From fa111bc0d05144ec5c42b52b9b9cf38ca198b4c3 Mon Sep 17 00:00:00 2001
From: Thibault Ayanides <thibault.ayanides@ovhcloud.com>
Date: Wed, 17 Feb 2021 11:31:22 +0100
Subject: [PATCH] Update mac and kex to match debian10 CIS (#60)

fix #53

Co-authored-by: GoldenKiwi <thibault.dewailly@corp.ovh.com>
---
 bin/hardening/5.2.14_ssh_cry_mac.sh   | 2 +-
 bin/hardening/5.2.15_ssh_cry_kex.sh   | 2 +-
 tests/hardening/5.2.14_ssh_cry_mac.sh | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/bin/hardening/5.2.14_ssh_cry_mac.sh b/bin/hardening/5.2.14_ssh_cry_mac.sh
index 5867162..6894aff 100755
--- a/bin/hardening/5.2.14_ssh_cry_mac.sh
+++ b/bin/hardening/5.2.14_ssh_cry_mac.sh
@@ -78,7 +78,7 @@ create_config() {
     cat <<EOF
 status=audit
 # Put your MACs
-OPTIONS="MACs=umac-128-etm@openssh.com,umac-64-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128@openssh.com,umac-64@openssh.com,hmac-sha2-512,hmac-sha2-256"
+OPTIONS="MACs=hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256"
 EOF
 }
 
diff --git a/bin/hardening/5.2.15_ssh_cry_kex.sh b/bin/hardening/5.2.15_ssh_cry_kex.sh
index 584786f..1a0a070 100755
--- a/bin/hardening/5.2.15_ssh_cry_kex.sh
+++ b/bin/hardening/5.2.15_ssh_cry_kex.sh
@@ -78,7 +78,7 @@ create_config() {
     if [[ 7 -le "$DEB_MAJ_VER" ]]; then
         KEX='diffie-hellman-group-exchange-sha256'
     else
-        KEX='curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256'
+        KEX='curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256'
     fi
     set -u
     cat <<EOF
diff --git a/tests/hardening/5.2.14_ssh_cry_mac.sh b/tests/hardening/5.2.14_ssh_cry_mac.sh
index 557832c..585282d 100644
--- a/tests/hardening/5.2.14_ssh_cry_mac.sh
+++ b/tests/hardening/5.2.14_ssh_cry_mac.sh
@@ -17,6 +17,6 @@ test_audit() {
 
     describe Checking resolved state
     register_test retvalshouldbe 0
-    register_test contain "[ OK ] ^MACs[[:space:]]*umac-128-etm@openssh.com,umac-64-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128@openssh.com,umac-64@openssh.com,hmac-sha2-512,hmac-sha2-256 is present in /etc/ssh/sshd_config"
+    register_test contain "[ OK ] ^MACs[[:space:]]*hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256 is present in /etc/ssh/sshd_config"
     run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
 }