Skip to content
This repository has been archived by the owner on Jan 11, 2023. It is now read-only.

harden SSH: kex/ciphers/MACS + disable X11 forwarding #3612

Merged
merged 2 commits into from
Aug 10, 2018
Merged

harden SSH: kex/ciphers/MACS + disable X11 forwarding #3612

merged 2 commits into from
Aug 10, 2018

Conversation

seanknox
Copy link
Contributor

@seanknox seanknox commented Aug 3, 2018

What this PR does / why we need it: harden SSH. specifically, it implements best practices for SSH key exchange, ciphers, and MACs. Also disables X11 forwarding.

Which issue this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close that issue when PR gets merged): fixes #

Special notes for your reviewer:

If applicable:

  • documentation
  • unit tests
  • tested backward compatibility (ie. deploy with previous version, upgrade with this branch)

Release note:

@ghost ghost assigned seanknox Aug 3, 2018
@ghost ghost added the in progress label Aug 3, 2018
@acs-bot acs-bot added the size/M label Aug 3, 2018
CecileRobertMichon
CecileRobertMichon reviewed Aug 3, 2018
View reviewed changes
pkg/acsengine/template_generator.go
@@ -550,6 +550,9 @@ func (t *TemplateGenerator) getTemplateFuncMap(cs *api.ContainerService) templat
"GetKubernetesB64GenerateProxyCerts": func() string {
return getBase64CustomScript(kubernetesMasterGenerateProxyCertsScript)
},
"GetB64sshdConfig": func() string {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Where is this being used?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oops nevermind ignore my comment ^

@codecov
Copy link

codecov bot commented Aug 3, 2018 •
edited
Loading

Codecov Report

Merging #3612 into master will decrease coverage by 0.01%.
The diff coverage is 100%.

@@            Coverage Diff             @@
##           master    #3612      +/-   ##
==========================================
- Coverage   55.56%   55.55%   -0.02%     
==========================================
  Files         107      107              
  Lines       16195    16198       +3     
==========================================
  Hits         8999     8999              
- Misses       6421     6425       +4     
+ Partials      775      774       -1

@jackfrancis
Copy link
Member

jackfrancis commented Aug 3, 2018 •
edited
Loading

@seanknox kindly confirm this is what we want (from a master vm built from one of the E2E tests run against this PR):

azureuser@k8s-master-24722381-0:~$ cat /etc/ssh/sshd_config 
# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key

KexAlgorithms curve25519-sha256@libssh.org
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com

#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 1024

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 120
PermitRootLogin prohibit-password
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
PasswordAuthentication no

X11Forwarding no
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

# CLOUD_IMG: This file was created/modified by the Cloud Image build process
ClientAliveInterval 120

@jackfrancis
Copy link
Member

jackfrancis commented Aug 3, 2018 •
edited
Loading

As a reference, this is the sshd_config pulled from a vm built against the master branch as of now:

azureuser@k8s-master-41481510-0:~$ cat /etc/ssh/sshd_config 
# Package generated configuration file
# See the sshd_config(5) manpage for details

# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 1024

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 120
PermitRootLogin prohibit-password
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile	%h/.ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
PasswordAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

#MaxStartups 10:30:60
#Banner /etc/issue.net

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

# CLOUD_IMG: This file was created/modified by the Cloud Image build process
ClientAliveInterval 120

@jackfrancis
Copy link
Member

@seanknox here's a diff for our convenience:

$ diff before after
1,3d0
< # Package generated configuration file
< # See the sshd_config(5) manpage for details
< 
14a12,16
> 
> KexAlgorithms curve25519-sha256@libssh.org
> Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
> MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com
> 
33d34
< #AuthorizedKeysFile	%h/.ssh/authorized_keys
41,42d41
< # Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
< #IgnoreUserKnownHosts yes
54,64c53
< # Kerberos options
< #KerberosAuthentication no
< #KerberosGetAFSToken no
< #KerberosOrLocalPasswd yes
< #KerberosTicketCleanup yes
< 
< # GSSAPI options
< #GSSAPIAuthentication no
< #GSSAPICleanupCredentials yes
< 
< X11Forwarding yes
---
> X11Forwarding no
71,73d59
< #MaxStartups 10:30:60
< #Banner /etc/issue.net
<

@seanknox
Copy link
Contributor Author

seanknox commented Aug 3, 2018

@seanknox kindly confirm this is what we want (from a master vm built from one of the E2E tests run against this PR)

yep! looks good.

@ghost ghost assigned jackfrancis Aug 7, 2018
@mboersma
Copy link
Member

/lgtm

@jackfrancis
Copy link
Member

/lgtm thanks @seanknox!

@acs-bot
Copy link

acs-bot commented Aug 10, 2018

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jackfrancis, mboersma, seanknox

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:
  • OWNERS [jackfrancis,mboersma]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@jackfrancis jackfrancis merged commit 26f6de1 into master Aug 10, 2018
@ghost ghost removed the in progress label Aug 10, 2018
@jackfrancis jackfrancis deleted the ssh-hardening branch August 10, 2018 20:46
jackfrancis added a commit that referenced this pull request Aug 11, 2018
@jackfrancis
Revert "harden SSH: kex/ciphers/MACS + disable X11 forwarding (#3612)"
275e4fe 
This reverts commit 26f6de1.
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@CecileRobertMichon CecileRobertMichon CecileRobertMichon left review comments

@jackfrancis jackfrancis Awaiting requested review from jackfrancis

Assignees

@mboersma mboersma

@seanknox seanknox

@jackfrancis jackfrancis

Labels
approved lgtm size/M
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@seanknox @jackfrancis @mboersma @acs-bot @CecileRobertMichon