chef-ssh-hardening v2.9.0 releases: provides secure ssh-client and ssh-server configurations
ssh-hardening
This cookbook provides secure ssh-client and ssh-server configurations. This cookbook does not provide capabilities for management of users and/or ssh keys, please use other cookbooks for that.
Requirements
- Chef >= 13.10.0
Platform
- Debian 8, 9
- Ubuntu 14.04, 16.04, 18.04
- RHEL 6, 7
- CentOS 6, 7
- Oracle Linux 6, 7
- Fedora 27, 28
- OpenSuse Leap 42
- Amazon Linux 1, 2
Attributes
Below you can find the attribute documentation and their default values.
Notice: Some of attribute defaults of this cookbook are set in the recipes. You should use a higher attribute precedence level for overriding of such attributes. Such attributes are flagged with #override attribute# in the list below. Example for overriding a such attribute:
override[‘ssh-hardening‘][‘ssh‘][‘server‘][‘listen_to‘] = node[‘ipaddress‘]
- [‘ssh-hardening’][‘network’][‘ipv6’][‘enable’] – false. Set to true if IPv6 is needed
- [‘ssh-hardening’][‘ssh’][‘ports’] – 22. Ports to which ssh-server should listen to and ssh-client should connect to
- [‘ssh-hardening’][‘ssh’][{‘client’, ‘server’}][‘kex’] – nil to calculate best key-exchange (KEX) based on server version, otherwise specify a string of Kex values
- [‘ssh-hardening’][‘ssh’][{‘client’, ‘server’}][‘mac’] – nil to calculate best Message Authentication Codes (MACs) based on server version, otherwise specify a string of Mac values
- [‘ssh-hardening’][‘ssh’][{‘client’, ‘server’}][‘cipher’] – nil to calculate best ciphers based on server version, otherwise specify a string of Cipher values
- [‘ssh-hardening’][‘ssh’][{‘client’, ‘server’}][‘cbc_required’] – false. Set to true if CBC for ciphers is required. This is usually only necessary, if older M2M mechanism need to communicate with SSH, that don’t have any of the configured secure ciphers enabled. CBC is a weak alternative. Anything weaker should be avoided and is thus not available.
- [‘ssh-hardening’][‘ssh’][{‘client’, ‘server’}][‘weak_hmac’] – false. Set to true if weaker HMAC mechanisms are required. This is usually only necessary, if older M2M mechanism need to communicate with SSH, that don’t have any of the configured secure HMACs enabled.
- [‘ssh-hardening’][‘ssh’][{‘client’, ‘server’}][‘weak_kex’] – false. Set to true if weaker Key-Exchange (KEX) mechanisms are required. This is usually only necessary, if older M2M mechanism need to communicate with SSH, that don’t have any of the configured secure KEXs enabled.
- [‘ssh-hardening’][‘ssh’][‘client’][‘remote_hosts’] – [] – one or more hosts, to which ssh-client can connect to.
- [‘ssh-hardening’][‘ssh’][‘client’][‘password_authentication’] – false. Set to true if password authentication should be enabled.
- More…
Changelog v2.9
Merged pull requests:
- CentOS 8: proper SELinux package naming #223 (artem-sidorenko)
- CI: enable testing on centos-8 #222 (artem-sidorenko)
- Allow to specify an alternate AuthorizedKeysFile inside the Match block #214 (dud225)
