wallenstein/algo
1
0
Fork 0
mirror of https://github.com/trailofbits/algo.git synced 2025-06-07 07:33:52 +02:00
Code Issues Projects Releases Wiki Activity

1. Disable SSH key deploying if installation on existing server

Browse source 
2. Move to the ed25519 algorithm
3. Delete unneeded option RSAAuthentication
Fixes #272
This commit is contained in:
Jack Ivanov 2017-04-09 20:39:22 +02:00
parent e55ce03906
commit 95e0134f21
3 changed files with 3 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
playbooks/common.yml
View file

@ -17,4 +17,4 @@
user: "{{ ansible_ssh_user }}" user: "{{ ansible_ssh_user }}"
state: present state: present
key: "{{ lookup('file', '{{ SSH_keys.public }}') }}" key: "{{ lookup('file', '{{ SSH_keys.public }}') }}"
tags: [ 'always' ] tags: [ 'cloud' ]

5
playbooks/local.yml
View file

@ -1,14 +1,13 @@
--- ---
- name: Generate the SSH private key - name: Generate the SSH private key
local_action: shell echo -e 'n' | ssh-keygen -b 2048 -C {{ SSH_keys.comment }} -t rsa -f {{ SSH_keys.private }} -q -N "" local_action: shell echo -e 'n' | ssh-keygen -C {{ SSH_keys.comment }} -t ed25519 -f {{ SSH_keys.private }} -q -N ""
args: args:
creates: "{{ SSH_keys.private }}" creates: "{{ SSH_keys.private }}"
- name: Generate the SSH public key - name: Generate the SSH public key
local_action: shell echo `ssh-keygen -y -f {{ SSH_keys.private }}` {{ SSH_keys.comment }} > {{ SSH_keys.public }} local_action: shell echo `ssh-keygen -y -f {{ SSH_keys.private }}` {{ SSH_keys.comment }} > {{ SSH_keys.public }}
args: changed_when: false
creates: "{{ SSH_keys.public }}"
- name: Change mode for the SSH private key - name: Change mode for the SSH private key
local_action: file path={{ SSH_keys.private }} mode=0600 local_action: file path={{ SSH_keys.private }} mode=0600

2
roles/security/templates/sshd_config.j2
View file

@ -26,7 +26,6 @@ AcceptEnv LANG LC_*
# Turn off a lot of features # Turn off a lot of features
IgnoreRhosts yes IgnoreRhosts yes
RhostsRSAAuthentication no RhostsRSAAuthentication no
RSAAuthentication no
HostbasedAuthentication no HostbasedAuthentication no
PermitEmptyPasswords no PermitEmptyPasswords no
ChallengeResponseAuthentication no ChallengeResponseAuthentication no
@ -53,4 +52,3 @@ MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@op
# HostKeyAlgorithms ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519 # HostKeyAlgorithms ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519
# TODO: I haven't seen anyone review these yet # TODO: I haven't seen anyone review these yet
# PubkeyAcceptedKeyTypes ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519 # PubkeyAcceptedKeyTypes ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519