@ -7,3 +7,15 @@ ssh_group: root ssh_selinux_packages: - policycoreutils-python - checkpolicy + +# true if SSH support Kerberos +ssh_kerberos_support: true + +# true if SSH has PAM support +ssh_pam_support: true + +sshd_moduli_file: '/etc/ssh/moduli' + +# disable CRYPTO_POLICY to take settings from sshd configuration +# see: https://access.redhat.com/solutions/4410591 +sshd_disable_crypto_policy: true diff --git a/roles/ssh_hardening/vars/RedHat_8.yml b/roles/ssh_hardening/vars/RedHat_8.yml index 76558666..31f84e61 100644 --- a/roles/ssh_hardening/vars/RedHat_8.yml +++ b/roles/ssh_hardening/vars/RedHat_8.yml @@ -7,3 +7,15 @@ ssh_group: root ssh_selinux_packages: - python3-policycoreutils - checkpolicy + +# true if SSH support Kerberos +ssh_kerberos_support: true + +# true if SSH has PAM support +ssh_pam_support: true + +sshd_moduli_file: '/etc/ssh/moduli' + +# disable CRYPTO_POLICY to take settings from sshd configuration +# see: https://access.redhat.com/solutions/4410591 +sshd_disable_crypto_policy: true diff --git a/roles/ssh_hardening/vars/SmartOS.yml b/roles/ssh_hardening/vars/SmartOS.yml index ef38877a..63cdd62c 100644 --- a/roles/ssh_hardening/vars/SmartOS.yml +++ b/roles/ssh_hardening/vars/SmartOS.yml @@ -5,4 +5,12 @@ sshd_service_name: ssh ssh_owner: root ssh_group: root +# true if SSH support Kerberos +ssh_kerberos_support: true + +# true if SSH has PAM support ssh_pam_support: false + +sshd_moduli_file: '/etc/ssh/moduli' + +sshd_disable_crypto_policy: false diff --git a/roles/ssh_hardening/vars/Suse.yml b/roles/ssh_hardening/vars/Suse.yml index 66aad672..06ba6615 100644 --- a/roles/ssh_hardening/vars/Suse.yml +++ b/roles/ssh_hardening/vars/Suse.yml @@ -5,4 +5,12 @@ sshd_service_name: sshd ssh_owner: root ssh_group: root +# true if SSH support Kerberos +ssh_kerberos_support: true + +# true if SSH has PAM support +ssh_pam_support: true + +sshd_moduli_file: '/etc/ssh/moduli' + sshd_disable_crypto_policy: false diff --git a/roles/ssh_hardening/vars/main.yml b/roles/ssh_hardening/vars/main.yml new file mode 100644 index 00000000..99b7004c --- /dev/null +++ b/roles/ssh_hardening/vars/main.yml @@ -0,0 +1,52 @@ +--- +ssh_macs_53_default: + - hmac-ripemd160 + - hmac-sha1 + +ssh_macs_53_el_6_5_default: + - hmac-sha2-512 + - hmac-sha2-256 + +ssh_macs_59_default: + - hmac-sha2-512 + - hmac-sha2-256 + - hmac-ripemd160 + +ssh_macs_66_default: + - hmac-sha2-512-etm@openssh.com + - hmac-sha2-256-etm@openssh.com + - umac-128-etm@openssh.com + - hmac-sha2-512 + - hmac-sha2-256 + +ssh_macs_76_default: + - hmac-sha2-512-etm@openssh.com + - hmac-sha2-256-etm@openssh.com + - umac-128-etm@openssh.com + - hmac-sha2-512 + - hmac-sha2-256 + +ssh_ciphers_53_default: + - aes256-ctr + - aes192-ctr + - aes128-ctr + +ssh_ciphers_66_default: + - chacha20-poly1305@openssh.com + - aes256-gcm@openssh.com + - aes128-gcm@openssh.com + - aes256-ctr + - aes192-ctr + - aes128-ctr + +ssh_kex_59_default: + - diffie-hellman-group-exchange-sha256 + +ssh_kex_66_default: + - curve25519-sha256@libssh.org + - diffie-hellman-group-exchange-sha256 + +ssh_kex_80_default: + - sntrup4591761x25519-sha512@tinyssh.org + - curve25519-sha256@libssh.org + - diffie-hellman-group-exchange-sha256