From ef31838fa2307ecea0901c0d8e59f591755fdc8f Mon Sep 17 00:00:00 2001 From: Sina Tak Tehrani Date: Thu, 21 Jan 2021 13:38:48 +0100 Subject: [PATCH] Regenerate RSA key with size 4096 bits (#376) * regenerate RSA key with size 4096 bits Signed-off-by: Sina Tak Tehrani * fixed lint problem Signed-off-by: Sina Tak Tehrani * fixed E301 lint error Signed-off-by: Sina Tak Tehrani * added host keys related vars Signed-off-by: Sina Tak Tehrani * used openssh_keypair module Signed-off-by: Sina Tak Tehrani * changed RSA private key mode to 0640 Signed-off-by: Sina Tak Tehrani * specified condition to prevent wrong file mode on debian-based OS Signed-off-by: Sina Tak Tehrani --- roles/ssh_hardening/tasks/crypto_hostkeys.yml | 19 +++++++++++++++++++ roles/ssh_hardening/vars/Archlinux.yml | 2 ++ roles/ssh_hardening/vars/Debian.yml | 2 ++ roles/ssh_hardening/vars/Fedora.yml | 2 ++ roles/ssh_hardening/vars/FreeBSD.yml | 2 ++ roles/ssh_hardening/vars/OpenBSD.yml | 2 ++ roles/ssh_hardening/vars/RedHat.yml | 2 ++ roles/ssh_hardening/vars/RedHat_8.yml | 2 ++ roles/ssh_hardening/vars/SmartOS.yml | 2 ++ roles/ssh_hardening/vars/Suse.yml | 2 ++ 10 files changed, 37 insertions(+) diff --git a/roles/ssh_hardening/tasks/crypto_hostkeys.yml b/roles/ssh_hardening/tasks/crypto_hostkeys.yml index 76ff7ad5..789651ef 100644 --- a/roles/ssh_hardening/tasks/crypto_hostkeys.yml +++ b/roles/ssh_hardening/tasks/crypto_hostkeys.yml @@ -1,4 +1,23 @@ --- +- name: replace default 2048 bits RSA keypair with 4096 bits keypair + openssh_keypair: + state: present + type: rsa + size: 4096 + path: "{{ ssh_host_keys_dir }}/ssh_host_rsa_key" + force: false + regenerate: partial_idempotence + +# In RHEL and Fedora, the 'ssh_keys' group is the group owner of the host private SSH keys. +# Since the openssh_keypair module needs to read the key to provide idempotency, we need to set ownership and group based on specific OS vars. +- name: change host private key ownership, group and permissions + file: + path: "{{ ssh_host_keys_dir }}/ssh_host_rsa_key" + owner: "{{ ssh_host_keys_owner }}" + group: "{{ ssh_host_keys_group }}" + mode: "0640" + when: "ansible_facts.distribution in ['CentOS', 'OracleLinux', 'RedHat']" + - name: set hostkeys according to openssh-version if openssh >= 5.3 set_fact: ssh_host_key_files: diff --git a/roles/ssh_hardening/vars/Archlinux.yml b/roles/ssh_hardening/vars/Archlinux.yml index 3feb288e..25796938 100644 --- a/roles/ssh_hardening/vars/Archlinux.yml +++ b/roles/ssh_hardening/vars/Archlinux.yml @@ -4,6 +4,8 @@ ssh_host_keys_dir: '/etc/ssh' sshd_service_name: sshd ssh_owner: root ssh_group: root +ssh_host_keys_owner: 'root' +ssh_host_keys_group: 'root' # true if SSH support Kerberos ssh_kerberos_support: true diff --git a/roles/ssh_hardening/vars/Debian.yml b/roles/ssh_hardening/vars/Debian.yml index 1aae36c3..d112d0f1 100644 --- a/roles/ssh_hardening/vars/Debian.yml +++ b/roles/ssh_hardening/vars/Debian.yml @@ -4,6 +4,8 @@ ssh_host_keys_dir: '/etc/ssh' sshd_service_name: ssh ssh_owner: root ssh_group: root +ssh_host_keys_owner: 