andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Provide granular noop for ssh configuration (#789)

Browse Source 
* Provide granular noop for shh configuration

We would like to have more fine grained options on applying or not specific configurations.

This commit let the user choose to noop some configuration with a few new
boolean variables.

Motivation for theses options are we may configure ourselves some (ssh host key
regeneration in a templating system) or we are not ready for others (ssh_kex
will break dist-upgrades, letting the operator without ssh).

Signed-off-by: seven beep <[email protected]>

* Provide granula noop for ssh configuration

We would like to have more fine grained options on applying or not specific configurations.

This commit let the user choose to disable configurations for `ssh_host_key_config`,
`ssh_ciphers_config`, `ssh_host_key_config`, `ssh_macs_config` by setting them
to False.

Motivation for theses options are we may configure ourselves some (ssh host key
regeneration in a templating system) or we are not ready for others (ssh_kex
will break dist-upgrades, letting the operator without ssh).

Signed-off-by: seven beep <[email protected]>

---------

Signed-off-by: seven beep <[email protected]>
This commit is contained in:
seven-beep authored and GitHub committed 2024-10-13 12:34:52 +02:00
1 parent a1c7e77f08
commit a97a54dc30
5 files changed
+39 -28
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

roles/ssh_hardening/templates/opensshd.conf.j2
+20 -6
View File
@@ -34,9 +34,11 @@ ListenAddress {{ address }}
{% endfor %}
# HostKeys are listed here.
{% for key in ssh_host_key_files %}
{% if ssh_host_key_files is defined and ssh_host_key_files -%}
{% for key in ssh_host_key_files %}
HostKey {{ key }}
{% endfor %}
{% endfor %}
{% endif %}
# HostCertificates are listed here.
{% for certificate in ssh_host_certificates -%}
@@ -73,14 +75,22 @@ LogLevel {{ sshd_log_level }}
# -- see: (http://net-ssh.github.com/net-ssh/classes/Net/SSH/Transport/CipherFactory.html)
#
{# This outputs 'Ciphers <list-of-ciphers>' if ssh_ciphers is defined or '#Ciphers' if ssh_ciphers is undefined -#}
{{ 'Ciphers ' ~ ssh_ciphers|join(',') if ssh_ciphers else 'Ciphers'|comment }}
{% if ssh_ciphers is defined and ssh_ciphers -%}
{{ 'Ciphers ' ~ ssh_ciphers|join(',') }}
{% else -%}
{{ 'Ciphers'|comment }}
{% endif %}
# **Hash algorithms** -- SHA-1 is formally deprecated by NIST in 2011 because of security issues.
# Weak HMAC is sometimes required if older package versions are used
# eg Ruby's Net::SSH at around 2.2.* doesn't support sha2 for hmac, so this will have to be set true in this case.
#
{# This outputs 'MACs <list-of-macs>' if ssh_macs is defined or '#MACs' if ssh_macs is undefined -#}
{{ 'MACs ' ~ ssh_macs|join(',') if ssh_macs else 'MACs'|comment }}
{% if ssh_macs is defined and ssh_macs -%}
{{ 'MACs ' ~ ssh_macs|join(',') }}
{% else -%}
{{ 'MACs'|comment }}
{% endif %}
{% if sshd_version is version('5.9', '<') %}
# Alternative setting, if OpenSSH version is below v5.9
@@ -92,8 +102,12 @@ LogLevel {{ sshd_log_level }}
# eg ruby's Net::SSH at around 2.2.* doesn't support sha2 for kex, so this will have to be set true in this case.
# based on: https://bettercrypto.org/static/applied-crypto-hardening.pdf
#
{# This outputs 'KexAlgorithms <list-of-algos>' if ssh_kex is defined or '#KexAlgorithms' if ssh_kex is undefined #}
{{ 'KexAlgorithms ' ~ ssh_kex|join(',') if ssh_kex else 'KexAlgorithms'|comment }}
{# This outputs 'KexAlgorithms <list-of-algos>' if ssh_kex is defined and ssh_kex or '#KexAlgorithms' if ssh_kex is undefined #}
{% if ssh_kex is defined and ssh_kex -%}
{{ 'KexAlgorithms ' ~ ssh_kex|join(',') }}
{% else -%}
{{ 'KexAlgorithms'|comment }}
{% endif %}
# Authentication
# --------------