aboutsummaryrefslogtreecommitdiff
path: root/templates/sshd_config/CentOS.erb
diff options
context:
space:
mode:
authorintrigeri <intrigeri@boum.org>2011-03-06 09:10:44 +0100
committerintrigeri <intrigeri@boum.org>2011-06-21 00:27:55 +0200
commit34863e959fcd05dd325a658561f14580d49b6764 (patch)
tree5deef5ff63629e746d3b3abc6b36b4baf31d2331 /templates/sshd_config/CentOS.erb
parentaf76f6cfe70c416cbbf72f9c685a0d54c6eb4afb (diff)
downloadpuppet-sshd-34863e959fcd05dd325a658561f14580d49b6764.tar.gz
puppet-sshd-34863e959fcd05dd325a658561f14580d49b6764.tar.bz2
New opt-in support to only use strong SSL ciphers and MACs.
The new configuration variable is $sshd_hardened_ssl. Settings were stolen from https://github.com/ioerror/duraconf.git.
Diffstat (limited to 'templates/sshd_config/CentOS.erb')
-rw-r--r--templates/sshd_config/CentOS.erb5
1 files changed, 5 insertions, 0 deletions
diff --git a/templates/sshd_config/CentOS.erb b/templates/sshd_config/CentOS.erb
index 544effe..859759a 100644
--- a/templates/sshd_config/CentOS.erb
+++ b/templates/sshd_config/CentOS.erb
@@ -204,6 +204,11 @@ AllowUsers <%= sshd_allowed_users %>
AllowGroups <%= sshd_allowed_groups %>
<%- end -%>
+<%- if sshd_hardened_ssl.to_s == 'yes' then -%>
+Ciphers aes256-ctr
+MACs hmac-sha1
+<%- end -%>
+
<%- unless sshd_tail_additional_options.to_s.empty? then %>
<%= sshd_tail_additional_options %>
<%- end %>