Skip to content

Commit

Permalink
Merge pull request #70 from TelekomLabs/kex-sha1
Browse files Browse the repository at this point in the history 
remove sha1 key-exchange mechanisms from default
  • Loading branch information
@chris-rock
chris-rock committed Jan 14, 2015
2 parents 3f78b0b + 6f5792f commit 16593db
Show file tree
Hide file tree
Showing 3 changed files with 52 additions and 4 deletions.
8 changes: 4 additions & 4 deletions libraries/get_ssh_kex.rb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -27,12 +27,12 @@ def self.get_kexs(node, weak_kex)
weak_kex = weak_kex ? 'weak' : 'default'

kex_59 = {}
kex_59.default = 'diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1'
kex_59['weak'] = kex_59['default'] + ',diffie-hellman-group1-sha1'
kex_59.default = 'diffie-hellman-group-exchange-sha256'
kex_59['weak'] = kex_59['default'] + ',diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1'

kex_66 = {}
kex_66.default = 'curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1'
kex_66['weak'] = kex_66['default'] + ',diffie-hellman-group1-sha1'
kex_66.default = 'curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256'
kex_66['weak'] = kex_66['default'] + ',diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1'

# determine the kex for the operating system
kex = kex_59
Expand Down
24 changes: 24 additions & 0 deletions spec/recipes/client_spec.rb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,10 @@
end

it 'disables weak kexs' do
expect(chef_run).not_to render_file('/etc/ssh/ssh_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group14-sha1\b/)
expect(chef_run).not_to render_file('/etc/ssh/ssh_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group-exchange-sha1\b/)
expect(chef_run).not_to render_file('/etc/ssh/ssh_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group1-sha1\b/)
end
Expand Down Expand Up @@ -102,6 +106,10 @@
end

it 'allows weak kexs on the client' do
expect(chef_run).to render_file('/etc/ssh/ssh_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group14-sha1\b/)
expect(chef_run).to render_file('/etc/ssh/ssh_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group-exchange-sha1\b/)
expect(chef_run).to render_file('/etc/ssh/ssh_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group1-sha1\b/)
end
Expand All @@ -119,6 +127,10 @@
end

it 'does not allow weak kexs on the client' do
expect(chef_run).not_to render_file('/etc/ssh/ssh_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group14-sha1\b/)
expect(chef_run).not_to render_file('/etc/ssh/ssh_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group-exchange-sha1\b/)
expect(chef_run).not_to render_file('/etc/ssh/ssh_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group1-sha1\b/)
end
Expand Down Expand Up @@ -170,6 +182,10 @@
end

it 'still does not allow weak kexs' do
expect(chef_run).not_to render_file('/etc/ssh/ssh_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group14-sha1\b/)
expect(chef_run).not_to render_file('/etc/ssh/ssh_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group-exchange-sha1\b/)
expect(chef_run).not_to render_file('/etc/ssh/ssh_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group1-sha1\b/)
end
Expand All @@ -194,6 +210,10 @@
end

it 'allows weak kexs on the client' do
expect(chef_run).to render_file('/etc/ssh/ssh_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group14-sha1\b/)
expect(chef_run).to render_file('/etc/ssh/ssh_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group-exchange-sha1\b/)
expect(chef_run).to render_file('/etc/ssh/ssh_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group1-sha1\b/)
end
Expand Down Expand Up @@ -235,6 +255,10 @@
end

it 'still does not allow weak kexs' do
expect(chef_run).not_to render_file('/etc/ssh/ssh_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group14-sha1\b/)
expect(chef_run).not_to render_file('/etc/ssh/ssh_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group-exchange-sha1\b/)
expect(chef_run).not_to render_file('/etc/ssh/ssh_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group1-sha1\b/)
end
Expand Down
24 changes: 24 additions & 0 deletions spec/recipes/server_spec.rb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,10 @@
end

it 'disables weak kexs' do
expect(chef_run).not_to render_file('/etc/ssh/sshd_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group14-sha1\b/)
expect(chef_run).not_to render_file('/etc/ssh/sshd_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group-exchange-sha1\b/)
expect(chef_run).not_to render_file('/etc/ssh/sshd_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group1-sha1\b/)
end
Expand Down Expand Up @@ -111,6 +115,10 @@
end

it 'enables weak kexs on the server' do
expect(chef_run).to render_file('/etc/ssh/sshd_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group14-sha1\b/)
expect(chef_run).to render_file('/etc/ssh/sshd_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group-exchange-sha1\b/)
expect(chef_run).to render_file('/etc/ssh/sshd_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group1-sha1\b/)
end
Expand All @@ -129,6 +137,10 @@
end

it 'does not enable weak kexs on the server' do
expect(chef_run).not_to render_file('/etc/ssh/sshd_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group14-sha1\b/)
expect(chef_run).not_to render_file('/etc/ssh/sshd_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group-exchange-sha1\b/)
expect(chef_run).not_to render_file('/etc/ssh/sshd_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group1-sha1\b/)
end
Expand Down Expand Up @@ -182,6 +194,10 @@
end

it 'still does not allow weak kexs' do
expect(chef_run).not_to render_file('/etc/ssh/sshd_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group14-sha1\b/)
expect(chef_run).not_to render_file('/etc/ssh/sshd_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group-exchange-sha1\b/)
expect(chef_run).not_to render_file('/etc/ssh/sshd_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group1-sha1\b/)
end
Expand All @@ -207,6 +223,10 @@
end

it 'allows weak kexs' do
expect(chef_run).to render_file('/etc/ssh/sshd_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group14-sha1\b/)
expect(chef_run).to render_file('/etc/ssh/sshd_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group-exchange-sha1\b/)
expect(chef_run).to render_file('/etc/ssh/sshd_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group1-sha1\b/)
end
Expand Down Expand Up @@ -249,6 +269,10 @@
end

it 'still does not allow weak kexs' do
expect(chef_run).not_to render_file('/etc/ssh/sshd_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group14-sha1\b/)
expect(chef_run).not_to render_file('/etc/ssh/sshd_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group-exchange-sha1\b/)
expect(chef_run).not_to render_file('/etc/ssh/sshd_config')
.with_content(/KexAlgorithms [^#]*\bdiffie-hellman-group1-sha1\b/)
end
Expand Down

0 comments on commit 16593db

Please sign in to comment.