Skip to content

Commit 8e36493

Browse files
artem-sidorenkoartem-sidorenko
committed
Split the attribues to the client and server areas
Fixes GH-53
1 parent c1fbf18 commit 8e36493

File tree

4 files changed

+85
-83
lines changed

4 files changed

+85
-83
lines changed

‎attributes/default.rb‎

Lines changed: 45 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -46,55 +46,57 @@
4646
default['ssh-hardening']['sshserver']['service_name'] = 'ssh'
4747
end
4848

49+
# sshd + ssh client
50+
default['ssh-hardening']['network']['ipv6']['enable'] = false
4951
default['ssh-hardening']['config_disclaimer'] = '**Note:** This file was automatically created by Hardening Framework (dev-sec.io) configuration. If you use its automated setup, do not edit this file directly, but adjust the automation instead.'
50-
default['ssh-hardening']['network']['ipv6']['enable'] = false # sshd + ssh
51-
default['ssh-hardening']['ssh']['server']['kex'] = nil # nil = calculate best combination for server version
52+
default['ssh-hardening']['ssh']['ports'] = [22]
53+
54+
# ssh client
5255
default['ssh-hardening']['ssh']['client']['mac'] = nil # nil = calculate best combination for client
53-
default['ssh-hardening']['ssh']['server']['cipher'] = nil # nil = calculate best combination for server version
5456
default['ssh-hardening']['ssh']['client']['kex'] = nil # nil = calculate best combination for client
55-
default['ssh-hardening']['ssh']['server']['mac'] = nil # nil = calculate best combination for server version
5657
default['ssh-hardening']['ssh']['client']['cipher'] = nil # nil = calculate best combination for client
57-
default['ssh-hardening']['ssh']['client']['cbc_required'] = false # ssh
58-
default['ssh-hardening']['ssh']['server']['cbc_required'] = false # sshd
59-
default['ssh-hardening']['ssh']['client']['weak_hmac'] = false # ssh
60-
default['ssh-hardening']['ssh']['server']['weak_hmac'] = false # sshd
61-
default['ssh-hardening']['ssh']['client']['weak_kex'] = false # ssh
62-
default['ssh-hardening']['ssh']['server']['weak_kex'] = false # sshd
63-
default['ssh-hardening']['ssh']['ports'] = [22] # sshd + ssh
64-
default['ssh-hardening']['ssh']['listen_to'] = ['0.0.0.0'] # sshd
65-
default['ssh-hardening']['ssh']['host_key_files'] = ['/etc/ssh/ssh_host_rsa_key', '/etc/ssh/ssh_host_dsa_key', '/etc/ssh/ssh_host_ecdsa_key'] # sshd
66-
default['ssh-hardening']['ssh']['client_alive_interval'] = 600 # sshd, 10min
67-
default['ssh-hardening']['ssh']['client_alive_count'] = 3 # sshd, ~> 3 x interval
68-
default['ssh-hardening']['ssh']['remote_hosts'] = [] # ssh
69-
default['ssh-hardening']['ssh']['allow_root_with_key'] = false # sshd
70-
default['ssh-hardening']['ssh']['allow_tcp_forwarding'] = false # sshd
71-
default['ssh-hardening']['ssh']['allow_agent_forwarding'] = false # sshd
72-
default['ssh-hardening']['ssh']['allow_x11_forwarding'] = false # sshd
73-
default['ssh-hardening']['ssh']['use_pam'] = false # sshd
74-
default['ssh-hardening']['ssh']['challenge_response_authentication'] = false # sshd
75-
default['ssh-hardening']['ssh']['deny_users'] = [] # sshd
76-
default['ssh-hardening']['ssh']['allow_users'] = [] # sshd
77-
default['ssh-hardening']['ssh']['deny_groups'] = [] # sshd
78-
default['ssh-hardening']['ssh']['allow_groups'] = [] # sshd
79-
default['ssh-hardening']['ssh']['print_motd'] = false # sshd
80-
default['ssh-hardening']['ssh']['print_last_log'] = false # sshd
81-
# set this to nil to disable banner or provide a path like '/etc/issue.net'
82-
default['ssh-hardening']['ssh']['banner'] = nil # sshd
83-
default['ssh-hardening']['ssh']['os_banner'] = false # sshd (Debian OS family)
58+
default['ssh-hardening']['ssh']['client']['cbc_required'] = false
59+
default['ssh-hardening']['ssh']['client']['weak_hmac'] = false
60+
default['ssh-hardening']['ssh']['client']['weak_kex'] = false
8461

