Update and add annotations to sshd config for servers #5666

emkll · 2020-12-09T16:55:18Z

Status

Work in progress

Description of Changes

Fixes #5660

Update supported algorthms
Disable some agent forwarding and tunnelling options
Annotate and reorder configuration for readability

Sources:

Testing

provided config is good / adheres to best practices
provided config is adequately annotated
provided config eliminates log message described in Update sshd config for Focal #5660
on an existing Xenial install the config is applied properly when an Ansible run occurs (I have tested this)

Deployment

New installs

The sshd configuration will be applied on new installs via Ansible

Existing installs

Existing installs will not be updated unattended, but applied when an Ansible run occurs

Checklist

Configuration tests pass

If you made non-trivial code changes:

I have written a test plan and validated it for this PR

Choose one of the following:

I have opened a PR in the docs repo for these changes, or will do so later
I would appreciate help with the documentation
These changes do not require documentation

codecov-io · 2020-12-10T21:16:04Z

Codecov Report

Merging #5666 (3f4f6ac) into develop (b24cbaa) will decrease coverage by 4.05%.
The diff coverage is n/a.

@@             Coverage Diff             @@
##           develop    #5666      +/-   ##
===========================================
- Coverage    85.46%   81.41%   -4.06%     
===========================================
  Files           51       53       +2     
  Lines         3709     3965     +256     
  Branches       464      496      +32     
===========================================
+ Hits          3170     3228      +58     
- Misses         439      632     +193     
- Partials       100      105       +5

Impacted Files	Coverage Δ
securedrop/models.py	`91.66% <0.00%> (-0.55%)`	⬇️
securedrop/source_app/api.py	`100.00% <0.00%> (ø)`
securedrop/source_app/main.py	`91.75% <0.00%> (ø)`
securedrop/source_app/__init__.py	`100.00% <0.00%> (ø)`
securedrop/journalist_app/forms.py	`100.00% <0.00%> (ø)`
.../92fba0be98e9_added_organization_name_field_in_.py	`66.66% <0.00%> (ø)`
securedrop/loaddata.py	`0.00% <0.00%> (ø)`
securedrop/journalist_app/__init__.py	`93.45% <0.00%> (+0.18%)`	⬆️
securedrop/journalist_app/admin.py	`92.92% <0.00%> (+0.25%)`	⬆️
securedrop/source_app/utils.py	`92.20% <0.00%> (+2.59%)`	⬆️
... and 1 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update b24cbaa...3f4f6ac. Read the comment docs.

zenmonkeykstop · 2020-12-14T14:44:29Z

One minor note, would it be worth making an accompanying docs change specifically in https://docs.securedrop.org/en/stable/servers.html?highlight=ssh-keygen to use ed25519 for new installs??

zenmonkeykstop · 2020-12-14T16:49:43Z

Tested on prod VMs (using existing instructions to generate an RSA SSH key on the workstation):

installation completes successfully
on subsequent playbook runs, or on attempts to connect via ssh <serverAlias> SSH fails with a host key mismatch, as an ECDSA host key was set up initially but an ED25519 key is now present.

Removing the known_hosts entries for app and mon and accepting the new host keys clears the error but it might be good to handle it more transparently.

zenmonkeykstop · 2020-12-14T16:57:09Z

install_files/ansible-base/roles/restrict-direct-access/templates/sshd_config

+# Cipher selection
+
+Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr
+HostKeyAlgorithms ssh-ed25519,rsa-sha2-256,rsa-sha2-512


It looks like this ordering forces a new host key to be generated when the new config is applied. Since ECDSA is being removed altogether I don't see that there's a way around this in Xenial. It might make sense to have tailsconfig remove the old host key entries on the workstation if found, and alert the user that they can expect to see prompts on their first SSH/playbook run.

emkll · 2020-12-16T17:52:46Z

Since ECDSA is being removed altogether I don't see that there's a way around this in Xenial. It might make sense to have tailsconfig remove the old host key entries on the workstation if found, and alert the user that they can expect to see prompts on their first SSH/playbook run.

This might also be an issue in Focal, in a default configuration, the Host key is still ECDSA.

We could preserve the same host key preferences as the previous sshd_config: Given by default ssh is exposed Tor, which provides a second layer of authentication via authenticated onion services, or only exposed through a local network, we could simply preserve ECDSA / distribution defaults for host keys.

I will look into @zenmonkeykstop 's suggestion above, and use Ansible to

Delete the server fingerprint in known_hosts, and have a user re-verify the fingerprints or
Have Ansible edit known_hosts and add server fingerprints there

This might need to be done before the reboot action, so in the main Ansible playbook

conorsch · 2020-12-17T01:07:14Z

We could preserve the same host key preferences as the previous sshd_config

Preserving as-is seems the most straightforward. Certainly for Xenial, there's no pressing need to change the config. For Focal, ideally we'd have a stronger default, but the gains from v2 -> v3 onions are pretty great already, and v3 is required for Focal. So I don't think we need to block on managing the host keys, as long as you're comfortable backing out on the defaults for now, @emkll.

It does strike me as worthwhile to consider hostkey management outside the context of config updates: on first install, the same hostkey for the IPv4 address must be re-confirmed for the ssh onions, which we needn't prompt admins to configure. Still, I don't think that work needs to go into this PR. We can file a separate issue for it, and address if it proves to be a sticking point during testing the backup-and-restore flow as part of the LTS upgrade path.

