From 801ea22dcac551b33b8f3c3007431bc0c896b939 Mon Sep 17 00:00:00 2001
From: Patrick Spek <p.spek@tyil.nl>
Date: Tue, 30 Aug 2022 04:11:27 +0200
Subject: Update SSH config

Credits to
https://www.monotux.tech/posts/2021/11/maximize-ssh-audit-score/
---
 playbooks.d/ssh/playbook.bash     | 18 ++++++++++++++++++
 playbooks.d/ssh/share/sshd_config | 10 ++++++++--
 2 files changed, 26 insertions(+), 2 deletions(-)

(limited to 'playbooks.d/ssh')

diff --git a/playbooks.d/ssh/playbook.bash b/playbooks.d/ssh/playbook.bash
index e9b28d5..12f6bb6 100644
--- a/playbooks.d/ssh/playbook.bash
+++ b/playbooks.d/ssh/playbook.bash
@@ -17,6 +17,14 @@ playbook_sync() {
 		"sftp=$(config "ssh.sftp")" \
 		> /etc/ssh/sshd_config
 
+	# Generate stronger keys if needed
+	if (( $(ssh_key_size "$(config "fs.etcdir")/ssh/ssh_host_rsa_key") < 4096 ))
+	then
+		warn "$BASHTARD_PLAYBOOK" "Generating new RSA SSH host key"
+		rm -f -- "$(config "fs.etcdir")/ssh/ssh_host_rsa_key"
+		ssh-keygen -t rsa -b 4096 -f "$(config "fs.etcdir")/ssh/ssh_host_rsa_key" -N ""
+	fi
+
 	info "$BASHTARD_PLAYBOOK" "Generating MotD"
 	file_template "motd" \
 		"fqdn=${BASHTARD_PLATFORM[fqdn]}" \
@@ -32,3 +40,13 @@ playbook_del() {
 	svc stop "sshd"
 	svc disable "sshd"
 }
+
+ssh_key_size() {
+	if [[ ! -f "$1" ]]
+	then
+		printf "0"
+		return
+	fi
+
+	ssh-keygen -l -f "$1" | awk '{ print $1 }'
+}
diff --git a/playbooks.d/ssh/share/sshd_config b/playbooks.d/ssh/share/sshd_config
index 97bea2e..b7eae70 100644
--- a/playbooks.d/ssh/share/sshd_config
+++ b/playbooks.d/ssh/share/sshd_config
@@ -12,11 +12,17 @@ Subsystem sftp ${sftp}
 
 # Authentication
 AuthorizedKeysFile /etc/ssh/authorized_keys .ssh/authorized_keys
-PermitRootLogin no
-PasswordAuthentication no
 ChallengeResponseAuthentication no
+PasswordAuthentication no
+PermitRootLogin no
 PubkeyAuthentication no
 
+# Security
+Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
+HostKeyAlgorithms rsa-sha2-512,rsa-sha2-256,ssh-ed25519
+KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256
+MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com
+
 # Allow tyil
 Match User tyil
     PubkeyAuthentication yes
-- 
cgit v1.1