85-
# set this to nil to let us use the default OpenSSH in case it's not set by the user
86-
default['ssh-hardening']['ssh']['use_dns'] = nil # sshd
87-
# set this to nil to let us detect the attribute based on the node platform
88-
default['ssh-hardening']['ssh']['use_privilege_separation'] = nil
89-
default['ssh-hardening']['ssh']['login_grace_time'] = '30s' # sshd
90-
default['ssh-hardening']['ssh']['max_auth_tries'] = 2 # sshd
91-
default['ssh-hardening']['ssh']['max_sessions'] = 10 # sshd
62+
default['ssh-hardening']['ssh']['client']['remote_hosts'] = []
9263
default['ssh-hardening']['ssh']['client']['password_authentication'] = false # ssh
93-
default['ssh-hardening']['ssh']['server']['password_authentication'] = false # sshd
9464
# http://undeadly.org/cgi?action=article&sid=20160114142733
9565
default['ssh-hardening']['ssh']['client']['roaming'] = false
9666

97-
# Define SFTP options
98-
default['ssh-hardening']['ssh']['sftp']['enable'] = false
99-
default['ssh-hardening']['ssh']['sftp']['group'] = 'sftponly'
100-
default['ssh-hardening']['ssh']['sftp']['chroot'] = '/home/%u'
67+
# sshd
68+
default['ssh-hardening']['ssh']['server']['kex'] = nil # nil = calculate best combination for server version
69+
default['ssh-hardening']['ssh']['server']['cipher'] = nil # nil = calculate best combination for server version
70+
default['ssh-hardening']['ssh']['server']['mac'] = nil # nil = calculate best combination for server version
71+
default['ssh-hardening']['ssh']['server']['cbc_required'] = false
72+
default['ssh-hardening']['ssh']['server']['weak_hmac'] = false
73+
default['ssh-hardening']['ssh']['server']['weak_kex'] = false
74+
default['ssh-hardening']['ssh']['server']['listen_to'] = ['0.0.0.0']
75+
default['ssh-hardening']['ssh']['server']['host_key_files'] = ['/etc/ssh/ssh_host_rsa_key', '/etc/ssh/ssh_host_dsa_key', '/etc/ssh/ssh_host_ecdsa_key']
76+
default['ssh-hardening']['ssh']['server']['client_alive_interval'] = 600 # 10min
77+
default['ssh-hardening']['ssh']['server']['client_alive_count'] = 3 # ~> 3 x interval
78+
79+
default['ssh-hardening']['ssh']['server']['allow_root_with_key'] = false
80+
default['ssh-hardening']['ssh']['server']['allow_tcp_forwarding'] = false
81+
default['ssh-hardening']['ssh']['server']['allow_agent_forwarding'] = false
82+
default['ssh-hardening']['ssh']['server']['allow_x11_forwarding'] = false
83+
default['ssh-hardening']['ssh']['server']['use_pam'] = false
84+
default['ssh-hardening']['ssh']['server']['challenge_response_authentication'] = false
85+
default['ssh-hardening']['ssh']['server']['deny_users'] = []
86+
default['ssh-hardening']['ssh']['server']['allow_users'] = []
87+
default['ssh-hardening']['ssh']['server']['deny_groups'] = []
88+
default['ssh-hardening']['ssh']['server']['allow_groups'] = []
89+
default['ssh-hardening']['ssh']['server']['print_motd'] = false
90+
default['ssh-hardening']['ssh']['server']['print_last_log'] = false
91+
default['ssh-hardening']['ssh']['server']['banner'] = nil # set this to nil to disable banner or provide a path like '/etc/issue.net'
92+
default['ssh-hardening']['ssh']['server']['os_banner'] = false # (Debian OS family)
93+
default['ssh-hardening']['ssh']['server']['use_dns'] = nil # set this to nil to let us use the default OpenSSH in case it's not set by the user
94+
default['ssh-hardening']['ssh']['server']['use_privilege_separation'] = nil # set this to nil to let us detect the attribute based on the node platform
95+
default['ssh-hardening']['ssh']['server']['login_grace_time'] = '30s'
96+
default['ssh-hardening']['ssh']['server']['max_auth_tries'] = 2
97+
default['ssh-hardening']['ssh']['server']['max_sessions'] = 10
98+
default['ssh-hardening']['ssh']['server']['password_authentication'] = false
99+
# sshd sftp options
100+
default['ssh-hardening']['ssh']['server']['sftp']['enable'] = false
101+
default['ssh-hardening']['ssh']['server']['sftp']['group'] = 'sftponly'
102+
default['ssh-hardening']['ssh']['server']['sftp']['chroot'] = '/home/%u'

