Changeset 13850

Timestamp:

25 Apr 2016, 21:25:32 (9 years ago)

Author:

uli

Message:

Add missing sshd_config pieces.

We set required SSH ciphers/MACs/key algos according to "Applied
Crypto Hardening" from bettercrypto.org, state 2016-04-21.

File:

• main/waeup-ansible/bootstrap.yml (modified) (4 diffs)

main/waeup-ansible/bootstrap.yml

@@ -44 +44 @@
         state=present
 
-    - name: "bootstrap | disable dsa keys in sshd_config"
+    - name: "bootstrap | sshd_config - disable dsa keys"
       lineinfile:
         dest=/etc/ssh/sshd_config
@@ -53 +53 @@
       notify: "restart sshd"
 
-    - name: "bootstrap | disable ecdsa keys in sshd_config"
+    - name: "bootstrap | sshd_config - disable ecdsa keys"
       lineinfile:
         dest=/etc/ssh/sshd_config
@@ -62 +62 @@
       notify: "restart sshd"
 
-    - name: "bootstrap | set key bits in sshd_config to 4096"
+    - name: "bootstrap | sshd_config - set key bits to 4096"
       lineinfile:
         dest=/etc/ssh/sshd_config
@@ -71 +71 @@
       notify: "restart sshd"
 
+    - name: "bootstrap | sshd_config - set secure ciphers from bettercrypto.org"
+      lineinfile:
+        dest=/etc/ssh/sshd_config
+        line='Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr'
+        state=present
+      notify: "restart sshd"
+
+    - name: "bootstrap | sshd_config - set secure MACs from bettercrypto.org"
+      lineinfile:
+        dest=/etc/ssh/sshd_config
+        line='MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160'
+        state=present
+      notify: "restart sshd"
+
+    - name: "bootstrap | sshd_config - set secure kex algos from bettercrypto.org"
+      lineinfile:
+        dest=/etc/ssh/sshd_config
+        line='KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1'
+        state=present
+      notify: "restart sshd"
+
     - name: "bootstrap | remove short moduli (<2048 bits) from /etc/ssh/moduli"
       replace: