From 26f6de19d30cc942d863761e2f127fb112ada1d3 Mon Sep 17 00:00:00 2001 From: Sean Knox Date: Fri, 10 Aug 2018 13:46:09 -0700 Subject: [PATCH] harden SSH: kex/ciphers/MACS + disable X11 forwarding (#3612) --- parts/k8s/kubernetesagentcustomdata.yml | 7 +++ parts/k8s/kubernetesmastercustomdata.yml | 7 +++ parts/k8s/kubernetesmastervars.t | 1 + parts/k8s/sshd_config | 77 ++++++++++++++++++++++++ pkg/acsengine/const.go | 1 + pkg/acsengine/template_generator.go | 3 + 6 files changed, 96 insertions(+) create mode 100644 parts/k8s/sshd_config diff --git a/parts/k8s/kubernetesagentcustomdata.yml b/parts/k8s/kubernetesagentcustomdata.yml index 7a25b18c8f..c992a619fa 100644 --- a/parts/k8s/kubernetesagentcustomdata.yml +++ b/parts/k8s/kubernetesagentcustomdata.yml @@ -8,6 +8,13 @@ write_files: content: !!binary | {{WrapAsVariable "provisionSource"}} +- path: "/etc/ssh/sshd_config" + permissions: "0644" + encoding: gzip + owner: "root" + content: !!binary | + {{WrapAsVariable "sshdConfig"}} + {{if .KubernetesConfig.RequiresDocker}} {{if not .IsCoreOS}} - path: "/etc/systemd/system/docker.service.d/clear_mount_propagation_flags.conf" diff --git a/parts/k8s/kubernetesmastercustomdata.yml b/parts/k8s/kubernetesmastercustomdata.yml index 7601016394..c17d9ede04 100644 --- a/parts/k8s/kubernetesmastercustomdata.yml +++ b/parts/k8s/kubernetesmastercustomdata.yml @@ -14,6 +14,13 @@ write_files: content: !!binary | {{WrapAsVariable "provisionSource"}} +- path: "/etc/ssh/sshd_config" + permissions: "0644" + encoding: gzip + owner: "root" + content: !!binary | + {{WrapAsVariable "sshdConfig"}} + {{if .OrchestratorProfile.KubernetesConfig.RequiresDocker}} {{if not .MasterProfile.IsCoreOS}} - path: "/etc/systemd/system/docker.service.d/clear_mount_propagation_flags.conf" diff --git a/parts/k8s/kubernetesmastervars.t b/parts/k8s/kubernetesmastervars.t index 5e797b7c63..e3e39043a0 100644 --- a/parts/k8s/kubernetesmastervars.t +++ b/parts/k8s/kubernetesmastervars.t @@ -128,6 +128,7 @@ "provisionSource": "{{GetKubernetesB64ProvisionSource}}", "mountetcdScript": "{{GetKubernetesB64Mountetcd}}", "customSearchDomainsScript": "{{GetKubernetesB64CustomSearchDomainsScript}}", + "sshdConfig": "{{GetB64sshdConfig}}", {{if not IsOpenShift}} {{if not IsHostedMaster}} "provisionScriptParametersMaster": "[concat('MASTER_VM_NAME=',variables('masterVMNames')[variables('masterOffset')],' ETCD_PEER_URL=',variables('masterEtcdPeerURLs')[variables('masterOffset')],' ETCD_CLIENT_URL=',variables('masterEtcdClientURLs')[variables('masterOffset')],' MASTER_NODE=true CLUSTER_AUTOSCALER_ADDON=',parameters('kubernetesClusterAutoscalerEnabled'),' ACI_CONNECTOR_ADDON=',parameters('kubernetesACIConnectorEnabled'),' APISERVER_PRIVATE_KEY=',parameters('apiServerPrivateKey'),' CA_CERTIFICATE=',parameters('caCertificate'),' CA_PRIVATE_KEY=',parameters('caPrivateKey'),' MASTER_FQDN=',variables('masterFqdnPrefix'),' KUBECONFIG_CERTIFICATE=',parameters('kubeConfigCertificate'),' KUBECONFIG_KEY=',parameters('kubeConfigPrivateKey'),' ETCD_SERVER_CERTIFICATE=',parameters('etcdServerCertificate'),' ETCD_CLIENT_CERTIFICATE=',parameters('etcdClientCertificate'),' ETCD_SERVER_PRIVATE_KEY=',parameters('etcdServerPrivateKey'),' ETCD_CLIENT_PRIVATE_KEY=',parameters('etcdClientPrivateKey'),' ETCD_PEER_CERTIFICATES=',string(variables('etcdPeerCertificates')),' ETCD_PEER_PRIVATE_KEYS=',string(variables('etcdPeerPrivateKeys')))]", diff --git a/parts/k8s/sshd_config b/parts/k8s/sshd_config new file mode 100644 index 0000000000..29a8c9cab9 --- /dev/null +++ b/parts/k8s/sshd_config @@ -0,0 +1,77 @@ +# What ports, IPs and protocols we listen for +Port 22 +# Use these options to restrict which interfaces/protocols sshd will bind to +#ListenAddress :: +#ListenAddress 0.0.0.0 +Protocol 2 +# HostKeys for protocol version 2 +HostKey /etc/ssh/ssh_host_rsa_key +HostKey /etc/ssh/ssh_host_dsa_key +HostKey /etc/ssh/ssh_host_ecdsa_key +HostKey /etc/ssh/ssh_host_ed25519_key + +KexAlgorithms curve25519-sha256@libssh.org +Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr +MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com + +#Privilege Separation is turned on for security +UsePrivilegeSeparation yes + +# Lifetime and size of ephemeral version 1 server key +KeyRegenerationInterval 3600 +ServerKeyBits 1024 + +# Logging +SyslogFacility AUTH +LogLevel INFO + +# Authentication: +LoginGraceTime 120 +PermitRootLogin prohibit-password +StrictModes yes + +RSAAuthentication yes +PubkeyAuthentication yes + +# Don't read the user's ~/.rhosts and ~/.shosts files +IgnoreRhosts yes +# For this to work you will also need host keys in /etc/ssh_known_hosts +RhostsRSAAuthentication no +# similar for protocol version 2 +HostbasedAuthentication no + +# To enable empty passwords, change to yes (NOT RECOMMENDED) +PermitEmptyPasswords no + +# Change to yes to enable challenge-response passwords (beware issues with +# some PAM modules and threads) +ChallengeResponseAuthentication no + +# Change to no to disable tunnelled clear text passwords +PasswordAuthentication no + +X11Forwarding no +X11DisplayOffset 10 +PrintMotd no +PrintLastLog yes +TCPKeepAlive yes +#UseLogin no + +# Allow client to pass locale environment variables +AcceptEnv LANG LC_* + +Subsystem sftp /usr/lib/openssh/sftp-server + +# Set this to 'yes' to enable PAM authentication, account processing, +# and session processing. If this is enabled, PAM authentication will +# be allowed through the ChallengeResponseAuthentication and +# PasswordAuthentication. Depending on your PAM configuration, +# PAM authentication via ChallengeResponseAuthentication may bypass +# the setting of "PermitRootLogin without-password". +# If you just want the PAM account and session checks to run without +# PAM authentication, then enable this but set PasswordAuthentication +# and ChallengeResponseAuthentication to 'no'. +UsePAM yes + +# CLOUD_IMG: This file was created/modified by the Cloud Image build process +ClientAliveInterval 120 diff --git a/pkg/acsengine/const.go b/pkg/acsengine/const.go index bbecaf59f9..26a89c9d41 100644 --- a/pkg/acsengine/const.go +++ b/pkg/acsengine/const.go @@ -217,6 +217,7 @@ const ( openshiftMasterScript = "openshift/unstable/openshiftmasterscript.sh" openshift39NodeScript = "openshift/release-3.9/openshiftnodescript.sh" openshift39MasterScript = "openshift/release-3.9/openshiftmasterscript.sh" + sshdConfig = "k8s/sshd_config" ) const ( diff --git a/pkg/acsengine/template_generator.go b/pkg/acsengine/template_generator.go index ba88a58652..1df678bee4 100644 --- a/pkg/acsengine/template_generator.go +++ b/pkg/acsengine/template_generator.go @@ -538,6 +538,9 @@ func (t *TemplateGenerator) getTemplateFuncMap(cs *api.ContainerService) templat "GetKubernetesB64GenerateProxyCerts": func() string { return getBase64CustomScript(kubernetesMasterGenerateProxyCertsScript) }, + "GetB64sshdConfig": func() string { + return getBase64CustomScript(sshdConfig) + }, "GetKubernetesMasterPreprovisionYaml": func() string { str := "" if cs.Properties.MasterProfile.PreprovisionExtension != nil {