From 0328cfb7149ca1246558be3a32b0f904258c3650 Mon Sep 17 00:00:00 2001 From: Silvio Rhatto Date: Tue, 25 Sep 2018 18:17:02 -0300 Subject: Remove deprecated/unsafe algorithms from hardened config as reported by ssh-audit.py --- templates/sshd_config/Debian_buster.erb | 6 +++--- templates/sshd_config/Debian_stretch.erb | 6 +++--- templates/sshd_config/Ubuntu_bionic.erb | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) (limited to 'templates/sshd_config') diff --git a/templates/sshd_config/Debian_buster.erb b/templates/sshd_config/Debian_buster.erb index 33c874b..0a4fd31 100644 --- a/templates/sshd_config/Debian_buster.erb +++ b/templates/sshd_config/Debian_buster.erb @@ -114,9 +114,9 @@ AllowGroups <%= s %> <%- end -%> <% if scope.lookupvar('::sshd::hardened') == 'yes' -%> -KexAlgorithms curve25519-sha256@libssh.org -Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr -MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com +KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512 +Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr,aes128-ctr,aes128-gcm@openssh.com,aes192-ctr +MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com <% end -%> <% unless (s=scope.lookupvar('::sshd::tail_additional_options')).empty? -%> diff --git a/templates/sshd_config/Debian_stretch.erb b/templates/sshd_config/Debian_stretch.erb index 91dbfff..0a4fd31 100644 --- a/templates/sshd_config/Debian_stretch.erb +++ b/templates/sshd_config/Debian_stretch.erb @@ -114,9 +114,9 @@ AllowGroups <%= s %> <%- end -%> <% if scope.lookupvar('::sshd::hardened') == 'yes' -%> -KexAlgorithms curve25519-sha256@libssh.org -Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr -MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com +KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512 +Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr,aes128-ctr,aes128-gcm@openssh.com,aes192-ctr +MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com <% end -%> <% unless (s=scope.lookupvar('::sshd::tail_additional_options')).empty? -%> diff --git a/templates/sshd_config/Ubuntu_bionic.erb b/templates/sshd_config/Ubuntu_bionic.erb index ae2d67b..dbf413f 100644 --- a/templates/sshd_config/Ubuntu_bionic.erb +++ b/templates/sshd_config/Ubuntu_bionic.erb @@ -118,9 +118,9 @@ AllowGroups <%= s %> <%- end -%> <% if scope.lookupvar('::sshd::hardened') == 'yes' -%> -KexAlgorithms curve25519-sha256@libssh.org -Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr -MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com +KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512 +Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr,aes128-ctr,aes128-gcm@openssh.com,aes192-ctr +MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com <% end -%> <% unless (s=scope.lookupvar('::sshd::tail_additional_options')).empty? -%> -- cgit v1.2.3