public
/
nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #31763 from jeaye/harden-ssh-config 

Harden ssh config defaults and remove old host key support
This commit is contained in:
Tim Steinbach 2017-11-20 20:13:21 +00:00 committed by GitHub
parent b7dac500d7 03f7adfdd1
commit 861fef71f4
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 37 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
nixos/doc/manual/release-notes/rl-1803.xml
View File

@ -72,6 +72,29 @@ following incompatible changes:</para>
<option>services.pgmanage</option>. <option>services.pgmanage</option>.
</para> </para>
</listitem> </listitem>
<listitem>
<para>
<emphasis role="strong">
The OpenSSH service no longer enables support for DSA keys by default,
which could cause a system lock out. Update your keys or, unfavorably,
re-enable DSA support manually.
</emphasis>
</para>
<para>
DSA support was
<link xlink:href="https://www.openssh.com/legacy.html">deprecated in OpenSSH 7.0</link>,
due to it being too weak. To re-enable support, add
<literal>PubkeyAcceptedKeyTypes +ssh-dss</literal> to the end of your
<option>services.openssh.extraConfig</option>.
</para>
<para>
After updating the keys to be stronger, anyone still on a pre-17.03
version is safe to jump to 17.03, as vetted
<link xlink:href="https://search.nix.gsc.io/?q=stateVersion">here</link>.
</para>
</listitem>
</itemizedlist> </itemizedlist>
</section> </section>

26
nixos/modules/services/networking/ssh/sshd.nix
View File

@ -54,8 +54,6 @@ let
)); ));
in listToAttrs (map mkAuthKeyFile usersWithKeys); in listToAttrs (map mkAuthKeyFile usersWithKeys);
supportOldHostKeys = !versionAtLeast config.system.stateVersion "15.07";
in in
{ {
@ -191,9 +189,6 @@ in
default = default =
[ { type = "rsa"; bits = 4096; path = "/etc/ssh/ssh_host_rsa_key"; } [ { type = "rsa"; bits = 4096; path = "/etc/ssh/ssh_host_rsa_key"; }
{ type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; } { type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
] ++ optionals supportOldHostKeys
[ { type = "dsa"; path = "/etc/ssh/ssh_host_dsa_key"; }
{ type = "ecdsa"; bits = 521; path = "/etc/ssh/ssh_host_ecdsa_key"; }
]; ];
description = '' description = ''
NixOS can automatically generate SSH host keys. This option NixOS can automatically generate SSH host keys. This option
@ -363,14 +358,21 @@ in
HostKey ${k.path} HostKey ${k.path}
'')} '')}
# Allow DSA client keys for now. (These were deprecated ### Recommended settings from both:
# in OpenSSH 7.0.) # https://stribika.github.io/2015/01/04/secure-secure-shell.html
PubkeyAcceptedKeyTypes +ssh-dss # and
# https://wiki.mozilla.org/Security/Guidelines/OpenSSH#Modern_.28OpenSSH_6.7.2B.29
# Re-enable DSA host keys for now. KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
${optionalString supportOldHostKeys '' Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
HostKeyAlgorithms +ssh-dss MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com
''}
# LogLevel VERBOSE logs user's key fingerprint on login.
# Needed to have a clear audit track of which key was used to log in.
LogLevel VERBOSE
# Use kernel sandbox mechanisms where possible in unprivileged processes.
UsePrivilegeSeparation sandbox
''; '';
assertions = [{ assertion = if cfg.forwardX11 then cfgc.setXAuthLocation else true; assertions = [{ assertion = if cfg.forwardX11 then cfgc.setXAuthLocation else true;