‎spec/recipes/server_spec.rb‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -177,7 +177,7 @@
177177
context 'with attribute deny_users' do
178178
cached(:chef_run) do
179179
ChefSpec::ServerRunner.new do |node|
180-
node.normal['ssh-hardening']['ssh']['deny_users'] = %w(someuser)
180+
node.normal['ssh-hardening']['ssh']['server']['deny_users'] = %w(someuser)
181181
end.converge(described_recipe)
182182
end
183183

@@ -190,7 +190,7 @@
190190
context 'with attribute deny_users mutiple' do
191191
cached(:chef_run) do
192192
ChefSpec::ServerRunner.new do |node|
193-
node.normal['ssh-hardening']['ssh']['deny_users'] = %w(someuser otheruser)
193+
node.normal['ssh-hardening']['ssh']['server']['deny_users'] = %w(someuser otheruser)
194194
end.converge(described_recipe)
195195
end
196196

@@ -210,7 +210,7 @@
210210
context 'with attribute use_dns set to false' do
211211
cached(:chef_run) do
212212
ChefSpec::ServerRunner.new do |node|
213-
node.normal['ssh-hardening']['ssh']['use_dns'] = false
213+
node.normal['ssh-hardening']['ssh']['server']['use_dns'] = false
214214
end.converge(described_recipe)
215215
end
216216

@@ -223,7 +223,7 @@
223223
context 'with attribute use_dns set to true' do
224224
cached(:chef_run) do
225225
ChefSpec::ServerRunner.new do |node|
226-
node.normal['ssh-hardening']['ssh']['use_dns'] = true
226+
node.normal['ssh-hardening']['ssh']['server']['use_dns'] = true
227227
end.converge(described_recipe)
228228
end
229229

@@ -243,7 +243,7 @@
243243
context 'with attribute ["sftp"]["enable"] set to true' do
244244
cached(:chef_run) do
245245
ChefSpec::ServerRunner.new do |node|
246-
node.normal['ssh-hardening']['ssh']['sftp']['enable'] = true
246+
node.normal['ssh-hardening']['ssh']['server']['sftp']['enable'] = true
247247
end.converge(described_recipe)
248248
end
249249

@@ -256,8 +256,8 @@
256256
context 'with attribute ["sftp"]["enable"] set to true and ["sftp"]["group"] set to "testgroup"' do
257257
cached(:chef_run) do
258258
ChefSpec::ServerRunner.new do |node|
259-
node.normal['ssh-hardening']['ssh']['sftp']['enable'] = true
260-
node.normal['ssh-hardening']['ssh']['sftp']['group'] = 'testgroup'
259+
node.normal['ssh-hardening']['ssh']['server']['sftp']['enable'] = true
260+
node.normal['ssh-hardening']['ssh']['server']['sftp']['group'] = 'testgroup'
261261
end.converge(described_recipe)
262262
end
263263

