From b7d698d743009b1ac07bbca974b4e36d4b51ad36 Mon Sep 17 00:00:00 2001 From: Joe Testa Date: Sun, 27 Sep 2020 17:04:43 -0400 Subject: [PATCH] Added policy for hardened OpenSSH v8.4. --- policies/openssh_8_4.txt | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 policies/openssh_8_4.txt diff --git a/policies/openssh_8_4.txt b/policies/openssh_8_4.txt new file mode 100644 index 0000000..ef34152 --- /dev/null +++ b/policies/openssh_8_4.txt @@ -0,0 +1,28 @@ +# +# Official policy for hardened OpenSSH v8.4. +# + +name = "Hardened OpenSSH v8.4" +version = 1 + +# RSA host key sizes. +hostkey_size_rsa-sha2-256 = 4096 +hostkey_size_rsa-sha2-512 = 4096 + +# Group exchange DH modulus sizes. +dh_modulus_size_diffie-hellman-group-exchange-sha256 = 2048 + +# The host key types that must match exactly (order matters). +host keys = rsa-sha2-512, rsa-sha2-256, ssh-ed25519 + +# Host key types that may optionally appear. +optional host keys = sk-ssh-ed25519@openssh.com, ssh-ed25519-cert-v01@openssh.com, sk-ssh-ed25519-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com + +# The key exchange algorithms that must match exactly (order matters). +key exchanges = curve25519-sha256, curve25519-sha256@libssh.org, diffie-hellman-group16-sha512, diffie-hellman-group18-sha512, diffie-hellman-group-exchange-sha256 + +# The ciphers that must match exactly (order matters). +ciphers = chacha20-poly1305@openssh.com, aes256-gcm@openssh.com, aes128-gcm@openssh.com, aes256-ctr, aes192-ctr, aes128-ctr + +# The MACs that must match exactly (order matters). +macs = hmac-sha2-256-etm@openssh.com, hmac-sha2-512-etm@openssh.com, umac-128-etm@openssh.com