Skip to content
This repository was archived by the owner on Dec 26, 2020. It is now read-only.

Commit e5c8cc9

Browse files
author
Sebastian Gumprich
authored
Merge pull request #73 from atomic111/master
Use new ciphers, kex, macs and priv separation sandbox for redhat family 7
2 parents 9fd2879 + e0ebff8 commit e5c8cc9

File tree

4 files changed

+30
-22
lines changed

4 files changed

+30
-22
lines changed

‎.kitchen.yml‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,11 @@
11
---
22
driver:
33
name: docker
4+
privileged: true
45
use_sudo: false
56
provision_command:
67
- "mkdir /var/run/sshd"
78

8-
transport:
9-
max_ssh_sessions: 5
10-
119
provisioner:
1210
name: ansible_playbook
1311
hosts: all

‎Rakefile‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,13 @@
11
#!/usr/bin/env rake
22
# encoding: utf-8
33

4+
require 'foodcritic'
5+
require 'rspec/core/rake_task'
6+
7+
# Rubocop before rspec so we don't lint vendored cookbooks
8+
desc 'Run all tests except Kitchen (default task)'
9+
task default: [:integration]
10+
411
# Automatically generate a changelog for this project. Only loaded if
512
# the necessary gem is installed.
613
begin
@@ -9,3 +16,10 @@ begin
916
rescue LoadError
1017
puts '>>>>> GitHub Changelog Generator not loaded, omitting tasks'
1118
end
19+
20+
desc 'Run integration tests'
21+
task :integration do
22+
concurrency = ENV['CONCURRENCY'] || 1
23+
os = ENV['OS'] || ''
24+
sh('sh', '-c', "bundle exec kitchen test -c #{concurrency} #{os}")
25+
end

‎templates/openssh.conf.j2‎

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -47,13 +47,13 @@ StrictHostKeyChecking ask
4747
# -- see: (http://net-ssh.github.com/net-ssh/classes/Net/SSH/Transport/CipherFactory.html)
4848
#
4949
{% if ssh_client_cbc_required -%}
50-
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
50+
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') or (ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version >= '7') -%}
5151
Ciphers {{ ssh_ciphers_66_weak | join(',') }}
5252
{% else -%}
5353
Ciphers {{ ssh_ciphers_53_weak | join(',') }}
5454
{% endif %}
5555
{% else -%}
56-
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
56+
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') or (ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version >= '7') -%}
5757
Ciphers {{ ssh_ciphers_66_default | join(',') }}
5858
{% else -%}
5959
Ciphers {{ ssh_ciphers_53_default | join(',') }}
@@ -65,20 +65,18 @@ StrictHostKeyChecking ask
6565
# eg Ruby's Net::SSH at around 2.2.* doesn't support sha2 for hmac, so this will have to be set true in this case.
6666
#
6767
{% if ssh_client_weak_hmac -%}
68-
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
68+
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') or (ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version >= '7') -%}
6969
MACs {{ ssh_macs_66_weak | join(',') }}
7070
{% elif ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version <= '6' -%}
7171
MACs {{ ssh_macs_53_default | join(',') }}
72-
{% else -%}
73-
MACs {{ ssh_macs_59_weak | join(',') }}
7472
{% endif %}
7573
{% else -%}
76-
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
74+
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') or (ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version >= '7') -%}
7775
MACs {{ ssh_macs_66_default | join(',') }}
7876
{% elif ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version <= '6' -%}
79-
MACs {{ ssh_macs_53_default | join(',') }}
77+
MACs {{ ssh_macs_53_default | join(',') }}
8078
{% else -%}
81-
MACs {{ ssh_macs_59_default | join(',') }}
79+
MACs {{ ssh_macs_59_default | join(',') }}
8280
{% endif %}
8381
{% endif %}
8482