@@ -270,8 +270,8 @@
270270
context 'with attribute ["sftp"]["enable"] set to true and ["sftp"]["chroot"] set to "/export/home/%u"' do
271271
cached(:chef_run) do
272272
ChefSpec::ServerRunner.new do |node|
273-
node.normal['ssh-hardening']['ssh']['sftp']['enable'] = true
274-
node.normal['ssh-hardening']['ssh']['sftp']['chroot'] = 'test_home_dir'
273+
node.normal['ssh-hardening']['ssh']['server']['sftp']['enable'] = true
274+
node.normal['ssh-hardening']['ssh']['server']['sftp']['chroot'] = 'test_home_dir'
275275
end.converge(described_recipe)
276276
end
277277

‎templates/default/openssh.conf.erb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
# Address family should always be limited to the active network configuration.
1515
AddressFamily <%= ((@node['ssh-hardening']['network']['ipv6']['enable']) ? "any" : "inet" ) %>
1616

17-
<% Array(@node['ssh-hardening']['ssh']['remote_hosts']).each do |host| %>
17+
<% Array(@node['ssh-hardening']['ssh']['client']['remote_hosts']).each do |host| %>
1818
# Restrict the following configuration to be limited to this Host.
1919
Host <%= host %>
2020
<% end %>

‎templates/default/opensshd.conf.erb‎

Lines changed: 30 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
# ===================
1313

1414
# Either disable or only allow root login via certificates.
15-
<% if @node['ssh-hardening']['ssh']['allow_root_with_key'] %>
15+
<% if @node['ssh-hardening']['ssh']['server']['allow_root_with_key'] %>
1616
PermitRootLogin without-password
1717
<% else %>
1818
PermitRootLogin no
@@ -27,12 +27,12 @@ Port <%= ssh_port %>
2727
AddressFamily <%= ((@node['ssh-hardening']['network']['ipv6']['enable']) ? "any" : "inet" ) %>
2828

2929
# Define which addresses sshd should listen to. Default to `0.0.0.0`, ie make sure you put your desired address in here, since otherwise sshd will listen to everyone.
30-
<% Array(@node['ssh-hardening']['ssh']['listen_to']).each do |ssh_ip| %>
30+
<% Array(@node['ssh-hardening']['ssh']['server']['listen_to']).each do |ssh_ip| %>
3131
ListenAddress <%= ssh_ip %>
3232
<% end %>
3333

3434
# List HostKeys here.
35-
<% Array(@node['ssh-hardening']['ssh']['host_key_files']).each do |host_key_file| %>
35+
<% Array(@node['ssh-hardening']['ssh']['server']['host_key_files']).each do |host_key_file| %>
3636
HostKey <%= host_key_file %> # Req 20
3737
<% end %>
3838

@@ -88,9 +88,9 @@ KexAlgorithms <%= @kex %>
8888
UseLogin no
8989
UsePrivilegeSeparation <%= @use_priv_sep %>
9090
PermitUserEnvironment no
91-
LoginGraceTime <%= @node['ssh-hardening']['ssh']['login_grace_time'] %>
92-
MaxAuthTries <%= @node['ssh-hardening']['ssh']['max_auth_tries'] %>
93-
MaxSessions <%= @node['ssh-hardening']['ssh']['max_sessions'] %>
91+
LoginGraceTime <%= @node['ssh-hardening']['ssh']['server']['login_grace_time'] %>
92+
MaxAuthTries <%= @node['ssh-hardening']['ssh']['server']['max_auth_tries'] %>
93+
MaxSessions <%= @node['ssh-hardening']['ssh']['server']['max_sessions'] %>
9494
MaxStartups 10:30:100
9595

9696
# Enable public key authentication
@@ -102,12 +102,12 @@ IgnoreUserKnownHosts yes
102102
HostbasedAuthentication no
103103

104104
# Enable PAM to enforce system wide rules
105-
UsePAM <%= ((@node['ssh-hardening']['ssh']['use_pam']) ? "yes" : "no" ) %>
105+
UsePAM <%= ((@node['ssh-hardening']['ssh']['server']['use_pam']) ? "yes" : "no" ) %>
106106
# Disable password-based authentication, it can allow for potentially easier brute-force attacks.
107107
<% passsword_auth = @node['ssh-hardening']['ssh']['server']['password_authentication'] || !!@node['ssh-hardening']['ssh']['password_authentication'] -%>
108108
PasswordAuthentication <%= (passsword_auth ? "yes" : "no" ) %>
109109
PermitEmptyPasswords no
110-
ChallengeResponseAuthentication <%= (@node['ssh-hardening']['ssh']['challenge_response_authentication'] ? "yes" : "no" ) %>
110+
ChallengeResponseAuthentication <%= (@node['ssh-hardening']['ssh']['server']['challenge_response_authentication'] ? "yes" : "no" ) %>
111111

