[PATCH v2 1/2] add hardened SSH client configuration

[PATCH v2 1/2] add hardened SSH client configuration

[Peter Müller]

[-- Attachment #1: Type: text/plain, Size: 2139 bytes --]

Introduce a custom OpenSSH client configuration file for IPFire.
Some people use it as a jumping host, so applying hardening options
system-wide improves security.

Cryptography setup is the same as for OpenSSH server configuration.

The second version of this patch re-adds some non-AEAD cipher suites
which are needed for connecting to older RHEL systems.

Partially fixes #11751

Signed-off-by: Peter Müller <peter.mueller(a)link38.eu>
---
 config/ssh/ssh_config | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 config/ssh/ssh_config

diff --git a/config/ssh/ssh_config b/config/ssh/ssh_config
new file mode 100644
index 000000000..2abfae6d1
--- /dev/null
+++ b/config/ssh/ssh_config
@@ -0,0 +1,33 @@
+# OpenSSH client configuration
+#
+# set some basic hardening options for all connections
+Host *
+        # disable Roaming as it is known to be vulnerable
+        UseRoaming no
+
+        # only use secure crypto algorithm
+        KexAlgorithms curve25519-sha256(a)libssh.org,diffie-hellman-group-exchange-sha256
+        Ciphers chacha20-poly1305(a)openssh.com,aes256-gcm(a)openssh.com,aes128-gcm(a)openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
+        MACs hmac-sha2-512-etm(a)openssh.com,hmac-sha2-256-etm(a)openssh.com,umac-128-etm(a)openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128(a)openssh.com
+
+        # always visualise server host keys (has no technical
+        # effect, but helps to identify key based MITM attacks)
+        VisualHostKey yes
+
+        # use SSHFP (might work on some up-to-date networks) to look up host keys
+        VerifyHostKeyDNS yes
+
+        # send keep-alive messages to connected server to avoid broken connections
+        ServerAliveInterval 10
+        ServerAliveCountMax 6
+
+        # disable X11 forwarding (security risk)
+        ForwardX11 no
+
+        # always check server IP address
+        CheckHostIP yes
+
+        # ensure only allowed authentication methods are used
+        PreferredAuthentications publickey,keyboard-interactive,password
+
+# EOF
-- 
2.16.4

[PATCH v2 2/2] use custom SSH client configuration in LFS file

[Peter Müller]

[-- Attachment #1: Type: text/plain, Size: 803 bytes --]

Include OpenSSH client configuration file during build.

Signed-off-by: Peter Müller <peter.mueller(a)link38.eu>
---
 lfs/openssh | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lfs/openssh b/lfs/openssh
index a88b2d126..0e6acc227 100644
--- a/lfs/openssh
+++ b/lfs/openssh
@@ -100,5 +100,10 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 		-e 's|^#\?HostKey /etc/ssh/ssh_host_ed25519_key$$||' \
 		-e 's|^#\?HostKey /etc/ssh/ssh_host_rsa_key$$|HostKey /etc/ssh/ssh_host_ecdsa_key\nHostKey /etc/ssh/ssh_host_ed25519_key\nHostKey /etc/ssh/ssh_host_rsa_key|' \
 		/etc/ssh/sshd_config
+
+	# install custom OpenSSH client configuration
+	install -v -m 644 $(DIR_SRC)/config/ssh/ssh_config \
+		/etc/ssh/ssh_config
+
 	@rm -rf $(DIR_APP)
 	@$(POSTBUILD)
-- 
2.16.4

Re: [PATCH v2 2/2] use custom SSH client configuration in LFS file

[Michael Tremer]

[-- Attachment #1: Type: text/plain, Size: 1078 bytes --]

Hello,

did you notice that this file is excluded from being updated on existing
installations?

How do we handle any custom changes from users here?

I merged this for new installations already.

-Michael

On Mon, 2018-09-10 at 16:29 +0200, Peter Müller wrote:
> Include OpenSSH client configuration file during build.
> 
> Signed-off-by: Peter Müller <peter.mueller(a)link38.eu>
> ---
>  lfs/openssh | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/lfs/openssh b/lfs/openssh
> index a88b2d126..0e6acc227 100644
> --- a/lfs/openssh
> +++ b/lfs/openssh
> @@ -100,5 +100,10 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
>  		-e 's|^#\?HostKey /etc/ssh/ssh_host_ed25519_key$$||' \
>  		-e 's|^#\?HostKey /etc/ssh/ssh_host_rsa_key$$|HostKey
> /etc/ssh/ssh_host_ecdsa_key\nHostKey /etc/ssh/ssh_host_ed25519_key\nHostKey
> /etc/ssh/ssh_host_rsa_key|' \
>  		/etc/ssh/sshd_config
> +
> +	# install custom OpenSSH client configuration
> +	install -v -m 644 $(DIR_SRC)/config/ssh/ssh_config \
> +		/etc/ssh/ssh_config
> +
>  	@rm -rf $(DIR_APP)
>  	@$(POSTBUILD)

Re: [PATCH v2 2/2] use custom SSH client configuration in LFS file

[Peter Müller]

[-- Attachment #1: Type: text/plain, Size: 2014 bytes --]

Hello Michael,

> Hello,
> 
> did you notice that this file is excluded from being updated on existing
> installations?
no - but I should have thought about that. :-\
> 
> How do we handle any custom changes from users here?
The only possibility of keeping the user's settings is to move existing
SSH client configurations to a new location, replace /etc/ssh/ssh_config
with this one and include the version before.

However, I strongly advise against this. (For example, some settings
in the original config might revert hardening options, causing no security
benefit after all.)

Since it is "just" the client configuration, I consider overwriting it
the best procedure. Of course, there has to be a yellow warning box in
the release notes, but it is better than no hardening at all.
> 
> I merged this for new installations already.
Great. SSH server configuration will follow.

Best regards,
Peter Müller
> 
> -Michael
> 
> On Mon, 2018-09-10 at 16:29 +0200, Peter Müller wrote:
>> Include OpenSSH client configuration file during build.
>>
>> Signed-off-by: Peter Müller <peter.mueller(a)link38.eu>
>> ---
>>  lfs/openssh | 5 +++++
>>  1 file changed, 5 insertions(+)
>>
>> diff --git a/lfs/openssh b/lfs/openssh
>> index a88b2d126..0e6acc227 100644
>> --- a/lfs/openssh
>> +++ b/lfs/openssh
>> @@ -100,5 +100,10 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
>>  		-e 's|^#\?HostKey /etc/ssh/ssh_host_ed25519_key$$||' \
>>  		-e 's|^#\?HostKey /etc/ssh/ssh_host_rsa_key$$|HostKey
>> /etc/ssh/ssh_host_ecdsa_key\nHostKey /etc/ssh/ssh_host_ed25519_key\nHostKey
>> /etc/ssh/ssh_host_rsa_key|' \
>>  		/etc/ssh/sshd_config
>> +
>> +	# install custom OpenSSH client configuration
>> +	install -v -m 644 $(DIR_SRC)/config/ssh/ssh_config \
>> +		/etc/ssh/ssh_config
>> +
>>  	@rm -rf $(DIR_APP)
>>  	@$(POSTBUILD)
> 

-- 
Microsoft DNS service terminates abnormally when it recieves a response
to a DNS query that was never made.  Fix Information: Run your DNS
service on a different platform.
		-- bugtraq