- Update supported algorthms - Disable some agent forwarding and tunnelling options - Annotate and reorder configuration for readability Sources: - https://github.com/dev-sec/ansible-ssh-hardening - https://github.com/arthepsy/ssh-audit

ECDSA will be used by defaut for the client to authenticate the host. Tor Onion Services will also provide another layer of authentication, when using ssh over Tor.

emkll · 2021-01-05T17:04:33Z

This is ready for re-review, however the docs update identified in #5666 (comment) is still pending

kushaldas · 2021-01-06T11:00:21Z

install_files/ansible-base/roles/restrict-direct-access/templates/sshd_config

+
+# Cipher selection
+
+Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr


Do we really need chacha20-poly1305@openssh.com?
chacha20 is specially being used from the cheap phones which does not have good hardware. And our users will use Tails on proper hardware to ssh.

@kushaldas

- As pointed out by @kushaldas, chacha20-poly1305 mostly mobile-specific cipher, and while historically present in the sshd configuration for SecureDrop, is not necessary to support Debian-based ssh clients. - The UsePrivilegeSeparation option has been deprecated in OpenSSH 7.5 [1]. UsePrivilegeSeparation has defaulted to 'sandbox' since 6.1 [2] and to 'yes' since 3.3 [3]. [1] https://www.openssh.com/txt/release-7.5 [2] https://www.openssh.com/txt/release-6.1 [3] https://www.openssh.com/txt/release-3.3

kushaldas

The current changes look nice to me, did not test it in a server yet.

kushaldas

provided config is good / adheres to best practices
provided config is adequately annotated
provided config eliminates log message described in Update sshd config for Focal #5660
on an existing Xenial install the config is applied properly when an Ansible run occurs

I tested manually with ssh over Tor on both Focal and Xenial. Works as expected. Approving. ~ Will merge after standup.~ @conorsch do you think is it ready for merge?

Concerns raised have been addressed: specifically, the changes to hostkey algos were backed out

emkll added this to In Development in SecureDrop Team Board Dec 9, 2020

emkll force-pushed the 5660-sshd-config-focal branch from 57af90a to 2609cce Compare December 10, 2020 20:18

emkll marked this pull request as ready for review December 11, 2020 13:36

emkll requested review from conorsch and kushaldas as code owners December 11, 2020 13:36

emkll moved this from In Development to Ready for Review in SecureDrop Team Board Dec 11, 2020

zenmonkeykstop self-assigned this Dec 14, 2020

zenmonkeykstop previously requested changes Dec 14, 2020

View reviewed changes

eloquence moved this from Ready for Review to In Development in SecureDrop Team Board Dec 14, 2020

emkll added 2 commits December 17, 2020 09:31

Updates sshd config

00ceaeb

- Update supported algorthms - Disable some agent forwarding and tunnelling options - Annotate and reorder configuration for readability Sources: - https://github.com/dev-sec/ansible-ssh-hardening - https://github.com/arthepsy/ssh-audit

Use ditribution-default host key algorithms

54abdb2

ECDSA will be used by defaut for the client to authenticate the host. Tor Onion Services will also provide another layer of authentication, when using ssh over Tor.

emkll force-pushed the 5660-sshd-config-focal branch from d4f1643 to 54abdb2 Compare December 17, 2020 15:07

emkll moved this from In Development to Ready for Review in SecureDrop Team Board Dec 17, 2020

kushaldas reviewed Jan 6, 2021

View reviewed changes

kushaldas reviewed Jan 11, 2021

View reviewed changes

kushaldas approved these changes Jan 27, 2021

View reviewed changes

eloquence added this to the 1.8.0 milestone Feb 4, 2021

eloquence added the release blocker label Feb 10, 2021

conorsch approved these changes Feb 11, 2021

View reviewed changes

conorsch requested a review from zenmonkeykstop February 11, 2021 19:18

conorsch merged commit fc6753e into develop Feb 11, 2021

SecureDrop Team Board automation moved this from Ready for Review to Done Feb 11, 2021

emkll mentioned this pull request Feb 23, 2021

Further deprecation warnings for sshd_config in Focal #5816

Open

kushaldas mentioned this pull request Feb 26, 2021

Release SecureDrop 1.8.0 #5794

Closed

27 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update and add annotations to sshd config for servers #5666

Update and add annotations to sshd config for servers #5666

emkll commented Dec 9, 2020 •

edited

codecov-io commented Dec 10, 2020 •

edited

zenmonkeykstop commented Dec 14, 2020

zenmonkeykstop commented Dec 14, 2020

zenmonkeykstop Dec 14, 2020

emkll commented Dec 16, 2020

conorsch commented Dec 17, 2020

emkll commented Jan 5, 2021 •

edited

kushaldas Jan 6, 2021 •

edited

kushaldas left a comment •

edited

kushaldas left a comment •

edited


		# Cipher selection

		Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr

Update and add annotations to sshd config for servers #5666

Update and add annotations to sshd config for servers #5666

Conversation

emkll commented Dec 9, 2020 • edited

Status

Description of Changes

Testing

Deployment

New installs

Existing installs

Checklist

If you made non-trivial code changes:

codecov-io commented Dec 10, 2020 • edited

Codecov Report

zenmonkeykstop commented Dec 14, 2020

zenmonkeykstop commented Dec 14, 2020

zenmonkeykstop Dec 14, 2020

Choose a reason for hiding this comment

emkll commented Dec 16, 2020

conorsch commented Dec 17, 2020

emkll commented Jan 5, 2021 • edited

kushaldas Jan 6, 2021 • edited

Choose a reason for hiding this comment

kushaldas left a comment • edited

Choose a reason for hiding this comment

kushaldas left a comment • edited

Choose a reason for hiding this comment

emkll commented Dec 9, 2020 •

edited

codecov-io commented Dec 10, 2020 •

edited

emkll commented Jan 5, 2021 •

edited

kushaldas Jan 6, 2021 •

edited

kushaldas left a comment •

edited

kushaldas left a comment •

edited