337 lines
9.9 KiB
Go
337 lines
9.9 KiB
Go
/*
|
|
SSHSecure - a program to harden OpenSSH from defaults
|
|
Copyright (C) 2020 Brent Saner
|
|
|
|
This program is free software: you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License as published by
|
|
the Free Software Foundation, either version 3 of the License, or
|
|
(at your option) any later version.
|
|
|
|
This program is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
along with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
package config
|
|
|
|
const (
|
|
// To check if this release of SSHSecure is up-to-date with the default values.
|
|
// upstreamSshdURL string = "https://anongit.mindrot.org/openssh.git/plain/sshd_config"
|
|
upstreamSshdURL string = "https://raw.githubusercontent.com/openssh/openssh-portable/master/sshd_config"
|
|
upstreamSshdCksum string = "952C844D7B36C54B03E2ADFB24860405" +
|
|
"1A702620A0ADC0738A8C30DC83D42A75" +
|
|
"27F5B3C184E779B1430168950F7695A1" +
|
|
"AA249F7CC719DEC1631ACFDDC2E8B653"
|
|
// upstreamSshURL string = "https://anongit.mindrot.org/openssh.git/plain/ssh_config"
|
|
upstreamSshURL string = "https://raw.githubusercontent.com/openssh/openssh-portable/master/ssh_config"
|
|
upstreamSshCksum string = "FF2D600465CC5D9CFBB57346491CCAF2" +
|
|
"C917E2F0C7B4D4EF6B851940948B55BD" +
|
|
"88205AC8153210ECA6C6BEA38E800F33" +
|
|
"7562C0190AE760220417A5DC2E00A5E1"
|
|
)
|
|
|
|
// These are items that this program modifies.
|
|
var (
|
|
// sshdModify are values we modify.
|
|
sshdModify = [...]string{
|
|
"AuthenticationMethods",
|
|
"ChallengeResponseAuthentication",
|
|
"Ciphers",
|
|
"HostKey",
|
|
"HostKeyAlgorithms",
|
|
"KexAlgorithms",
|
|
"MACs",
|
|
"PasswordAuthentication",
|
|
"PermitEmptyPasswords",
|
|
"PermitRootLogin",
|
|
"PrintLastLog",
|
|
"Protocol",
|
|
"PubkeyAuthentication",
|
|
"StrictModes",
|
|
}
|
|
|
|
// sshModify are values we modify.
|
|
sshModify = [...]string{""}
|
|
)
|
|
|
|
// These are collections of long lists of valid values.
|
|
var (
|
|
// sshdMulti are values that can be specified multiple times (multiple lines).
|
|
sshdMulti = [...]string{
|
|
"",
|
|
}
|
|
|
|
sshMulti = [...]string{
|
|
"IdentityFile",
|
|
}
|
|
|
|
// authMethods are authentication methods that openssh supports.
|
|
authMethods = []string{
|
|
"any",
|
|
"keyboard-interactive",
|
|
"keyboard-interactive:bsdauth",
|
|
"keyboard-interactive:pam",
|
|
"gssapi-with-mic",
|
|
"hostbased",
|
|
"none",
|
|
"password",
|
|
"publickey",
|
|
}
|
|
|
|
// ciphers are cipher algorithms that openssh supports.
|
|
ciphers = []string{
|
|
"3des-cbc",
|
|
"aes128-cbc",
|
|
"aes192-cbc",
|
|
"aes256-cbc",
|
|
"aes128-ctr",
|
|
"aes192-ctr",
|
|
"aes256-ctr",
|
|
"aes128-gcm@openssh.com",
|
|
"aes256-gcm@openssh.com",
|
|
"chacha20-poly1305@openssh.com",
|
|
}
|
|
|
|
// forwardAllows are shared values used by forwarding access control.
|
|
forwardAllows = []string{"yes", "all", "no", "local", "remote"}
|
|
|
|
// keyTypes are algorithms/types used for host keys and client pubkeys.
|
|
// The following should generate the same list.
|
|
// ssh -Q HostKeyAlgorithms | sed -re 's/^/"/g' -e 's/$/",/g'
|
|
// ssh -Q HostbasedAcceptedKeyTypes | sed -re 's/^/"/g' -e 's/$/",/g'
|
|
// ssh -Q PubkeyAcceptedKeyTypes | sed -re 's/^/"/g' -e 's/$/",/g'
|
|
// ssh -Q HostbasedKeyTypes | sed -re 's/^/"/g' -e 's/$/",/g'
|
|
keyTypes = []string{
|
|
"ssh-ed25519",
|
|
"ssh-ed25519-cert-v01@openssh.com",
|
|
"sk-ssh-ed25519@openssh.com",
|
|
"sk-ssh-ed25519-cert-v01@openssh.com",
|
|
"ssh-rsa",
|
|
"rsa-sha2-256",
|
|
"rsa-sha2-512",
|
|
"ssh-dss",
|
|
"ecdsa-sha2-nistp256",
|
|
"ecdsa-sha2-nistp384",
|
|
"ecdsa-sha2-nistp521",
|
|
"sk-ecdsa-sha2-nistp256@openssh.com",
|
|
"ssh-rsa-cert-v01@openssh.com",
|
|
"rsa-sha2-256-cert-v01@openssh.com",
|
|
"rsa-sha2-512-cert-v01@openssh.com",
|
|
"ssh-dss-cert-v01@openssh.com",
|
|
"ecdsa-sha2-nistp256-cert-v01@openssh.com",
|
|
"ecdsa-sha2-nistp384-cert-v01@openssh.com",
|
|
"ecdsa-sha2-nistp521-cert-v01@openssh.com",
|
|
"sk-ecdsa-sha2-nistp256-cert-v01@openssh.com",
|
|
}
|
|
|
|
// ipQoS is a list of valid QoS profiles.
