drop default values (fixes #102)

[alxwr]

fixes #102

tested on:

• FreeBSD 10.3
• Debian 8.9
• Ubuntu 14.04

[aboe76]

@alxwr I want to test this first before I merge.

[aboe76]

@alxwr looks good except that it leaves a lot of empty lines and comments between the options...
which makes a weird sshd_config file.

[alxwr]

@aboe76 I'll try to optimize that. :-)

[alxwr]

@aboe76 I removed the redundant white space.

[aboe76]

@alxwr somewhere around AllowUsers, and allowgroups it merges all the lines together.

AllowUsers xxxx xxxxAllowGroups xxxxKexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctrMACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,umac-128@openssh.comCompression no

It should be:

AllowUsers XXXX XXXXX
AllowGroups XXXXX
KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,umac-128@openssh.com
Compression no

[alxwr]

@aboe76 whitespace issues should be fixed. :-)
Please test again!

[aboe76]

@alxwr thanks looks good.

[aboe76]

Looks good, and clean sshd_config file.

[aboe76]

@whiteinge can you give some feedback?

[aboe76]

@alxwr still see some trouble with ciphers being on the same line as kexalgorithms.

I pinpointed the problem with the lists:
This will give an error:

sshd_config:
  KexAlgorithms:
    - 'curve25519-sha256@libssh.org'
    - 'diffie-hellman-group-exchange-sha256'
    - 'diffie-hellman-group-exchange-sha1'
    - 'diffie-hellman-group14-sha1'
  Ciphers:
    - 'chacha20-poly1305@openssh.com'
    - 'aes256-gcm@openssh.com'
    - 'aes128-gcm@openssh.com'
    - 'aes256-ctr'
    - 'aes192-ctr'
    - 'aes128-ctr'
  MACs:
    - 'hmac-sha2-512-etm@openssh.com'
    - 'hmac-sha2-256-etm@openssh.com'
    - 'hmac-ripemd160-etm@openssh.com'
    - 'umac-128-etm@openssh.com'
    - 'hmac-sha2-512'
    - 'hmac-sha2-256'
    - 'hmac-sha1'
    - 'hmac-ripemd160'
    - 'umac-128@openssh.com'

while this will work:

sshd_config:
  KexAlgorithms: 'curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1'
  Ciphers: 'chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr'
  MACs: 'hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-ripemd160,umac-128@openssh.com'

[whiteinge]

Looks good to me. I don't have anything to add to @aboe76 's good feedback.

[alxwr]

@aboe76 Reproduced and fixed the bug. :-) Thanks for testing!

Maybe squash the fix-of-the-fix commits before merging to increase clarity?

[aboe76]

@alxwr thanks for this.