opuppet/module-sshd
5
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Implement enhanced symmetric cipher selection, based on

Browse source 
https://stribika.github.io/2015/01/04/secure-secure-shell.html and
version of openssh installed
This commit is contained in:
Micah Anderson 2015-05-01 13:57:37 -04:00
parent 430c48200e
commit 1402e67b21
10 changed files with 26 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
templates/sshd_config/CentOS_6.erb
View file

@ -153,8 +153,10 @@ AllowGroups <%= s %>
<% if scope.lookupvar('sshd::hardened') == 'yes' -%>
<% if (scope.function_versioncmp([scope.lookupvar('::ssh_version'),'6.5'])) >= 0 -%>
KexAlgorithms curve25519-sha256@libssh.org
<% end -%>
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
<% else -%>
Ciphers aes256-ctr
<% end -%>
MACs hmac-sha1
<% end -%>

4
templates/sshd_config/CentOS_7.erb
View file

@ -167,8 +167,10 @@ AllowGroups <%= s %>
<% if scope.lookupvar('sshd::hardened') == 'yes' -%>
<% if (scope.function_versioncmp([scope.lookupvar('::ssh_version'),'6.5'])) >= 0 -%>
KexAlgorithms curve25519-sha256@libssh.org
<% end -%>
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
<% else -%>
Ciphers aes256-ctr
<% end -%>
MACs hmac-sha1
<% end -%>

2
templates/sshd_config/Debian_jessie.erb
View file

@ -113,7 +113,7 @@ AllowGroups <%= s %>
<% if scope.lookupvar('sshd::hardened') == 'yes' -%>
KexAlgorithms curve25519-sha256@libssh.org
Ciphers aes256-ctr
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
MACs hmac-sha1
<% end -%>

2
templates/sshd_config/Debian_sid.erb
View file

@ -113,7 +113,7 @@ AllowGroups <%= s %>
<% if scope.lookupvar('sshd::hardened') == 'yes' -%>
KexAlgorithms curve25519-sha256@libssh.org
Ciphers aes256-ctr
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
MACs hmac-sha1
<% end -%>

4
templates/sshd_config/Debian_wheezy.erb
View file

@ -117,8 +117,10 @@ AllowGroups <%= s %>
<% if scope.lookupvar('sshd::hardened') == 'yes' -%>
<% if (scope.function_versioncmp([scope.lookupvar('::ssh_version'),'6.5'])) >= 0 -%>
KexAlgorithms curve25519-sha256@libssh.org
<% end -%>
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
<% else -%>
Ciphers aes256-ctr
<% end -%>
MACs hmac-sha1
<% end -%>

4
templates/sshd_config/FreeBSD.erb
View file

@ -155,8 +155,10 @@ AllowGroups <%= s %>
<% if scope.lookupvar('sshd::hardened') == 'yes' -%>
<% if (scope.function_versioncmp([scope.lookupvar('::ssh_version'),'6.5'])) >= 0 -%>
KexAlgorithms curve25519-sha256@libssh.org
<% end -%>
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
<% else -%>
Ciphers aes256-ctr
<% end -%>
MACs hmac-sha1
<% end -%>

4
templates/sshd_config/Gentoo.erb
View file

@ -150,8 +150,10 @@ AllowGroups <%= s %>
<% if scope.lookupvar('sshd::hardened') == 'yes' -%>
<% if (scope.function_versioncmp([scope.lookupvar('::ssh_version'),'6.5'])) >= 0 -%>
KexAlgorithms curve25519-sha256@libssh.org
<% end -%>
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
<% else -%>
Ciphers aes256-ctr
<% end -%>
MACs hmac-sha1
<% end -%>

4
templates/sshd_config/OpenBSD.erb
View file

@ -131,8 +131,10 @@ AllowGroups <%= s %>
<% if scope.lookupvar('sshd::hardened') == 'yes' -%>
<% if (scope.function_versioncmp([scope.lookupvar('::ssh_version'),'6.5'])) >= 0 -%>
KexAlgorithms curve25519-sha256@libssh.org
<% end -%>
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
<% else -%>
Ciphers aes256-ctr
<% end -%>
MACs hmac-sha1
<% end -%>

4
templates/sshd_config/Ubuntu.erb
View file

@ -118,8 +118,10 @@ AllowGroups <%= s %>
<% if scope.lookupvar('sshd::hardened') == 'yes' -%>
<% if (scope.function_versioncmp([scope.lookupvar('::ssh_version'),'6.5'])) >= 0 -%>
KexAlgorithms curve25519-sha256@libssh.org
<% end -%>
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
<% else -%>
Ciphers aes256-ctr
<% end -%>
MACs hmac-sha1
<% end -%>

4
templates/sshd_config/Ubuntu_lucid.erb
View file

@ -121,8 +121,10 @@ PrintMotd <%= scope.lookupvar('sshd::print_motd') %>
<% if scope.lookupvar('sshd::hardened') == 'yes' -%>
<% if (scope.function_versioncmp([scope.lookupvar('::ssh_version'),'6.5'])) >= 0 -%>
KexAlgorithms curve25519-sha256@libssh.org
<% end -%>
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
<% else -%>
Ciphers aes256-ctr
<% end -%>
MACs hmac-sha1
<% end -%>