|
|
ipQoS = []string{
|
|
// This also supports a "numeric value" per sshd_config(5),
|
|
// but I have no idea what those values are, their range, etc.
|
|
// So strings only. Makes for more readable configs anyways.
|
|
// TODO: is this specified in the source anywhere?
|
|
"af11",
|
|
"af12",
|
|
"af13",
|
|
"af21",
|
|
"af22",
|
|
"af23",
|
|
"af31",
|
|
"af32",
|
|
"af33",
|
|
"af41",
|
|
"af42",
|
|
"af43",
|
|
"cs0",
|
|
"cs1",
|
|
"cs2",
|
|
"cs3",
|
|
"cs4",
|
|
"cs5",
|
|
"cs6",
|
|
"cs7",
|
|
"ef",
|
|
"le",
|
|
"lowdelay",
|
|
"throughput",
|
|
"reliability",
|
|
"none",
|
|
}
|
|
|
|
// kexAlgos is a lost of valid kex ("KEy eXchange") algorithms.
|
|
// ssh -Q kex | sed -re 's/^/"/g' -e 's/$/",/g'
|
|
kexAlgos = []string{
|
|
"diffie-hellman-group1-sha1",
|
|
"diffie-hellman-group14-sha1",
|
|
"diffie-hellman-group14-sha256",
|
|
"diffie-hellman-group16-sha512",
|
|
"diffie-hellman-group18-sha512",
|
|
"diffie-hellman-group-exchange-sha1",
|
|
"diffie-hellman-group-exchange-sha256",
|
|
"ecdh-sha2-nistp256",
|
|
"ecdh-sha2-nistp384",
|
|
"ecdh-sha2-nistp521",
|
|
"curve25519-sha256",
|
|
"curve25519-sha256@libssh.org",
|
|
"sntrup4591761x25519-sha512@tinyssh.org",
|
|
}
|
|
|
|
// sigAlgos is a list of valid algorithms for CA signatures.
|
|
sigAlgos = []string{
|
|
// These are the defaults. TODO: are any others valid?
|
|
"ecdsa-sha2-nistp256",
|
|
"ecdsa-sha2-nistp384",
|
|
"ecdsa-sha2-nistp521",
|
|
"ssh-ed25519",
|
|
"rsa-sha2-512",
|
|
"rsa-sha2-256",
|
|
"ssh-rsa",
|
|
}
|
|
|
|
// logLevels is a list of valid LogLevel levels.
|
|
logLevels = []string{
|
|
"QUIET",
|
|
"FATAL",
|
|
"ERROR",
|
|
"INFO", // default
|
|
"VERBOSE",
|
|
"DEBUG", // same as DEBUG1
|
|
"DEBUG1", // same as DEBUG
|
|
"DEBUG2",
|
|
"DEBUG3",
|
|
}
|
|
|
|
// logFacilities is a list of valid syslog facilities.
|
|
logFacilities = []string{
|
|
"DAEMON",
|
|
"USER",
|
|
"AUTH", // default
|
|
"LOCAL0",
|
|
"LOCAL1",
|
|
"LOCAL2",
|
|
"LOCAL3",
|
|
"LOCAL4",
|
|
"LOCAL5",
|
|
"LOCAL6",
|
|
"LOCAL7",
|
|
}
|
|
|
|
// macAlgos is a list of valid MAC (Message Authentication Code) values. "-etm" algos are recommended by upstream.
|
|
// ssh -Q mac | sed -re 's/^/"/g' -e 's/$/",/g'
|
|
macAlgos = []string{
|
|
"hmac-sha1",
|
|
"hmac-sha1-96",
|
|
"hmac-sha2-256",
|
|
"hmac-sha2-512",
|
|
"hmac-md5",
|
|
"hmac-md5-96",
|
|
"umac-64@openssh.com",
|
|
"umac-128@openssh.com",
|
|
"hmac-sha1-etm@openssh.com",
|
|
"hmac-sha1-96-etm@openssh.com",
|
|
"hmac-sha2-256-etm@openssh.com",
|
|
"hmac-sha2-512-etm@openssh.com",
|
|
"hmac-md5-etm@openssh.com",
|
|
"hmac-md5-96-etm@openssh.com",
|
|
"umac-64-etm@openssh.com",
|
|
"umac-128-etm@openssh.com",
|
|
}
|
|
)
|
|
|
|
// This is a collection related to Match blocks.
