The SSH server should be configured through Ansible with a configuration to be determined.
Do we have to talk about the config or do you have one already?
We don't have a configuration file yet, but I am sure Peter has some input on this...
Created attachment 588 [details] Example sshd_config file This is what I use on my servers (could be cleaned up a bit, but I didn't had time to do it yet).
(In reply to Peter Müller from comment #3) > Created attachment 588 [details] > Example sshd_config file > > This is what I use on my servers (could be cleaned up a bit, but I didn't > had time to do it yet). Of couse, setting SSH to an high port is not _that_ effective, but avoids some noise in the log files. High ports vary here, but it is better to be consistent.
22 is fine. We don't have SSH open towards the Internet with exception on the Git server on which it has to be on 22 or nobody will be able to use it.
Okay, I will post a more compact version of the sshd_config file. Two remarks: (a) I consider password authentication being insecure, complex, and completely unnecessary so it is disabled in my example. Could we do so for the IPFire infrastrucutre, too? (b) Further, remote logins as root should be avoided in my point of view. Use "sudo" instead. Does that suit you? In general, I would prefer a more restrictive configuration here since SSH is a well-known attack vector.
a) Since we do not have SSH key access properly set up with LDAP yet, I think we need to keep password authentication enabled. As soon as we have SSH agent forwarding enabled everywhere and everyone has their keys uploaded, then we can move towards disabling it. b) Yes, again, we have this all planned, but we need LDAP integration first so that we can give root access to people who need it.
I decided to deploy a "complete" configuration with ansible instead of changing specific parameters because this seems to be the easier and more robust way. Currently i would deploy a mixture of the CentOS 7 default sshd config and the configuration from Peter. -> Done.
Created attachment 609 [details] Custom OpenSSH server configuration for IPFire Sorry for being late on this - I hope it is not too late. :-\ Attached is an updated OpenSSH server configuration which is more clean and straight-forward than the original one. It is more or less what I use on my systems, except for automatic termination of ilde sessions (Michael did not appreciate that). Please note I dropped RSA keys since I consider them to be deprecated - ECC crypto is more faster on both server and client, and except for some outdated or buggy SSH clients (PuTTY?) I did not encounter and problems. Change this if needed by adding HostKey /etc/ssh/ssh_host_rsa_key to the configuration. Let me know if there are any questions. As mentioned, sorry for being so late all the time.
(In reply to Peter Müller from comment #9) > Created attachment 609 [details] > Custom OpenSSH server configuration for IPFire > > Sorry for being late on this - I hope it is not too late. :-\ We have a few systems where we rolled out the changes already and test. So we would have to do that again before we would be ready to roll this out everywhere. > Attached is an updated OpenSSH server configuration which is more clean and > straight-forward than the original one. It is more or less what I use on my > systems, except for automatic termination of ilde sessions (Michael did not > appreciate that). Absolutely not. > Please note I dropped RSA keys since I consider them to be deprecated - ECC > crypto is more faster on both server and client, and except for some > outdated or buggy SSH clients (PuTTY?) I did not encounter and problems. NACK. RSA might not be the best we have right now, but it is widely used and there is no signs RSA is becoming weak (given long enough keys). Please keep this enabled. > Change this if needed by adding > > HostKey /etc/ssh/ssh_host_rsa_key > > to the configuration.
Created attachment 610 [details] Updated custom OpenSSH server configuration for IPFire Attached is an updated version of OpenSSH server configuation. Changes are as follows: - Enabled RSA keys again and adjust correspondending comment - Remove "MaxSession" limit (was 5 per user before) - Set timeout for successful authentication to 30 seconds (before: 20 sec) Changes 2 and 3 were made because of Michaels post on the development mailing list (https://lists.ipfire.org/pipermail/development/2018-August/004726.html).
Created attachment 631 [details] Updated custom OpenSSH server configuration for IPFire Attached is an updated version of the OpenSSH server configuration file. It is more consistent to the version used in IPFire 2.x now. Ciphers have been updated so compatibility with some legacy clients (RHEL) is working again. From my point of view, this version can be distributed via Ansible in our infrastructure.
Created attachment 632 [details] custom OpenSSH client configuration for IPFire Added OpenSSH client configuration file (to be placed in /etc/ssh/ssh_config , users may override it by setting up local SSH client configurations). Crypto algorithm are consistent to the list choosen for OpenSSH server.
Did you test if CentOS 7 supports all these new ciphers?
OpenSSH server on CentOS 7 supports all of them: [pmueller@git01 ~]$ ssh -Q cipher 3des-cbc aes128-cbc aes192-cbc aes256-cbc rijndael-cbc@lysator.liu.se aes128-ctr aes192-ctr aes256-ctr aes128-gcm@openssh.com aes256-gcm@openssh.com chacha20-poly1305@openssh.com As far as I am aware, all modern (OpenSSH > 6.5) distributions do so.
Done in common role.