diff options
| author | Silvio Rhatto <rhatto@riseup.net> | 2018-09-25 18:17:02 -0300 |
|---|---|---|
| committer | Silvio Rhatto <rhatto@riseup.net> | 2018-09-25 18:17:02 -0300 |
| commit | 0328cfb7149ca1246558be3a32b0f904258c3650 (patch) | |
| tree | ad15ce8b438feb269b28cabbfcf7ecd470fd819e | |
| parent | 1bc341aac885eb16bf8d22a5ad257587e0694988 (diff) | |
| download | puppet-sshd-0328cfb7149ca1246558be3a32b0f904258c3650.tar.gz puppet-sshd-0328cfb7149ca1246558be3a32b0f904258c3650.tar.bz2 | |
Remove deprecated/unsafe algorithms from hardened config as reported by ssh-audit.py
| -rw-r--r-- | templates/sshd_config/Debian_buster.erb | 6 | ||||
| -rw-r--r-- | templates/sshd_config/Debian_stretch.erb | 6 | ||||
| -rw-r--r-- | templates/sshd_config/Ubuntu_bionic.erb | 6 |
3 files changed, 9 insertions, 9 deletions
diff --git a/templates/sshd_config/Debian_buster.erb b/templates/sshd_config/Debian_buster.erb index 33c874b..0a4fd31 100644 --- a/templates/sshd_config/Debian_buster.erb +++ b/templates/sshd_config/Debian_buster.erb @@ -114,9 +114,9 @@ AllowGroups <%= s %> <%- end -%> <% if scope.lookupvar('::sshd::hardened') == 'yes' -%> -KexAlgorithms curve25519-sha256@libssh.org -Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr -MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com +KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512 +Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr,aes128-ctr,aes128-gcm@openssh.com,aes192-ctr +MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com <% end -%> <% unless (s=scope.lookupvar('::sshd::tail_additional_options')).empty? -%> diff --git a/templates/sshd_config/Debian_stretch.erb b/templates/sshd_config/Debian_stretch.erb index 91dbfff..0a4fd31 100644 --- a/templates/sshd_config/Debian_stretch.erb +++ b/templates/sshd_config/Debian_stretch.erb @@ -114,9 +114,9 @@ AllowGroups <%= s %> <%- end -%> <% if scope.lookupvar('::sshd::hardened') == 'yes' -%> -KexAlgorithms curve25519-sha256@libssh.org -Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr -MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com +KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512 +Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr,aes128-ctr,aes128-gcm@openssh.com,aes192-ctr +MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com <% end -%> <% unless (s=scope.lookupvar('::sshd::tail_additional_options')).empty? -%> diff --git a/templates/sshd_config/Ubuntu_bionic.erb b/templates/sshd_config/Ubuntu_bionic.erb index ae2d67b..dbf413f 100644 --- a/templates/sshd_config/Ubuntu_bionic.erb +++ b/templates/sshd_config/Ubuntu_bionic.erb @@ -118,9 +118,9 @@ AllowGroups <%= s %> <%- end -%> <% if scope.lookupvar('::sshd::hardened') == 'yes' -%> -KexAlgorithms curve25519-sha256@libssh.org -Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr -MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com +KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512 +Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr,aes128-ctr,aes128-gcm@openssh.com,aes192-ctr +MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com <% end -%> <% unless (s=scope.lookupvar('::sshd::tail_additional_options')).empty? -%> |