Skip to content
This repository was archived by the owner on Dec 26, 2020. It is now read-only.

Commit 97c80ef

Browse files
author
Sebastian Gumprich
authored
Merge pull request #68 from dev-sec/debian8
Debian8
2 parents 3ed179b + a09eb51 commit 97c80ef

File tree

5 files changed

+24
-37
lines changed

5 files changed

+24
-37
lines changed

‎.kitchen.yml‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,26 @@
11
---
22
driver:
33
name: vagrant
4+
45
provisioner:
56
name: ansible_playbook
6-
test_repo_uri: https://github.com/hardening-io/tests-ssh-hardening.git
77
hosts: all
88
require_ansible_repo: false
99
require_ansible_omnibus: true
1010
require_chef_for_busser: false
1111
require_ruby_for_busser: false
1212
ansible_verbose: true
1313
ansible_diff: true
14+
hosts: all
1415
roles_path: ../ansible-ssh-hardening/
1516
playbook: default.yml
1617

18+
verifier:
19+
name: inspec
20+
sudo: true
21+
inspec_tests:
22+
- https://github.com/dev-sec/tests-ssh-hardening
23+
1724
platforms:
1825
- name: ubuntu-12.04
1926
driver_config:
@@ -39,10 +46,6 @@ platforms:
3946
driver_config:
4047
box: oracle-6.5
4148
box_url: https://storage.us2.oraclecloud.com/v1/istoilis-istoilis/vagrant/oel65-64.box
42-
- name: debian-6
43-
driver_config:
44-
box: debian-6
45-
box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_debian-6.0.10_chef-provisionerless.box
4649
- name: debian-7
4750
driver_config:
4851
box: debian-7
@@ -51,11 +54,9 @@ platforms:
5154
driver_config:
5255
box: debian-8
5356
box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_debian-8.1_chef-provisionerless.box
54-
verifier:
55-
name: inspec
57+
5658
suites:
57-
- name: ansible_1.9
59+
- name: ssh-ansible_1.9
5860
provisioner:
5961
ansible_version: 1.9.4
60-
- name: ansible_latest
61-
62+
- name: ssh-ansible_latest

‎README.md‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -60,9 +60,6 @@ Next install test-kitchen:
6060
gem install bundler
6161
bundle install
6262

63-
# Fetch tests
64-
bundle exec thor kitchen:fetch-remote-tests
65-
6663
# fast test on one machine
6764
bundle exec kitchen test default-ubuntu-1204
6865

‎meta/main.yml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,6 @@ galaxy_info:
99
- name: EL
1010
versions:
1111
- 6
12-
- name: Oracle Linux
13-
versions:
14-
- 6
1512
- name: Ubuntu
1613
versions:
1714
- precise

‎templates/openssh.conf.j2‎

Lines changed: 7 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
# ===================
1010

1111
# Address family should always be limited to the active network configuration.
12-
AddressFamily {{ 'any' if network_ipv6_enable else 'inet' }}
12+
AddressFamily {{ 'any' if network_ipv6_enable else 'inet' }}
1313
# Restrict the following configuration to be limited to this Host.
1414
{% for host in ssh_remote_hosts -%}
1515
Host {{host}}
@@ -47,13 +47,13 @@ StrictHostKeyChecking ask
4747
# -- see: (http://net-ssh.github.com/net-ssh/classes/Net/SSH/Transport/CipherFactory.html)
4848
#
4949
{% if ssh_client_cbc_required -%}
50-
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' -%}
50+
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
5151
Ciphers {{ ssh_ciphers_66_weak | join(',') }}
5252
{% else -%}
5353
Ciphers {{ ssh_ciphers_53_weak | join(',') }}
5454
{% endif %}
5555
{% else -%}
56-
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' -%}
56+
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
5757
Ciphers {{ ssh_ciphers_66_default | join(',') }}
5858
{% else -%}
5959
Ciphers {{ ssh_ciphers_53_default | join(',') }}
@@ -65,22 +65,18 @@ StrictHostKeyChecking ask
6565
# eg Ruby's Net::SSH at around 2.2.* doesn't support sha2 for hmac, so this will have to be set true in this case.
6666
#
6767
{% if ssh_client_weak_hmac -%}
68-
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' -%}
68+
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
6969
MACs {{ ssh_macs_66_weak | join(',') }}
7070
{% elif ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version <= '6' -%}
7171
MACs {{ ssh_macs_53_default | join(',') }}
72-
{% elif ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6' -%}
73-
MACs {{ ssh_macs_53_default | join(',') }}
7472
{% else -%}
7573
MACs {{ ssh_macs_59_weak | join(',') }}
7674
{% endif %}
7775
{% else -%}
78-
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' -%}
76+
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
7977
MACs {{ ssh_macs_66_default | join(',') }}
8078
{% elif ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version <= '6' -%}
8179
MACs {{ ssh_macs_53_default | join(',') }}
82-
{% elif ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6' -%}
83-
MACs {{ ssh_macs_53_default | join(',') }}
8480
{% else -%}
8581
MACs {{ ssh_macs_59_default | join(',') }}
8682
{% endif %}
@@ -93,14 +89,14 @@ StrictHostKeyChecking ask
9389
# Weak kex is sometimes required if older package versions are used
9490
# eg ruby's Net::SSH at around 2.2.* doesn't support sha2 for kex, so this will have to be set true in this case.
9591
#
96-
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' -%}
92+
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
9793
{% if ssh_client_weak_kex -%}
9894
KexAlgorithms {{ ssh_kex_66_weak | join(',') }}
9995
{% else -%}
10096
KexAlgorithms {{ ssh_kex_66_default | join(',') }}
10197
{% endif %}
10298
{% else -%}
103-
{% if ansible_os_family in ['Oracle Linux', 'RedHat'] or (ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6') -%}
99+
{% if ansible_os_family in ['Oracle Linux', 'RedHat'] -%}
104100
#KexAlgorithms
105101
{% elif ssh_client_weak_kex -%}
106102
KexAlgorithms {{ ssh_kex_59_weak | join(',') }}

