Skip to content

Commit 71e661c

Browse files
bdwyertechbdwyertech
committed
Add support for extra configuration options & improve readability with block syntax
1 parent d4dc236 commit 71e661c

File tree

3 files changed

+73
-49
lines changed

3 files changed

+73
-49
lines changed

‎attributes/default.rb

+59-49
Original file line numberDiff line numberDiff line change
@@ -52,55 +52,65 @@
5252
default['ssh-hardening']['ssh']['ports'] = [22]
5353

5454
# ssh client
55-
default['ssh-hardening']['ssh']['client']['mac'] = nil # nil = calculate best combination for client
56-
default['ssh-hardening']['ssh']['client']['kex'] = nil # nil = calculate best combination for client
57-
default['ssh-hardening']['ssh']['client']['cipher'] = nil # nil = calculate best combination for client
58-
default['ssh-hardening']['ssh']['client']['cbc_required'] = false
59-
default['ssh-hardening']['ssh']['client']['weak_hmac'] = false
60-
default['ssh-hardening']['ssh']['client']['weak_kex'] = false
61-
default['ssh-hardening']['ssh']['client']['remote_hosts'] = []
62-
default['ssh-hardening']['ssh']['client']['password_authentication'] = false # ssh
63-
# http://undeadly.org/cgi?action=article&sid=20160114142733
64-
default['ssh-hardening']['ssh']['client']['roaming'] = false
65-
default['ssh-hardening']['ssh']['client']['send_env'] = ['LANG', 'LC_*', 'LANGUAGE']
55+
default['ssh-hardening']['ssh']['client'].tap do |client|
56+
client['mac'] = nil # nil = calculate best combination for client
57+
client['kex'] = nil # nil = calculate best combination for client
58+
client['cipher'] = nil # nil = calculate best combination for client
59+
client['cbc_required'] = false
60+
client['weak_hmac'] = false
61+
client['weak_kex'] = false
62+
client['remote_hosts'] = []
63+
client['password_authentication'] = false # ssh
64+
# http://undeadly.org/cgi?action=article&sid=20160114142733
65+
client['roaming'] = false
66+
client['send_env'] = ['LANG', 'LC_*', 'LANGUAGE']
67+
68+
# extra client configuration options
69+
client['extras'].tap = {}
70+
end
6671

