From ec80c928255b3886aa2268398ccbbe4279004cff Mon Sep 17 00:00:00 2001 From: jeaye Date: Thu, 16 Nov 2017 20:16:06 -0800 Subject: nixos/ssh: Remove support for old host keys --- nixos/modules/services/networking/ssh/sshd.nix | 13 ------------- 1 file changed, 13 deletions(-) (limited to 'nixos') diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix index 8828429a8178b..a249f01421768 100644 --- a/nixos/modules/services/networking/ssh/sshd.nix +++ b/nixos/modules/services/networking/ssh/sshd.nix @@ -54,8 +54,6 @@ let )); in listToAttrs (map mkAuthKeyFile usersWithKeys); - supportOldHostKeys = !versionAtLeast config.system.stateVersion "15.07"; - in { @@ -191,9 +189,6 @@ in default = [ { type = "rsa"; bits = 4096; path = "/etc/ssh/ssh_host_rsa_key"; } { type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; } - ] ++ optionals supportOldHostKeys - [ { type = "dsa"; path = "/etc/ssh/ssh_host_dsa_key"; } - { type = "ecdsa"; bits = 521; path = "/etc/ssh/ssh_host_ecdsa_key"; } ]; description = '' NixOS can automatically generate SSH host keys. This option @@ -363,14 +358,6 @@ in HostKey ${k.path} '')} - # Allow DSA client keys for now. (These were deprecated - # in OpenSSH 7.0.) - PubkeyAcceptedKeyTypes +ssh-dss - - # Re-enable DSA host keys for now. - ${optionalString supportOldHostKeys '' - HostKeyAlgorithms +ssh-dss - ''} ''; assertions = [{ assertion = if cfg.forwardX11 then cfgc.setXAuthLocation else true; -- cgit 1.4.1 From 2a8bd9e2a11a8e69448682d8f8289ea021246354 Mon Sep 17 00:00:00 2001 From: jeaye Date: Thu, 16 Nov 2017 20:19:42 -0800 Subject: nixos/ssh: Harden config defaults --- nixos/modules/services/networking/ssh/sshd.nix | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'nixos') diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix index a249f01421768..6c4dcfeda064b 100644 --- a/nixos/modules/services/networking/ssh/sshd.nix +++ b/nixos/modules/services/networking/ssh/sshd.nix @@ -358,6 +358,21 @@ in HostKey ${k.path} '')} + ### Recommended settings from both: + # https://stribika.github.io/2015/01/04/secure-secure-shell.html + # and + # https://wiki.mozilla.org/Security/Guidelines/OpenSSH#Modern_.28OpenSSH_6.7.2B.29 + + KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256 + Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr + MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com + + # LogLevel VERBOSE logs user's key fingerprint on login. + # Needed to have a clear audit track of which key was used to log in. + LogLevel VERBOSE + + # Use kernel sandbox mechanisms where possible in unprivileged processes. + UsePrivilegeSeparation sandbox ''; assertions = [{ assertion = if cfg.forwardX11 then cfgc.setXAuthLocation else true; -- cgit 1.4.1 From 03f7adfdd13ba04619ab6e6bdb7448894494c58e Mon Sep 17 00:00:00 2001 From: jeaye Date: Sat, 18 Nov 2017 15:26:05 -0800 Subject: nixos/ssh: Update 18.03 release notes Since ssh-dss is no longer supported by default, users relying on those keys for their login may be locked out. They should ideally use stronger keys, but adding the support for ssh-dss back in can also be done through extraConfig. --- nixos/doc/manual/release-notes/rl-1803.xml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) (limited to 'nixos') diff --git a/nixos/doc/manual/release-notes/rl-1803.xml b/nixos/doc/manual/release-notes/rl-1803.xml index c1fe692ceecba..b0e29182127ef 100644 --- a/nixos/doc/manual/release-notes/rl-1803.xml +++ b/nixos/doc/manual/release-notes/rl-1803.xml @@ -72,6 +72,29 @@ following incompatible changes: . + + + + The OpenSSH service no longer enables support for DSA keys by default, + which could cause a system lock out. Update your keys or, unfavorably, + re-enable DSA support manually. + + + + + DSA support was + deprecated in OpenSSH 7.0, + due to it being too weak. To re-enable support, add + PubkeyAcceptedKeyTypes +ssh-dss to the end of your + . + + + + After updating the keys to be stronger, anyone still on a pre-17.03 + version is safe to jump to 17.03, as vetted + here. + + -- cgit 1.4.1