From 0b905a7fdd99501b793b6bfaedbe719fb16c8bc4 Mon Sep 17 00:00:00 2001 From: Joe Testa Date: Wed, 1 Feb 2023 19:29:54 -0500 Subject: [PATCH] Added Ubuntu Client 22.04 hardening policy. --- README.md | 4 ++-- src/ssh_audit/policy.py | 4 +++- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 856f63e..ac1db75 100644 --- a/README.md +++ b/README.md @@ -32,7 +32,7 @@ - historical information from OpenSSH, Dropbear SSH and libssh; - policy scans to ensure adherence to a hardened/standard configuration; - runs on Linux and Windows; -- supports Python 3.7 - 3.10; +- supports Python 3.7 - 3.11; - no dependencies ## Usage @@ -176,7 +176,7 @@ For convenience, a web front-end on top of the command-line tool is available at ### v2.6.0-dev - Dropped support for Python 3.6, as it reached EOL at the end of 2021. - - Added Ubuntu Server 22.04 hardening policy. + - Added Ubuntu Server & Client 22.04 hardening policies. - Removed experimental warning tag from `sntrup761x25519-sha512@openssh.com`. - Updated CVE database; credit [Alexandre Zanni](https://github.com/noraj). - Added `-g` and `--gex-test` for granular GEX modulus size tests; credit [Adam Russell](https://github.com/thecliguy). diff --git a/src/ssh_audit/policy.py b/src/ssh_audit/policy.py index 8c82c2d..2e28699 100644 --- a/src/ssh_audit/policy.py +++ b/src/ssh_audit/policy.py @@ -1,7 +1,7 @@ """ The MIT License (MIT) - Copyright (C) 2020-2021 Joe Testa (jtesta@positronsecurity.com) + Copyright (C) 2020-2023 Joe Testa (jtesta@positronsecurity.com) Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal @@ -83,6 +83,8 @@ class Policy: 'Hardened Ubuntu Client 20.04 LTS (version 2)': {'version': '2', 'banner': None, 'compressions': None, 'host_keys': ['ssh-ed25519', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512', 'rsa-sha2-512-cert-v01@openssh.com'], 'optional_host_keys': None, 'kex': ['curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256', 'ext-info-c'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': None, 'cakey_sizes': None, 'dh_modulus_sizes': None, 'server_policy': False}, + 'Hardened Ubuntu Client 22.04 LTS (version 1)': {'version': '1', 'banner': None, 'compressions': None, 'host_keys': ['ssh-ed25519', 'ssh-ed25519-cert-v01@openssh.com', 'sk-ssh-ed25519@openssh.com', 'sk-ssh-ed25519-cert-v01@openssh.com', 'rsa-sha2-256', 'rsa-sha2-256-cert-v01@openssh.com', 'rsa-sha2-512', 'rsa-sha2-512-cert-v01@openssh.com'], 'optional_host_keys': None, 'kex': ['sntrup761x25519-sha512@openssh.com', 'curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha256', 'ext-info-c'], 'ciphers': ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com', 'aes256-ctr', 'aes192-ctr', 'aes128-ctr'], 'macs': ['hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'umac-128-etm@openssh.com'], 'hostkey_sizes': None, 'cakey_sizes': None, 'dh_modulus_sizes': None, 'server_policy': False}, + }