|
|
var (
|
|
// sshdMatchCriteria is a list of valid criteria that can be used in a Match block.
|
|
// Valid keys for sshdMatchCriteria are tracked via field names in SshdMatchRule.
|
|
// Multiple criteria can be specified by e.g. "Match User foo, Host bar.tld"
|
|
sshdMatchCriteria = []string{
|
|
"Address",
|
|
"All",
|
|
"User",
|
|
"Group",
|
|
"Host",
|
|
"LocalAddress",
|
|
"LocalPort",
|
|
"RDomain",
|
|
}
|
|
|
|
// sshMatchCriteria is a list of valid criteria that can be used in a Match or Host block.
|
|
// Valid keys for sshMatchCriteria are tracked via field names in SshMatchRule.
|
|
// Multiple criteria can be specified by e.g. "Match User foo, Host bar.tld"
|
|
sshMatchCriteria = []string{
|
|
"all", // Must appear alone, or immediately after canonical/final.
|
|
"canonical",
|
|
"exec", // Requires second argument.
|
|
"final",
|
|
"host", // Requires second argument.
|
|
"localuser", // Requires second argument.
|
|
"originalhost", // Requires second argument.
|
|
"user", // Requires second argument.
|
|
}
|
|
)
|
|
|
|
// The following are validator maps.
|
|
var (
|
|
// These directives can also begin with "+", "-", or "^", so they need to be stripped off.
|
|
// TODO: How to do this non-destructively and cleanly?
|
|
// Currently we just save the struct field's first item with the prefix and strip it in a local var for validating.
|
|
sshdStripPre = []string{
|
|
"HostbasedAcceptedKeyTypes",
|
|
"KexAlgorithms",
|
|
}
|
|
sshStripPre = []string{
|
|
"HostbasedKeyTypes",
|
|
"KexAlgorithms",
|
|
}
|
|
|
|
// validSshdSingleVals are values that can accept a single string value from a static list.
|
|
validSshdSingleVals = map[string][]string{
|
|
"AddressFamily": {"any", "inet", "inet6"},
|
|
"AllowStreamLocalForwarding": forwardAllows,
|
|
"AllowTcpForwarding": forwardAllows,
|
|
"Compression": {"yes", "delayed", "no"}, // "delayed" is legacy, same as "yes".
|
|
"FingerprintHash": {"sha256", "md5"},
|
|
"GatewayPorts": {"yes", "no", "clientspecified"},
|
|
"HostbasedAcceptedKeyTypes": keyTypes,
|
|
"IgnoreRHosts": {"yes", "shosts-only", "no"},
|
|
"LogLevel": logLevels,
|
|
"PermitRootLogin": {"yes", "prohibit-password", "forced-commands-only", "no"}, // "without-password" is deprecated.
|
|
"PermitTunnel": {"yes", "point-to-point", "ethernet", "no"},
|
|
"PubkeyAuthOptions": {"none", "touch-required"},
|
|
"SyslogFacility": logFacilities,
|
|
}
|
|
|
|
// validSshdMultiVals are values that can accept multiple values from a static list.
|
|
validSshdMultiVals = map[string][]string{
|
|
"AuthenticationMethods": authMethods,
|
|
"CASignatureAlgorithms": sigAlgos,
|
|
"Ciphers": ciphers,
|
|
"HostbasedAcceptedKeyTypes": keyTypes,
|
|
"HostKeyAlgorithms": keyTypes,
|
|
"KexAlgorithms": kexAlgos,
|
|
"MACs": macAlgos,
|
|
"PubkeyAcceptedKeyTypes": keyTypes,
|
|
}
|
|
|
|
// validSshSingleVals are values that can accept a single string value from a static list.
|
|
validSshSingleVals = map[string][]string{
|
|
"AddKeysToAgent": {"yes", "ask", "confirm", "no"},
|
|
"AddressFamily": {"any", "inet", "inet6"},
|
|
"ControlMaster": {"ask", "yes", "no", "autoask", "auto"},
|
|
"FingerprintHash": {"sha256", "md5"},
|
|
}
|
|
|
|
// validSshMultiVals are values that can accept multiple values from a static list.
|
|
validSshMultiVals = map[string][]string{
|
|
"CASignatureAlgorithms": sigAlgos,
|
|
"Ciphers": ciphers,
|
|
"HostbasedKeyTypes": keyTypes,
|
|
"HostKeyAlgorithms": keyTypes,
|
|
"KbdInteractiveDevices": {"bsdauth", "pam"},
|
|
"KexAlgorithms": kexAlgos,
|
|
}
|
|
)
|