Replace ssh_keys group in Fedora with root (#677)

* Replace ssh_keys group in Fedora with root In Fedora 38, the `ssh_keys` group was removed. root is used now, in accordance to upstream. See: https://www.spinics.net/lists/fedora-devel/msg307707.html See: https://src.fedoraproject.org/rpms/openssh/pull-request/37# Signed-off-by: Sebastian Gumprich <[email protected]> * change host key mode and owner in fedora and rhel9 Signed-off-by: Sebastian Gumprich <[email protected]> * add missing host mode for rhel7 Signed-off-by: Sebastian Gumprich <[email protected]> * harden all ssh host keys Signed-off-by: Sebastian Gumprich <[email protected]> * skip linting rule Signed-off-by: Sebastian Gumprich <[email protected]> * correct grp for bsd is wheel Signed-off-by: Sebastian Gumprich <[email protected]> --------- Signed-off-by: Sebastian Gumprich <[email protected]>
2023-06-10 08:04:04 +02:00
1 parent 0e173b4165
commit f56d80b5d8
@@ -1,11 +1,12 @@
 ---
 sshd_path: /usr/sbin/sshd
-ssh_host_keys_dir: '/etc/ssh'
+ssh_host_keys_dir: /etc/ssh
 sshd_service_name: sshd
 ssh_owner: root
 ssh_group: root
-ssh_host_keys_owner: 'root'
-ssh_host_keys_group: 'ssh_keys'
+ssh_host_keys_owner: root
+ssh_host_keys_group: ssh_keys
+ssh_host_keys_mode: "0600"
 ssh_selinux_packages:
  - policycoreutils-python
  - checkpolicy
@@ -16,7 +17,7 @@ ssh_kerberos_support: true
 # true if SSH has PAM support
 ssh_pam_support: true

-sshd_moduli_file: '/etc/ssh/moduli'
+sshd_moduli_file: /etc/ssh/moduli

 # disable CRYPTO_POLICY to take settings from sshd configuration
 # see: https://access.redhat.com/solutions/4410591
@@ -6,6 +6,7 @@ ssh_owner: root
 ssh_group: root
 ssh_host_keys_owner: root
 ssh_host_keys_group: root
+ssh_host_keys_mode: "0600"

 # true if SSH support Kerberos
 ssh_kerberos_support: true
@@ -6,6 +6,7 @@ ssh_owner: root
 ssh_group: root
 ssh_host_keys_owner: root
 ssh_host_keys_group: root
+ssh_host_keys_mode: "0600"
 ssh_selinux_packages:
  - policycoreutils-python
  - checkpolicy
@@ -5,7 +5,8 @@ sshd_service_name: sshd
 ssh_owner: root
 ssh_group: root
 ssh_host_keys_owner: root
-ssh_host_keys_group: ssh_keys
+ssh_host_keys_group: root
+ssh_host_keys_mode: "0600"
 ssh_selinux_packages:
  - python3-policycoreutils
  - checkpolicy
@@ -5,7 +5,8 @@ sshd_service_name: sshd
 ssh_owner: root
 ssh_group: wheel
 ssh_host_keys_owner: root
-ssh_host_keys_group: root
+ssh_host_keys_group: wheel
+ssh_host_keys_mode: "0600"

 # true if SSH support Kerberos
 ssh_kerberos_support: true
@@ -5,7 +5,8 @@ sshd_service_name: sshd
 ssh_owner: root
 ssh_group: wheel
 ssh_host_keys_owner: root
-ssh_host_keys_group: root
+ssh_host_keys_group: wheel
+ssh_host_keys_mode: "0600"

 # true if SSH support Kerberos
 ssh_kerberos_support: false
@@ -6,6 +6,7 @@ ssh_owner: root
 ssh_group: root
 ssh_host_keys_owner: root
 ssh_host_keys_group: ssh_keys
+ssh_host_keys_mode: "0600"
 ssh_selinux_packages:
  - policycoreutils-python-utils
  - checkpolicy
@@ -6,6 +6,7 @@ ssh_owner: root
 ssh_group: root
 ssh_host_keys_owner: root
 ssh_host_keys_group: ssh_keys
+ssh_host_keys_mode: "0600"
 ssh_selinux_packages:
  - policycoreutils-python
  - checkpolicy
@@ -0,0 +1,24 @@
+---
+sshd_path: /usr/sbin/sshd
+ssh_host_keys_dir: /etc/ssh
+sshd_service_name: sshd
+ssh_owner: root
+ssh_group: root
+ssh_host_keys_owner: root
+ssh_host_keys_group: root
+ssh_host_keys_mode: "0600"
+ssh_selinux_packages:
+  - policycoreutils-python-utils
+  - checkpolicy
+
+# true if SSH support Kerberos
+ssh_kerberos_support: true
+
+# true if SSH has PAM support
+ssh_pam_support: true
+
+sshd_moduli_file: /etc/ssh/moduli
+
+# disable CRYPTO_POLICY to take settings from sshd configuration
+# see: https://access.redhat.com/solutions/4410591
+sshd_disable_crypto_policy: true
@@ -6,6 +6,7 @@ ssh_owner: root
 ssh_group: root
 ssh_host_keys_owner: root
 ssh_host_keys_group: root
+ssh_host_keys_mode: "0600"

 # true if SSH support Kerberos
 ssh_kerberos_support: true
@@ -6,6 +6,7 @@ ssh_owner: root
 ssh_group: root
 ssh_host_keys_owner: root
 ssh_host_keys_group: root
+ssh_host_keys_mode: "0600"

 # true if SSH support Kerberos
 ssh_kerberos_support: true