6772
# sshd
68-
default['ssh-hardening']['ssh']['server']['kex'] = nil # nil = calculate best combination for server version
69-
default['ssh-hardening']['ssh']['server']['cipher'] = nil # nil = calculate best combination for server version
70-
default['ssh-hardening']['ssh']['server']['mac'] = nil # nil = calculate best combination for server version
71-
default['ssh-hardening']['ssh']['server']['cbc_required'] = false
72-
default['ssh-hardening']['ssh']['server']['weak_hmac'] = false
73-
default['ssh-hardening']['ssh']['server']['weak_kex'] = false
74-
default['ssh-hardening']['ssh']['server']['dh_min_prime_size'] = 2048
75-
default['ssh-hardening']['ssh']['server']['dh_build_primes'] = false
76-
default['ssh-hardening']['ssh']['server']['dh_build_primes_size'] = 4096
77-
default['ssh-hardening']['ssh']['server']['host_key_files'] = nil
78-
default['ssh-hardening']['ssh']['server']['client_alive_interval'] = 600 # 10min
79-
default['ssh-hardening']['ssh']['server']['client_alive_count'] = 3 # ~> 3 x interval
80-
default['ssh-hardening']['ssh']['server']['allow_root_with_key'] = false
81-
default['ssh-hardening']['ssh']['server']['allow_tcp_forwarding'] = false
82-
default['ssh-hardening']['ssh']['server']['allow_agent_forwarding'] = false
83-
default['ssh-hardening']['ssh']['server']['allow_x11_forwarding'] = false
84-
default['ssh-hardening']['ssh']['server']['use_pam'] = true
85-
default['ssh-hardening']['ssh']['server']['challenge_response_authentication'] = false
86-
default['ssh-hardening']['ssh']['server']['deny_users'] = []
87-
default['ssh-hardening']['ssh']['server']['allow_users'] = []
88-
default['ssh-hardening']['ssh']['server']['deny_groups'] = []
89-
default['ssh-hardening']['ssh']['server']['allow_groups'] = []
90-
default['ssh-hardening']['ssh']['server']['print_motd'] = false
91-
default['ssh-hardening']['ssh']['server']['print_last_log'] = false
92-
default['ssh-hardening']['ssh']['server']['banner'] = nil # set this to nil to disable banner or provide a path like '/etc/issue.net'
93-
default['ssh-hardening']['ssh']['server']['os_banner'] = false # (Debian OS family)
94-
default['ssh-hardening']['ssh']['server']['use_dns'] = nil # set this to nil to let us use the default OpenSSH in case it's not set by the user
95-
default['ssh-hardening']['ssh']['server']['use_privilege_separation'] = nil # set this to nil to let us detect the attribute based on the node platform
96-
default['ssh-hardening']['ssh']['server']['login_grace_time'] = '30s'
97-
default['ssh-hardening']['ssh']['server']['max_auth_tries'] = 2
98-
default['ssh-hardening']['ssh']['server']['max_sessions'] = 10
99-
default['ssh-hardening']['ssh']['server']['password_authentication'] = false
100-
default['ssh-hardening']['ssh']['server']['log_level'] = 'verbose'
101-
default['ssh-hardening']['ssh']['server']['accept_env'] = ['LANG', 'LC_*', 'LANGUAGE']
73+
default['ssh-hardening']['ssh']['server'].tap do |server| # rubocop: disable BlockLength
74+
server['kex'] = nil # nil = calculate best combination for server version
75+
server['cipher'] = nil # nil = calculate best combination for server version
76+
server['mac'] = nil # nil = calculate best combination for server version
77+
server['cbc_required'] = false
78+
server['weak_hmac'] = false
79+
server['weak_kex'] = false
80+
server['dh_min_prime_size'] = 2048
81+
server['dh_build_primes'] = false
82+
server['dh_build_primes_size'] = 4096
83+
server['host_key_files'] = nil
84+
server['client_alive_interval'] = 600 # 10min
85+
server['client_alive_count'] = 3 # ~> 3 x interval
86+
server['allow_root_with_key'] = false
87+
server['allow_tcp_forwarding'] = false
88+
server['allow_agent_forwarding'] = false
89+
server['allow_x11_forwarding'] = false
90+
server['use_pam'] = true
91+
server['challenge_response_authentication'] = false
92+
server['deny_users'] = []
93+
server['allow_users'] = []
94+
server['deny_groups'] = []
95+
server['allow_groups'] = []
96+
server['print_motd'] = false
97+
server['print_last_log'] = false
98+
server['banner'] = nil # set this to nil to disable banner or provide a path like '/etc/issue.net'
99+
server['os_banner'] = false # (Debian OS family)
100+
server['use_dns'] = nil # set this to nil to let us use the default OpenSSH in case it's not set by the user
101+
server['use_privilege_separation'] = nil # set this to nil to let us detect the attribute based on the node platform
102+
server['login_grace_time'] = '30s'
103+
server['max_auth_tries'] = 2
104+
server['max_sessions'] = 10
105+
server['password_authentication'] = false
106+
server['log_level'] = 'verbose'
107+
server['accept_env'] = ['LANG', 'LC_*', 'LANGUAGE']
102108

103-
# sshd sftp options
104-
default['ssh-hardening']['ssh']['server']['sftp']['enable'] = false
105-
default['ssh-hardening']['ssh']['server']['sftp']['group'] = 'sftponly'
106-
default['ssh-hardening']['ssh']['server']['sftp']['chroot'] = '/home/%u'
109+
# extra server configuration options
110+
server['extras'] = {}
111+
112+
# sshd sftp options
113+
server['sftp']['enable'] = false
114+
server['sftp']['group'] = 'sftponly'
115+
server['sftp']['chroot'] = '/home/%u'
116+
end

‎templates/default/openssh.conf.erb

+7
Original file line numberDiff line numberDiff line change
@@ -117,3 +117,10 @@ UseRoaming <%= @node['ssh-hardening']['ssh']['client']['roaming'] ? 'yes' : 'no'
117117
# Send locale environment variables
118118
SendEnv <%= @node['ssh-hardening']['ssh']['client']['send_env'].join(' ') %>
119119
<% end %>
120+
121+
<%- unless Array(@node['ssh-hardening']['ssh']['client']['extras']).empty? %>
122+
# Extra Configuration Options
123+
<%- Array(@node['ssh-hardening']['ssh']['client']['extras']).each do |key, value| %>
124+
<%= key %> <%= value %>
125+
<% end -%>
126+
<% end -%>

‎templates/default/opensshd.conf.erb

+7
Original file line numberDiff line numberDiff line change
@@ -229,3 +229,10 @@ X11Forwarding no
229229
#PermitRootLogin no
230230
#X11Forwarding no
231231
<% end %>
232+
233+
<%- unless Array(@node['ssh-hardening']['ssh']['server']['extras']).empty? %>
234+
# Extra Configuration Options
235+
<%- Array(@node['ssh-hardening']['ssh']['server']['extras']).each do |key, value| %>
236+
<%= key %> <%= value %>
237+
<% end -%>
238+
<% end -%>

0 commit comments

Comments
 (0)