Merge pull request #468 from delphix/dlpx/pr/justsanjeev/8af576f6-072f-4cf8-9923-62cbe74253de

DLPX-86536 CIS: sshd configuration

Author: justsanjeev

files/common/var/lib/delphix-platform/ansible/10-delphix-platform/roles/delphix-platform/tasks/main.yml

@@ -76,12 +76,16 @@
 #
 # Restrict cron permissions. All jobs are owned by root so there's no
 # reason to allow others any level of access. This is also necessary to
-# satisfy external auditing of CIS security benchmarks.
+# satisfy external auditing of CIS security benchmarks. Also ensuring
+# the permissions on /etc/ssh/sshd_config are configured.
 #
 - file:
-    path: /etc/crontab
+    path: "{{ item }}"
     state: file
     mode: 0600
+  with_items:
+    - /etc/crontab
+    - /etc/ssh/sshd_config
 
 - file:
     path: "{{ item }}"
@@ -228,36 +232,14 @@
     - 'delphix'
     - 'root'
 
-- lineinfile:
-    path: /etc/ssh/sshd_config
-    regexp: "^#?{{ item.key }} "
-    line: "{{ item.key }} {{ item.value }}"
-  with_items:
-    #
-    # Configure SSH to allow PAM "conversations" (interactions with the user).
-    #
-    - { key: "ChallengeResponseAuthentication", value: "yes" }
-    #
-    # Harden the appliance by disabling ssh-agent(1), tcp, UNIX domain, and
-    # X11 forwarding. Note that this doesn't improve security unless users are
-    # also denied shell access.
-    #
-    - { key: "AllowAgentForwarding", value: "no" }
-    - { key: "AllowStreamLocalForwarding", value: "no" }
-    - { key: "AllowTcpForwarding", value: "no" }
-    - { key: "X11Forwarding", value: "no" }
-    - { key: "HostKeyAlgorithms", value: "-ssh-rsa*" }
-  notify: "sshd config changed"
-
 #
-# The CRA project mandated a 30 minute timeout for any idle connections.
-# By enabling an inactivity timeout we ensure that idle connections are
-# closed. Thus any sessions that are accidentally left opened at a
-# customer site will timeout preventing customers from gaining access to
-# our engine.
+# The 'ClientAliveInterval' setting determines the amount of time
+# (in seconds) the sshd server will wait to receive data from the
+# client before sending a request for response.
 #
 - set_fact:
-    ssh_client_alive_interval: "1800"
+    ssh_client_alive_interval: "300"
+    ssh_client_alive_count_max: "3"
 
 #
 # With that said (see comment above), the Azure marketplace does not
@@ -266,23 +248,39 @@
 #
 - set_fact:
     ssh_client_alive_interval: "180"
-  when: platform == "azure"
+    ssh_client_alive_count_max: "0"
+  when:
+    - platform == "azure"
 
 - lineinfile:
     path: /etc/ssh/sshd_config
     regexp: "^#?{{ item.key }} "
     line: "{{ item.key }} {{ item.value }}"
   with_items:
-    - { key: "ClientAliveInterval", value: "{{ ssh_client_alive_interval }}" }
-    - { key: "ClientAliveCountMax", value: "0" }
-  when:
     #
-    # For developer convenience, we only enable the CRA mandated timeout
-    # for external variants. The idle timeout can be a burden when we
-    # need to run long running processes over SSH on our internal
-    # systems (e.g. for development, testing, etc).
+    # Configure SSH to allow PAM "conversations" (interactions with the user).
     #
-    - variant is regex("external-.*")
+    - { key: "ChallengeResponseAuthentication", value: "yes" }
+    #
+    # Harden the appliance by disabling ssh-agent(1), tcp, UNIX domain, and
+    # X11 forwarding. Note that this doesn't improve security unless users are
+    # also denied shell access.
+    #
+    - { key: "AllowAgentForwarding", value: "no" }
+    - { key: "AllowStreamLocalForwarding", value: "no" }
+    - { key: "AllowTcpForwarding", value: "no" }
+    - { key: "Ciphers", value: "chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com" }
+    - { key: "ClientAliveCountMax", value: "{{ ssh_client_alive_count_max }}" }
+    - { key: "ClientAliveInterval", value: "{{ ssh_client_alive_interval }}" }
+    - { key: "HostKeyAlgorithms", value: "-ssh-rsa*" }
+    - { key: "KexAlgorithms", value: "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256"}
+    - { key: "LoginGraceTime", value: "60"}
+    - { key: "MACs", value: "umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512"}
+    - { key: "MaxAuthTries", value: "4" }
+    - { key: "MaxStartups", value: "10:30:60"}
+    - { key: "PermitRootLogin", value: "no" }
+    - { key: "X11Forwarding", value: "no" }
+  notify: "sshd config changed"
 
 - blockinfile:
     path: /etc/profile
@@ -338,38 +336,6 @@
     regexp: '^#?[\s]*(auth[\s]+required[\s]+pam_wheel\.so.*)$'
     replace: '\1'
 
-#
-# Prevent sshd from offering weak message authentication codes to clients.
-#
-# The "MACs" configuration parameter in sshd_config takes a list of algorithms
-# as its parameter. This list may be prefixed by a '+' or '-' operator
-# (indicating that the given list should be appended to or removed from the
-# existing MAC set, respectively), or neither operator (indicating that the
-# given list should replace the existing MAC set). If there already exists a
-# "MACs -..."  line, we can append to this list. If otherwise, we need to add
-# this as a separate line in the configuration.
-#
-- shell: grep -c -E "^MACs(\s+)-" /etc/ssh/sshd_config || true
-  register: grep_sshd_config_macs_to_remove
-
-- shell: grep -c -E "^MACs(\s+)-(.*)hmac-sha1\*,umac-64\*" /etc/ssh/sshd_config || true
-  register: grep_sshd_config_macs_already_removed
-
-- lineinfile:
-    path: /etc/ssh/sshd_config
-    backrefs: yes
-    regexp: '^MACs[\s]+-(.*)$'
-    line: 'MACs -\1,hmac-sha1*,umac-64*'
-  notify: "sshd config changed"
-  when: grep_sshd_config_macs_to_remove.stdout != "0" and grep_sshd_config_macs_already_removed == "0"
-
-- lineinfile:
-    path: /etc/ssh/sshd_config
-    insertafter: EOF
-    line: "MACs -hmac-sha1*,umac-64*"
-  notify: "sshd config changed"
-  when: grep_sshd_config_macs_to_remove.stdout == "0"
-
 #
 # Enable SNMP client tools to load MIBs by default.
 #