elie/debian-cis
1
0
Fork 0
mirror of https://github.com/ovh/debian-cis.git synced 2024-11-21 21:17:00 +01:00
Code Issues Packages Projects Releases Wiki Activity

Update mac and kex to match debian10 CIS (#60)

Browse Source 
fix #53

Co-authored-by: GoldenKiwi <thibault.dewailly@corp.ovh.com>
This commit is contained in:
Thibault Ayanides 2021-02-17 11:31:22 +01:00 committed by GitHub
parent 460843ffb3
commit fa111bc0d0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
bin/hardening/5.2.14_ssh_cry_mac.sh
View File

@ -78,7 +78,7 @@ create_config() {
cat <<EOF
status=audit
# Put your MACs
OPTIONS="MACs=umac-128-etm@openssh.com,umac-64-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128@openssh.com,umac-64@openssh.com,hmac-sha2-512,hmac-sha2-256"
OPTIONS="MACs=hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256"
EOF
}

2
bin/hardening/5.2.15_ssh_cry_kex.sh
View File

@ -78,7 +78,7 @@ create_config() {
if [[ 7 -le "$DEB_MAJ_VER" ]]; then
KEX='diffie-hellman-group-exchange-sha256'
else
KEX='curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256'
KEX='curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256'
fi
set -u
cat <<EOF

2
tests/hardening/5.2.14_ssh_cry_mac.sh
View File

@ -17,6 +17,6 @@ test_audit() {
describe Checking resolved state
register_test retvalshouldbe 0
register_test contain "[ OK ] ^MACs[[:space:]]*umac-128-etm@openssh.com,umac-64-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128@openssh.com,umac-64@openssh.com,hmac-sha2-512,hmac-sha2-256 is present in /etc/ssh/sshd_config"
register_test contain "[ OK ] ^MACs[[:space:]]*hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256 is present in /etc/ssh/sshd_config"
run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
}