‎templates/opensshd.conf.j2‎

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -51,13 +51,13 @@ LogLevel VERBOSE
5151
# -- see: (http://net-ssh.github.com/net-ssh/classes/Net/SSH/Transport/CipherFactory.html)
5252
#
5353
{% if ssh_server_cbc_required -%}
54-
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' -%}
54+
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
5555
Ciphers {{ ssh_ciphers_66_weak | join(',') }}
5656
{% else %}
5757
Ciphers {{ ssh_ciphers_53_weak | join(',') }}
5858
{% endif %}
5959
{% else -%}
60-
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' -%}
60+
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
6161
Ciphers {{ ssh_ciphers_66_default | join(',') }}
6262
{% else -%}
6363
Ciphers {{ ssh_ciphers_53_default | join(',') }}
@@ -70,22 +70,18 @@ LogLevel VERBOSE
7070
#
7171

7272
{% if ssh_server_weak_hmac -%}
73-
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' -%}
73+
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
7474
MACs {{ ssh_macs_66_weak | join(',') }}
7575
{% elif ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version <= '6' -%}
7676
MACs {{ ssh_macs_53_default | join(',') }}
77-
{% elif ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6' -%}
78-
MACs {{ ssh_macs_53_default | join(',') }}
7977
{% else -%}
8078
MACs {{ ssh_macs_59_weak | join(',') }}
8179
{% endif %}
8280
{% else -%}
83-
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' -%}
81+
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
8482
MACs {{ ssh_macs_66_default | join(',') }}
8583
{% elif ansible_os_family in ['Oracle Linux', 'RedHat'] and ansible_distribution_major_version <= '6' -%}
8684
MACs {{ ssh_macs_53_default | join(',') }}
87-
{% elif ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6' -%}
88-
MACs {{ ssh_macs_53_default | join(',') }}
8985
{% else -%}
9086
MACs {{ ssh_macs_59_default | join(',') }}
9187
{% endif %}
@@ -98,14 +94,14 @@ LogLevel VERBOSE
9894
# Weak kex is sometimes required if older package versions are used
9995
# eg ruby's Net::SSH at around 2.2.* doesn't support sha2 for kex, so this will have to be set true in this case.
10096
# based on: https://bettercrypto.org/static/applied-crypto-hardening.pdf
101-
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' -%}
97+
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04') or (ansible_distribution == 'Debian' and ansible_distribution_version >= '8') -%}
10298
{% if ssh_server_weak_kex -%}
10399
KexAlgorithms {{ ssh_kex_66_weak | join(',') }}
104100
{% else -%}
105101
KexAlgorithms {{ ssh_kex_66_default | join(',') }}
106102
{% endif %}
107103
{% else -%}
108-
{% if ansible_os_family in ['Oracle Linux', 'RedHat'] or (ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6') -%}
104+
{% if ansible_os_family in ['Oracle Linux', 'RedHat'] -%}
109105
#KexAlgorithms
110106
{% elif ssh_server_weak_kex -%}
111107
KexAlgorithms {{ sshd_kex_59_weak | join(',') }}

0 commit comments

Comments
 (0)