'root' +ssh_host_keys_group: 'root' ssh_selinux_packages: - policycoreutils-python - checkpolicy diff --git a/roles/ssh_hardening/vars/Fedora.yml b/roles/ssh_hardening/vars/Fedora.yml index 31f84e61..31dadb10 100644 --- a/roles/ssh_hardening/vars/Fedora.yml +++ b/roles/ssh_hardening/vars/Fedora.yml @@ -4,6 +4,8 @@ ssh_host_keys_dir: '/etc/ssh' sshd_service_name: sshd ssh_owner: root ssh_group: root +ssh_host_keys_owner: 'root' +ssh_host_keys_group: 'ssh_keys' ssh_selinux_packages: - python3-policycoreutils - checkpolicy diff --git a/roles/ssh_hardening/vars/FreeBSD.yml b/roles/ssh_hardening/vars/FreeBSD.yml index af56b0d3..688184d2 100644 --- a/roles/ssh_hardening/vars/FreeBSD.yml +++ b/roles/ssh_hardening/vars/FreeBSD.yml @@ -4,6 +4,8 @@ ssh_host_keys_dir: '/etc/ssh' sshd_service_name: sshd ssh_owner: root ssh_group: wheel +ssh_host_keys_owner: 'root' +ssh_host_keys_group: 'root' # true if SSH support Kerberos ssh_kerberos_support: true diff --git a/roles/ssh_hardening/vars/OpenBSD.yml b/roles/ssh_hardening/vars/OpenBSD.yml index e6ac1e2d..75df8149 100644 --- a/roles/ssh_hardening/vars/OpenBSD.yml +++ b/roles/ssh_hardening/vars/OpenBSD.yml @@ -4,6 +4,8 @@ ssh_host_keys_dir: '/etc/ssh' sshd_service_name: sshd ssh_owner: root ssh_group: wheel +ssh_host_keys_owner: 'root' +ssh_host_keys_group: 'root' # true if SSH support Kerberos ssh_kerberos_support: false diff --git a/roles/ssh_hardening/vars/RedHat.yml b/roles/ssh_hardening/vars/RedHat.yml index 35a1fba4..4c97cd6a 100644 --- a/roles/ssh_hardening/vars/RedHat.yml +++ b/roles/ssh_hardening/vars/RedHat.yml @@ -4,6 +4,8 @@ ssh_host_keys_dir: '/etc/ssh' sshd_service_name: sshd ssh_owner: root ssh_group: root +ssh_host_keys_owner: 'root' +ssh_host_keys_group: 'ssh_keys' ssh_selinux_packages: - policycoreutils-python - checkpolicy diff --git a/roles/ssh_hardening/vars/RedHat_8.yml b/roles/ssh_hardening/vars/RedHat_8.yml index 31f84e61..31dadb10 100644 --- a/roles/ssh_hardening/vars/RedHat_8.yml +++ b/roles/ssh_hardening/vars/RedHat_8.yml @@ -4,6 +4,8 @@ ssh_host_keys_dir: '/etc/ssh' sshd_service_name: sshd ssh_owner: root ssh_group: root +ssh_host_keys_owner: 'root' +ssh_host_keys_group: 'ssh_keys' ssh_selinux_packages: - python3-policycoreutils - checkpolicy diff --git a/roles/ssh_hardening/vars/SmartOS.yml b/roles/ssh_hardening/vars/SmartOS.yml index 63cdd62c..f22f5bf0 100644 --- a/roles/ssh_hardening/vars/SmartOS.yml +++ b/roles/ssh_hardening/vars/SmartOS.yml @@ -4,6 +4,8 @@ ssh_host_keys_dir: '/var/ssh' sshd_service_name: ssh ssh_owner: root ssh_group: root +ssh_host_keys_owner: 'root' +ssh_host_keys_group: 'root' # true if SSH support Kerberos ssh_kerberos_support: true diff --git a/roles/ssh_hardening/vars/Suse.yml b/roles/ssh_hardening/vars/Suse.yml index 06ba6615..066dfe58 100644 --- a/roles/ssh_hardening/vars/Suse.yml +++ b/roles/ssh_hardening/vars/Suse.yml @@ -4,6 +4,8 @@ ssh_host_keys_dir: '/etc/ssh' sshd_service_name: sshd ssh_owner: root ssh_group: root +ssh_host_keys_owner: 'root' +ssh_host_keys_group: 'root' # true if SSH support Kerberos ssh_kerberos_support: true