Skip to content

Commit fa39013

Browse files
bhouse-nexthopbhouse-nexthop
committed
SSH hardening configuration options
The SSH configuration does not contain many of the hardening requirements by the various standards bodies. This adds support for: * password_authentication - ability to disable password auth * permit_root_login - ability to prevent root logins * ciphers - ability to specify available ciphers * kex_algorithms - ability to specify key exchange algorithms * macs - ability to specify macs Signed-off-by: Brad House <[email protected]>
1 parent b9f3471 commit fa39013

File tree

5 files changed

+154
-3
lines changed

5 files changed

+154
-3
lines changed

‎src/sonic-yang-models/doc/Configuration.md‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2952,6 +2952,11 @@ In this table, we allow configuring ssh server global settings. This will featur
29522952
- ports - Ssh port numbers - string of port numbers seperated by ','
29532953
- inactivity_timeout - Inactivity timeout for SSH session, allowed values: 0-35000 (min), default value: 15 (min)
29542954
- max_sessions - Max number of concurrent logins, allowed values: 0-100 (where 0 means no limit), default value: 0
2955+
- permit_root_login - Whether or not to allow root login. Boolean.
2956+
- password_authentication - Whether or not to allow password authentication. Boolean.
2957+
- ciphers - Ciphers to allow. See `ssh -Q ciphers`
2958+
- kex_algorithms - Key Exchange algorithms to allow. See `ssh -Q kex_algorithms`
2959+
- macs - MAC algorithms to allow. See `ssh -Q macs`
29552960
```
29562961
{
29572962
"SSH_SERVER": {
@@ -2960,7 +2965,12 @@ In this table, we allow configuring ssh server global settings. This will featur
29602965
"login_timeout": "120",
29612966
"ports": "22",
29622967
"inactivity_timeout": "15",
2963-
"max_sessions": "0"
2968+
"max_sessions": "0",
2969+
"permit_root_login": "false",
2970+
"password_authentication": "true",
2971+
"ciphers": [ "[email protected]", "[email protected]" ],
2972+
"kex_algorithms": [ "sntrup761x25519-sha512", "curve25519-sha256", "ecdh-sha2-nistp521" ],
2973+
"macs": [ "[email protected]", "hmac-sha2-512" ]
29642974
}
29652975
}
29662976
}

‎src/sonic-yang-models/tests/files/sample_config_db.json‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2587,7 +2587,12 @@
25872587
"login_timeout": "120",
25882588
"ports": "22",
25892589
"inactivity_timeout": "15",
2590-
"max_sessions": "0"
2590+
"max_sessions": "0",
2591+
"permit_root_login": "false",
2592+
"password_authentication": "true",
2593+
"ciphers": [ "[email protected]", "[email protected]" ],
2594+
"kex_algorithms": [ "sntrup761x25519-sha512", "curve25519-sha256", "ecdh-sha2-nistp521" ],
2595+
"macs": [ "[email protected]", "hmac-sha2-512" ]
25912596
}
25922597
},
25932598

‎src/sonic-yang-models/tests/yang_model_tests/tests/ssh-server.json‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,5 +30,25 @@
3030
"SSH_SERVER_INVALID_MAX_SESSIONS": {
3131
"desc": "Configure invalid max_sessions value in SSH_SERVER.",
3232
"eStr": "does not satisfy the constraint \"0..100\""
33+
},
34+
"SSH_SERVER_INVALID_PERMIT_ROOT_LOGIN": {
35+
"desc": "Configure invalid permit_root_login value in SSH_SERVER.",
36+
"eStrKey": "InvalidValue"
37+
},
38+
"SSH_SERVER_INVALID_PASSWORD_AUTHENTICATION": {
39+
"desc": "Configure invalid password_authentication value in SSH_SERVER.",
40+
"eStrKey": "InvalidValue"
41+
},
42+
"SSH_SERVER_INVALID_CIPHERS": {
43+
"desc": "Configure invalid ciphers value in SSH_SERVER.",
44+
"eStrKey": "InvalidValue"
45+
},
46+
"SSH_SERVER_INVALID_KEX_ALGORITHMS": {
47+
"desc": "Configure invalid kex_algorithms value in SSH_SERVER.",
48+
"eStrKey": "InvalidValue"
49+
},
50+
"SSH_SERVER_INVALID_MACS": {
51+
"desc": "Configure invalid macs value in SSH_SERVER.",
52+
"eStrKey": "InvalidValue"
3353
}
3454
}

‎src/sonic-yang-models/tests/yang_model_tests/tests_config/ssh-server.json‎

