By default, both SSH server and client rely on TCP-based keep alive
messages to detect broken sessions, which can be spoofed rather easily
in order to keep a broken session opened (and vice versa).
Since we rely on SSH-based keep alive messages, which are not vulnerable
to this kind of tampering, there is no need to double-check connections
via TCP keep alive as well.
This patch thereof disables using TCP keep alive for both SSH client and
server scenario. For usability reasons, a timeout of 5 minutes (10
seconds * 30 keep alive messages = 300 seconds) will be used for both
client and server configuration, as 60 seconds were found to be too
short for unstable connectivity scenarios.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
This algorithm was introduced in OpenSSH 9.0p1; also, align the
curve25519-sha256* key exchanges to keep things tidy.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
In order to keep configurations as small as possible and to make them
easier to read/audit, this patch omits all default configuration in the
OpenSSH server configuration file.
Further, it mentions where to refer for the full documentation.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Fixes#11887
The second version of this patch uses the correct path on IPFire systems
and supersedes the first one. It also referrs to the correct issue ID.
Thanks to Matthias Fischer for reporting this.
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This is entirely not practicable and should have been changed
before. I missed this when I tested the configuration.
It is common that multiple SSH keys exist and three is common
number (RSA, ECDSA & Ed25519). A key passed with ssh -i and
password authentication are not even tried.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This is only setting something that is default anyways and
prevents sshd from starting if one of the listed methods
is not activated.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
In order to harden OpenSSH server in IPFire, using the upstream default configuration
and edit it via sed commands in LFS file is error-prone and does not scale.
Thereof we ship a custom and more secure OpenSSH server configuration which
is copied into the image during build time.
The fourth version of this patch disables password authentication by
default, since this is required by some cloud hosters in order to apply
the image. Further, this method is less secure than pubkey
authentication.
Non-AEAD ciphers have been re-added to provide compatibility to older
RHEL systems.
Fixes#11750Fixes#11751
Partially fixes#11538
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Cc: Marcel Lorenz <marcel.lorenz@ipfire.org>
Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Introduce a custom OpenSSH client configuration file for IPFire.
Some people use it as a jumping host, so applying hardening options
system-wide improves security.
Cryptography setup is the same as for OpenSSH server configuration.
The second version of this patch re-adds some non-AEAD cipher suites
which are needed for connecting to older RHEL systems.
Partially fixes#11751
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