112112
# Only enable Kerberos authentication if it is configured.
113113
KerberosAuthentication no
@@ -120,23 +120,23 @@ GSSAPIAuthentication no
120120
GSSAPICleanupCredentials yes
121121

122122
# In case you don't use PAM (`UsePAM no`), you can alternatively restrict users and groups here. For key-based authentication this is not necessary, since all keys must be explicitely enabled.
123-
<% unless @node['ssh-hardening']['ssh']['deny_users'].empty? %>
124-
DenyUsers <%= @node['ssh-hardening']['ssh']['deny_users'].join(' ') %>
123+
<% unless @node['ssh-hardening']['ssh']['server']['deny_users'].empty? %>
124+
DenyUsers <%= @node['ssh-hardening']['ssh']['server']['deny_users'].join(' ') %>
125125
<% else %>
126126
#DenyUsers *
127127
<% end %>
128-
<% unless @node['ssh-hardening']['ssh']['allow_users'].empty? %>
129-
AllowUsers <%= @node['ssh-hardening']['ssh']['allow_users'].join(' ') %>
128+
<% unless @node['ssh-hardening']['ssh']['server']['allow_users'].empty? %>
129+
AllowUsers <%= @node['ssh-hardening']['ssh']['server']['allow_users'].join(' ') %>
130130
<% else %>
131131
#AllowUsers user1
132132
<% end %>
133-
<% unless @node['ssh-hardening']['ssh']['deny_groups'].empty? %>
134-
DenyGroups <%= @node['ssh-hardening']['ssh']['deny_groups'].join(' ') %>
133+
<% unless @node['ssh-hardening']['ssh']['server']['deny_groups'].empty? %>
134+
DenyGroups <%= @node['ssh-hardening']['ssh']['server']['deny_groups'].join(' ') %>
135135
<% else %>
136136
#DenyGroups *
137137
<% end %>
138-
<% unless @node['ssh-hardening']['ssh']['allow_groups'].empty? %>
139-
AllowGroups <%= @node['ssh-hardening']['ssh']['allow_groups'].join(' ') %>
138+
<% unless @node['ssh-hardening']['ssh']['server']['allow_groups'].empty? %>
139+
AllowGroups <%= @node['ssh-hardening']['ssh']['server']['allow_groups'].join(' ') %>
140140
<% else %>
141141
#AllowGroups group1
142142
<% end %>
@@ -149,61 +149,61 @@ AllowGroups <%= @node['ssh-hardening']['ssh']['allow_groups'].join(' ') %>
149149
TCPKeepAlive no
150150

151151
# Manage `ClientAlive..` signals via interval and maximum count. This will periodically check up to a `..CountMax` number of times within `..Interval` timeframe, and abort the connection once these fail.
152-
ClientAliveInterval <%= @node['ssh-hardening']['ssh']['client_alive_interval'] %>
153-
ClientAliveCountMax <%= @node['ssh-hardening']['ssh']['client_alive_count'] %>
152+
ClientAliveInterval <%= @node['ssh-hardening']['ssh']['server']['client_alive_interval'] %>
153+
ClientAliveCountMax <%= @node['ssh-hardening']['ssh']['server']['client_alive_count'] %>
154154

155155
# Disable tunneling
156156
PermitTunnel no
157157

158158
# Disable forwarding tcp connections.
159159
# no real advantage without denied shell access
160-
AllowTcpForwarding <%= ((@node['ssh-hardening']['ssh']['allow_tcp_forwarding']) ? 'yes' : 'no' ) %>
160+
AllowTcpForwarding <%= ((@node['ssh-hardening']['ssh']['server']['allow_tcp_forwarding']) ? 'yes' : 'no' ) %>
161161

