From 430c48200eeacf11fd3980f162ffa1994c2d0dd0 Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Fri, 1 May 2015 13:48:19 -0400 Subject: Implement KexAlgorithms settings, based on Key exchange section of https://stribika.github.io/2015/01/04/secure-secure-shell.html Note, that on some systems it is uncertain if they will have a new enough version of openssh installed, so on those a version test is done to see before setting them. --- templates/sshd_config/Debian_wheezy.erb | 3 +++ 1 file changed, 3 insertions(+) (limited to 'templates/sshd_config/Debian_wheezy.erb') diff --git a/templates/sshd_config/Debian_wheezy.erb b/templates/sshd_config/Debian_wheezy.erb index 4633c09..e8465ea 100644 --- a/templates/sshd_config/Debian_wheezy.erb +++ b/templates/sshd_config/Debian_wheezy.erb @@ -115,6 +115,9 @@ AllowGroups <%= s %> <%- end -%> <% if scope.lookupvar('sshd::hardened') == 'yes' -%> +<% if (scope.function_versioncmp([scope.lookupvar('::ssh_version'),'6.5'])) >= 0 -%> +KexAlgorithms curve25519-sha256@libssh.org +<% end -%> Ciphers aes256-ctr MACs hmac-sha1 <% end -%> -- cgit v1.2.3