Skip to content
This repository was archived by the owner on Dec 26, 2020. It is now read-only.

Fixed KexAlgorithms Conditional Statement #66

Merged
merged 2 commits into from
Jun 7, 2016
Merged

Fixed KexAlgorithms Conditional Statement #66

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0b85e97
Fixed KexAlgorithms Conditional Statement
cjsheets May 31, 2016
a17aa49
Corrected a type in ssh_server_weak_kex
cjsheets Jun 7, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions templates/opensshd.conf.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
# Basic configuration
# ===================

# Either disable or only allow root login via certificates.
# Either disable or only allowssh root login via certificates.
PermitRootLogin {{ 'without-password' if ssh_allow_root_with_key else 'no' }}

# Define which port sshd should listen to. Default to `22`.
Expand Down Expand Up @@ -99,14 +99,16 @@ LogLevel VERBOSE
# eg ruby's Net::SSH at around 2.2.* doesn't support sha2 for kex, so this will have to be set true in this case.
# based on: https://bettercrypto.org/static/applied-crypto-hardening.pdf
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' -%}
{% if ssh_client_weak_kex -%}
{% if ssh_server_weak_kex -%}
KexAlgorithms {{ ssh_kex_66_weak | join(',') }}
{% else -%}
KexAlgorithms {{ ssh_kex_66_default | join(',') }}
{% endif %}
{% else -%}
{% if ansible_os_family in ['Oracle Linux', 'RedHat'] or (ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6') -%}
#KexAlgorithms
{% elif ssh_server_weak_kex -%}
KexAlgorithms {{ sshd_kex_59_weak | join(',') }}
{% else -%}
KexAlgorithms {{ ssh_kex_59_default | join(',') }}
{% endif %}
Expand Down