162162
# Disable agent formwarding, since local agent could be accessed through forwarded connection.
163163
# no real advantage without denied shell access
164-
AllowAgentForwarding <%= ((@node['ssh-hardening']['ssh']['allow_agent_forwarding']) ? 'yes' : 'no' ) %>
164+
AllowAgentForwarding <%= ((@node['ssh-hardening']['ssh']['server']['allow_agent_forwarding']) ? 'yes' : 'no' ) %>
165165

166166
# Do not allow remote port forwardings to bind to non-loopback addresses.
167167
GatewayPorts no
168168

169169
# Disable X11 forwarding, since local X11 display could be accessed through forwarded connection.
170-
X11Forwarding <%= ((@node['ssh-hardening']['ssh']['allow_x11_forwarding']) ? 'yes' : 'no' ) %>
170+
X11Forwarding <%= ((@node['ssh-hardening']['ssh']['server']['allow_x11_forwarding']) ? 'yes' : 'no' ) %>
171171
X11UseLocalhost yes
172172

173173

174174
# Misc. configuration
175175
# ===================
176176

177177

178-
PrintMotd <%= ((@node['ssh-hardening']['ssh']['print_motd']) ? 'yes' : 'no' ) %>
179-
PrintLastLog <%= ((@node['ssh-hardening']['ssh']['print_last_log']) ? 'yes' : 'no' ) %>
180-
Banner <%= @node['ssh-hardening']['ssh']['banner'] ? @node['ssh-hardening']['ssh']['banner'] : 'none' %>
178+
PrintMotd <%= ((@node['ssh-hardening']['ssh']['server']['print_motd']) ? 'yes' : 'no' ) %>
179+
PrintLastLog <%= ((@node['ssh-hardening']['ssh']['server']['print_last_log']) ? 'yes' : 'no' ) %>
180+
Banner <%= @node['ssh-hardening']['ssh']['server']['banner'] ? @node['ssh-hardening']['ssh']['server']['banner'] : 'none' %>
181181

182182
<% if @node['platform_family'] == 'debian' %>
183-
DebianBanner <%= @node['ssh-hardening']['ssh']['os_banner'] ? 'yes' : 'no' %>
183+
DebianBanner <%= @node['ssh-hardening']['ssh']['server']['os_banner'] ? 'yes' : 'no' %>
184184
<% end %>
185185

186-
<% if @node['ssh-hardening']['ssh']['use_dns'].nil? %>
186+
<% if @node['ssh-hardening']['ssh']['server']['use_dns'].nil? %>
187187
# Since OpenSSH 6.8, this value defaults to 'no'
188188
#UseDNS no
189189
<% else %>
190-
UseDNS <%= ((@node['ssh-hardening']['ssh']['use_dns']) ? 'yes' : 'no' ) %>
190+
UseDNS <%= ((@node['ssh-hardening']['ssh']['server']['use_dns']) ? 'yes' : 'no' ) %>
191191
<% end %>
192192
#PidFile /var/run/sshd.pid
193193
#MaxStartups 10
194194
#ChrootDirectory none
195195
#ChrootDirectory /home/%u
196196

197-
<% if @node['ssh-hardening']['ssh']['sftp']['enable'] %>
197+
<% if @node['ssh-hardening']['ssh']['server']['sftp']['enable'] %>
198198
# Configuration, in case SFTP is used
199199
## override default of no subsystems
200200
## Subsystem sftp /opt/app/openssh5/libexec/sftp-server
201201
Subsystem sftp internal-sftp -l VERBOSE
202202

203203
## These lines must appear at the *end* of sshd_config
204-
Match Group <%= @node['ssh-hardening']['ssh']['sftp']['group'] %>
204+
Match Group <%= @node['ssh-hardening']['ssh']['server']['sftp']['group'] %>
205205
ForceCommand internal-sftp -l VERBOSE
206-
ChrootDirectory <%= @node['ssh-hardening']['ssh']['sftp']['chroot'] %>
206+
ChrootDirectory <%= @node['ssh-hardening']['ssh']['server']['sftp']['chroot'] %>
207207
AllowTcpForwarding no
208208
AllowAgentForwarding no
209209
PasswordAuthentication no

0 commit comments

Comments
 (0)