From 1402e67b2143dca464905bb6d95410a4ee862255 Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Fri, 1 May 2015 13:57:37 -0400 Subject: Implement enhanced symmetric cipher selection, based on https://stribika.github.io/2015/01/04/secure-secure-shell.html and version of openssh installed --- templates/sshd_config/CentOS_6.erb | 4 +++- templates/sshd_config/CentOS_7.erb | 4 +++- templates/sshd_config/Debian_jessie.erb | 2 +- templates/sshd_config/Debian_sid.erb | 2 +- templates/sshd_config/Debian_wheezy.erb | 4 +++- templates/sshd_config/FreeBSD.erb | 4 +++- templates/sshd_config/Gentoo.erb | 4 +++- templates/sshd_config/OpenBSD.erb | 4 +++- templates/sshd_config/Ubuntu.erb | 4 +++- templates/sshd_config/Ubuntu_lucid.erb | 4 +++- 10 files changed, 26 insertions(+), 10 deletions(-) diff --git a/templates/sshd_config/CentOS_6.erb b/templates/sshd_config/CentOS_6.erb index f27e567..325c73a 100644 --- a/templates/sshd_config/CentOS_6.erb +++ b/templates/sshd_config/CentOS_6.erb @@ -153,8 +153,10 @@ AllowGroups <%= s %> <% if scope.lookupvar('sshd::hardened') == 'yes' -%> <% if (scope.function_versioncmp([scope.lookupvar('::ssh_version'),'6.5'])) >= 0 -%> KexAlgorithms curve25519-sha256@libssh.org -<% end -%> +Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr +<% else -%> Ciphers aes256-ctr +<% end -%> MACs hmac-sha1 <% end -%> diff --git a/templates/sshd_config/CentOS_7.erb b/templates/sshd_config/CentOS_7.erb index c6ecd06..b120356 100644 --- a/templates/sshd_config/CentOS_7.erb +++ b/templates/sshd_config/CentOS_7.erb @@ -167,8 +167,10 @@ AllowGroups <%= s %> <% if scope.lookupvar('sshd::hardened') == 'yes' -%> <% if (scope.function_versioncmp([scope.lookupvar('::ssh_version'),'6.5'])) >= 0 -%> KexAlgorithms curve25519-sha256@libssh.org -<% end -%> +Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr +<% else -%> Ciphers aes256-ctr +<% end -%> MACs hmac-sha1 <% end -%> diff --git a/templates/sshd_config/Debian_jessie.erb b/templates/sshd_config/Debian_jessie.erb index 19d4327..7b74e76 100644 --- a/templates/sshd_config/Debian_jessie.erb +++ b/templates/sshd_config/Debian_jessie.erb @@ -113,7 +113,7 @@ AllowGroups <%= s %> <% if scope.lookupvar('sshd::hardened') == 'yes' -%> KexAlgorithms curve25519-sha256@libssh.org -Ciphers aes256-ctr +Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr MACs hmac-sha1 <% end -%> diff --git a/templates/sshd_config/Debian_sid.erb b/templates/sshd_config/Debian_sid.erb index 19d4327..7b74e76 100644 --- a/templates/sshd_config/Debian_sid.erb +++ b/templates/sshd_config/Debian_sid.erb @@ -113,7 +113,7 @@ AllowGroups <%= s %> <% if scope.lookupvar('sshd::hardened') == 'yes' -%> KexAlgorithms curve25519-sha256@libssh.org -Ciphers aes256-ctr +Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr MACs hmac-sha1 <% end -%> diff --git a/templates/sshd_config/Debian_wheezy.erb b/templates/sshd_config/Debian_wheezy.erb index e8465ea..214fbd9 100644 --- a/templates/sshd_config/Debian_wheezy.erb +++ b/templates/sshd_config/Debian_wheezy.erb @@ -117,8 +117,10 @@ AllowGroups <%= s %> <% if scope.lookupvar('sshd::hardened') == 