@@ -89,14 +87,14 @@ StrictHostKeyChecking ask
8987
# Weak kex is sometimes required if older package versions are used
9088
# eg ruby's Net::SSH at around 2.2.* doesn't support sha2 for kex, so this will have to be set true in this case.
9189
#
92-
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
90+
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') or (ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version >= '7') -%}
9391
{% if ssh_client_weak_kex -%}
9492
KexAlgorithms {{ ssh_kex_66_weak | join(',') }}
9593
{% else -%}
9694
KexAlgorithms {{ ssh_kex_66_default | join(',') }}
9795
{% endif %}
9896
{% else -%}
99-
{% if ansible_os_family in ['Oracle Linux', 'RedHat'] -%}
97+
{% if ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version <= '6' -%}
10098
#KexAlgorithms
10199
{% elif ssh_client_weak_kex -%}
102100
KexAlgorithms {{ ssh_kex_59_weak | join(',') }}

‎templates/opensshd.conf.j2‎

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -51,13 +51,13 @@ LogLevel VERBOSE
5151
# -- see: (http://net-ssh.github.com/net-ssh/classes/Net/SSH/Transport/CipherFactory.html)
5252
#
5353
{% if ssh_server_cbc_required -%}
54-
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
54+
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') or (ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version >= '7') -%}
5555
Ciphers {{ ssh_ciphers_66_weak | join(',') }}
5656
{% else %}
5757
Ciphers {{ ssh_ciphers_53_weak | join(',') }}
5858
{% endif %}
5959
{% else -%}
60-
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
60+
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') or (ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version >= '7') -%}
6161
Ciphers {{ ssh_ciphers_66_default | join(',') }}
6262
{% else -%}
6363
Ciphers {{ ssh_ciphers_53_default | join(',') }}
@@ -70,15 +70,13 @@ LogLevel VERBOSE
7070
#
7171

7272
{% if ssh_server_weak_hmac -%}
73-
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
73+
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') or (ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version >= '7') -%}
7474
MACs {{ ssh_macs_66_weak | join(',') }}
7575
{% elif ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version <= '6' -%}
7676
MACs {{ ssh_macs_53_default | join(',') }}
77-
{% else -%}
78-
MACs {{ ssh_macs_59_weak | join(',') }}
7977
{% endif %}
8078
{% else -%}
81-
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
79+
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') or (ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version >= '7') -%}
8280
MACs {{ ssh_macs_66_default | join(',') }}
8381
{% elif ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version <= '6' -%}
8482
MACs {{ ssh_macs_53_default | join(',') }}
@@ -94,14 +92,14 @@ LogLevel VERBOSE
9492
# Weak kex is sometimes required if older package versions are used
9593
# eg ruby's Net::SSH at around 2.2.* doesn't support sha2 for kex, so this will have to be set true in this case.
9694
# based on: https://bettercrypto.org/static/applied-crypto-hardening.pdf
97-
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
95+
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') or (ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version >= '7') -%}
9896
{% if ssh_server_weak_kex -%}
9997
KexAlgorithms {{ ssh_kex_66_weak | join(',') }}
10098
{% else -%}
10199
KexAlgorithms {{ ssh_kex_66_default | join(',') }}
102100
{% endif %}
103101
{% else -%}
104-
{% if ansible_os_family in ['Oracle Linux', 'RedHat'] -%}
102+
{% if ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version <= '6' -%}
105103
#KexAlgorithms
106104
{% elif ssh_server_weak_kex -%}
107105
KexAlgorithms {{ sshd_kex_59_weak | join(',') }}
@@ -115,7 +113,7 @@ LogLevel VERBOSE
115113

116114
# Secure Login directives.
117115
UseLogin no
118-
UsePrivilegeSeparation {% if (ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6') or ansible_os_family in ['Oracle Linux', 'RedHat'] -%}{{ssh_ps53}}{% else %}{{ssh_ps59}}{% endif %}
116+
UsePrivilegeSeparation {% if (ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6') or (ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version <= '6') -%}{{ssh_ps53}}{% else %}{{ssh_ps59}}{% endif %}
119117

120118
PermitUserEnvironment no
121119
LoginGraceTime 30s

0 commit comments

Comments
 (0)