Fixes#11887
The second version of this patch uses the correct path on IPFire systems
and supersedes the first one. It also referrs to the correct issue ID.
Thanks to Matthias Fischer for reporting this.
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This is entirely not practicable and should have been changed
before. I missed this when I tested the configuration.
It is common that multiple SSH keys exist and three is common
number (RSA, ECDSA & Ed25519). A key passed with ssh -i and
password authentication are not even tried.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This is only setting something that is default anyways and
prevents sshd from starting if one of the listed methods
is not activated.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
In order to harden OpenSSH server in IPFire, using the upstream default configuration
and edit it via sed commands in LFS file is error-prone and does not scale.
Thereof we ship a custom and more secure OpenSSH server configuration which
is copied into the image during build time.
The fourth version of this patch disables password authentication by
default, since this is required by some cloud hosters in order to apply
the image. Further, this method is less secure than pubkey
authentication.
Non-AEAD ciphers have been re-added to provide compatibility to older
RHEL systems.
Fixes#11750Fixes#11751
Partially fixes#11538
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Cc: Marcel Lorenz <marcel.lorenz@ipfire.org>
Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Introduce a custom OpenSSH client configuration file for IPFire.
Some people use it as a jumping host, so applying hardening options
system-wide improves security.
Cryptography setup is the same as for OpenSSH server configuration.
The second version of this patch re-adds some non-AEAD cipher suites
which are needed for connecting to older RHEL systems.
Partially fixes#11751
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