'yes' -%> <% if (scope.function_versioncmp([scope.lookupvar('::ssh_version'),'6.5'])) >= 0 -%> KexAlgorithms curve25519-sha256@libssh.org -<% end -%> +Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr +<% else -%> Ciphers aes256-ctr +<% end -%> MACs hmac-sha1 <% end -%> diff --git a/templates/sshd_config/FreeBSD.erb b/templates/sshd_config/FreeBSD.erb index 8655c53..3e13328 100644 --- a/templates/sshd_config/FreeBSD.erb +++ b/templates/sshd_config/FreeBSD.erb @@ -155,8 +155,10 @@ AllowGroups <%= s %> <% if scope.lookupvar('sshd::hardened') == 'yes' -%> <% if (scope.function_versioncmp([scope.lookupvar('::ssh_version'),'6.5'])) >= 0 -%> KexAlgorithms curve25519-sha256@libssh.org -<% end -%> +Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr +<% else -%> Ciphers aes256-ctr +<% end -%> MACs hmac-sha1 <% end -%> diff --git a/templates/sshd_config/Gentoo.erb b/templates/sshd_config/Gentoo.erb index 1508d70..3d37d62 100644 --- a/templates/sshd_config/Gentoo.erb +++ b/templates/sshd_config/Gentoo.erb @@ -150,8 +150,10 @@ AllowGroups <%= s %> <% if scope.lookupvar('sshd::hardened') == 'yes' -%> <% if (scope.function_versioncmp([scope.lookupvar('::ssh_version'),'6.5'])) >= 0 -%> KexAlgorithms curve25519-sha256@libssh.org -<% end -%> +Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr +<% else -%> Ciphers aes256-ctr +<% end -%> MACs hmac-sha1 <% end -%> diff --git a/templates/sshd_config/OpenBSD.erb b/templates/sshd_config/OpenBSD.erb index 591d980..aa6868e 100644 --- a/templates/sshd_config/OpenBSD.erb +++ b/templates/sshd_config/OpenBSD.erb @@ -131,8 +131,10 @@ AllowGroups <%= s %> <% if scope.lookupvar('sshd::hardened') == 'yes' -%> <% if (scope.function_versioncmp([scope.lookupvar('::ssh_version'),'6.5'])) >= 0 -%> KexAlgorithms curve25519-sha256@libssh.org -<% end -%> +Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr +<% else -%> Ciphers aes256-ctr +<% end -%> MACs hmac-sha1 <% end -%> diff --git a/templates/sshd_config/Ubuntu.erb b/templates/sshd_config/Ubuntu.erb index 28ee5f6..2f8cb3e 100644 --- a/templates/sshd_config/Ubuntu.erb +++ b/templates/sshd_config/Ubuntu.erb @@ -118,8 +118,10 @@ AllowGroups <%= s %> <% if scope.lookupvar('sshd::hardened') == 'yes' -%> <% if (scope.function_versioncmp([scope.lookupvar('::ssh_version'),'6.5'])) >= 0 -%> KexAlgorithms curve25519-sha256@libssh.org -<% end -%> +Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr +<% else -%> Ciphers aes256-ctr +<% end -%> MACs hmac-sha1 <% end -%> diff --git a/templates/sshd_config/Ubuntu_lucid.erb b/templates/sshd_config/Ubuntu_lucid.erb index 36f787b..109b49f 100644 --- a/templates/sshd_config/Ubuntu_lucid.erb +++ b/templates/sshd_config/Ubuntu_lucid.erb @@ -121,8 +121,10 @@ PrintMotd <%= scope.lookupvar('sshd::print_motd') %> <% if scope.lookupvar('sshd::hardened') == 'yes' -%> <% if (scope.function_versioncmp([scope.lookupvar('::ssh_version'),'6.5'])) >= 0 -%> KexAlgorithms curve25519-sha256@libssh.org -<% end -%> +Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr +<% else -%> Ciphers aes256-ctr +<% end -%> MACs hmac-sha1 <% end -%> -- cgit v1.2.3