Trellis: More secure sshd defaults

Created on 12 Apr 2016 · 8Comments · Source: roots/trellis

Submit a feature request or bug report

[x] This is a feature request
[x] This request isn't a duplicate of an existing issue

What is the current behavior?

sshd may result in insecure-defaults like using RC4 cypher.

What is the expected or desired behavior?

Just like with SSL we should have better more secure defaults for sshd.

Feature Request

Please provide use cases for changing the current behavior:

Security!

Other relevant information:

See https://discourse.roots.io/t/do-we-need-ssh-rc4-cipher-enabled/6438/6

enhancement under development

Source

swalkinshaw

Most helpful comment

I'm interested. :)

Personally, I'd use ansible-ssh-hardening because it is maintained so changes there don't have to be reflected and implemented in your own config, especially with vulnerabilities showing up.

What do you think?

aried3r on 26 May 2016

👍3

All 8 comments

I'm very interested in this, any idea how is this going to be tackled? Using something like ansible-ssh-hardening or doing your own?

aried3r on 17 Apr 2016

@aried3r that role looks decent from a quick glance. We could use something like that or just add our own changes to the sshd config.

We're actually already using another role that we imported: https://github.com/roots/trellis/tree/master/roles/sshd

So we could switch or just update that template. If you're interested in helping let us know 👍

swalkinshaw on 5 May 2016

I'm interested. :)

Personally, I'd use ansible-ssh-hardening because it is maintained so changes there don't have to be reflected and implemented in your own config, especially with vulnerabilities showing up.

What do you think?

aried3r on 26 May 2016

👍3

@aried3r sorry never replied to this. https://github.com/dev-sec/ansible-ssh-hardening looks good. Would you be interested in implementing it?

swalkinshaw on 23 Jul 2016

@swalkinshaw Is this still something you want to see implemented? I never saw ansible-ssh-hardening before and now I'm most likely going to integrate it with my setup.

isynergy-development on 19 Oct 2016

@isynergy-development yep 👍

swalkinshaw on 1 Nov 2016

@swalkinshaw I got this pretty much finished, I currently have tested it locally and have it deployed on my live staging server.

Just need to test and verify sftp is still going to be working as expected because ssh-hardening is using internal-sftp with chroot directories (which is safer anyways) but obviously users that are used to using sftp will most likely want to access the web root instead of the user home folder which is default. I only use ssh in my normal day to day but I'm going to try and make a point to finish up this test and submit a PR soon.