Lines changed: 53 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,14 @@
55
"POLICIES":{
66
"authentication_retries": "6",
77
"login_timeout": "120",
8-
"ports": "22"
8+
"ports": "22",
9+
"inactivity_timeout": "15",
10+
"max_sessions": "0",
11+
"permit_root_login": "false",
12+
"password_authentication": "true",
13+
"ciphers": [ "[email protected]", "[email protected]" ],
14+
"kex_algorithms": [ "sntrup761x25519-sha512", "curve25519-sha256", "ecdh-sha2-nistp521" ],
15+
"macs": [ "[email protected]", "hmac-sha2-512" ]
916
}
1017
}
1118
}
@@ -74,5 +81,50 @@
7481
}
7582
}
7683
}
84+
},
85+
"SSH_SERVER_INVALID_PERMIT_ROOT_LOGIN": {
86+
"sonic-ssh-server:sonic-ssh-server": {
87+
"sonic-ssh-server:SSH_SERVER": {
88+
"POLICIES":{
89+
"permit_root_login": "invalid"
90+
}
91+
}
92+
}
93+
},
94+
"SSH_SERVER_INVALID_PASSWORD_AUTHENTICATION": {
95+
"sonic-ssh-server:sonic-ssh-server": {
96+
"sonic-ssh-server:SSH_SERVER": {
97+
"POLICIES":{
98+
"password_authentication": "invalid"
99+
}
100+
}
101+
}
102+
},
103+
"SSH_SERVER_INVALID_CIPHERS": {
104+
"sonic-ssh-server:sonic-ssh-server": {
105+
"sonic-ssh-server:SSH_SERVER": {
106+
"POLICIES":{
107+
"ciphers": [ "[email protected]", "invalid" ]
108+
}
109+
}
110+
}
111+
},
112+
"SSH_SERVER_INVALID_KEX_ALGORITHMS": {
113+
"sonic-ssh-server:sonic-ssh-server": {
114+
"sonic-ssh-server:SSH_SERVER": {
115+
"POLICIES":{
116+
"kex_algorithms": [ "sntrup761x25519-sha512", "invalid" ]
117+
}
118+
}
119+
}
120+
},
121+
"SSH_SERVER_INVALID_MACS": {
122+
"sonic-ssh-server:sonic-ssh-server": {
123+
"sonic-ssh-server:SSH_SERVER": {
124+
"POLICIES":{
125+
"macs": [ "[email protected]", "invalid" ]
126+
}
127+
}
128+
}
77129
}
78130
}

‎src/sonic-yang-models/yang-models/sonic-ssh-server.yang‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,70 @@ module sonic-ssh-server {
5959
range 0..100;
6060
}
6161
}
62+
leaf permit_root_login {
63+
description "Specifies whether root can log in using ssh.";
64+
type boolean;
65+
}
66+
leaf password_authentication {
67+
description "Specifies whether password authentication is enabled.";
68+
type boolean;
69+
default true;
70+
}
71+
leaf-list ciphers {
72+
description "Specifies the ciphers allowed.";
73+
type enumeration {
74+
enum "3des-cbc";
75+
enum "aes128-cbc";
76+
enum "aes192-cbc";
77+
enum "aes256-cbc";
78+
enum "aes128-ctr";
79+
enum "aes192-ctr";
80+
enum "aes256-ctr";
81+
enum "[email protected]";
82+
enum "[email protected]";
83+
enum "[email protected]";
84+
}
85+
}
86+
leaf-list kex_algorithms {
87+
description "Specifies the available Key Exchange algorithms.";
88+
type enumeration {
89+
enum "diffie-hellman-group1-sha1";
90+
enum "diffie-hellman-group14-sha1";
91+
enum "diffie-hellman-group14-sha256";
92+
enum "diffie-hellman-group16-sha512";
93+
enum "diffie-hellman-group18-sha512";
94+
enum "diffie-hellman-group-exchange-sha1";
95+
enum "diffie-hellman-group-exchange-sha256";
96+
enum "ecdh-sha2-nistp256";
97+
enum "ecdh-sha2-nistp384";
98+
enum "ecdh-sha2-nistp521";
99+
enum "curve25519-sha256";
100+
enum "[email protected]";
101+
enum "sntrup761x25519-sha512";
102+
enum "[email protected]";
103+
}
104+
}
105+
leaf-list macs {
106+
description "Specifies the available MAC (message authentication code) algorithms.";
107+
type enumeration {
108+
enum "hmac-sha1";
109+
enum "hmac-sha1-96";
110+
enum "hmac-sha2-256";
111+
enum "hmac-sha2-512";
112+
enum "hmac-md5";
113+
enum "hmac-md5-96";
114+
enum "[email protected]";
115+
enum "[email protected]";
116+
enum "[email protected]";
117+
enum "[email protected]";
118+
enum "[email protected]";
119+
enum "[email protected]";
120+
enum "[email protected]";
121+
enum "[email protected]";
122+
enum "[email protected]";
123+
enum "[email protected]";
124+
}
125+
}
62126
}/*container policies */
63127
} /* container SSH_SERVER */
64128
}/* container sonic-ssh-server */

0 commit comments

Comments
 (0)