CBC Ciphers should be disabled by default. about ansible-ssh-hardening

[schurzi]

Hi @salderma, thanks for discovering this.
I have run a quick test on CentOS7 and I think the ciphers are set correct. Also in our defaults we already do not include the CBC ciphers, see:

ansible-ssh-hardening/defaults/main.yml

Lines 213 to 224 in 6626617

	ssh_ciphers_53_default:
	- aes256-ctr
	- aes192-ctr
	- aes128-ctr
	ssh_ciphers_66_default:
	- [email protected]
	- [email protected]
	- [email protected]
	- aes256-ctr
	- aes192-ctr
	- aes128-ctr

On my test machine, this evaluates to:

# CBC: is true if you want to connect with OpenSSL-base libraries
# eg ruby Net::SSH::Transport::CipherFactory requires cbc-versions of the given openssh ciphers to work
# -- see: (http://net-ssh.github.com/net-ssh/classes/Net/SSH/Transport/CipherFactory.html)
#

Ciphers [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr

Maybe there is a problem with the playbook on you test server.
Can you describe which operating system (including version) you are running?
Can you also include the output from an ansible run with this role on the server?

[salderma]

It must be a CentOS 8 thing...

Apparently this would resolve - https://access.redhat.com/solutions/4410591

Sorry, I'll close the issue.

[schurzi]

oh, don't be sorry! I think you fund something, that we missed.
This is a change worth including in our role, since it affects the security of sshd on CentOS8 and RHEL8.

[schurzi]

relevant for this: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/using-the-system-wide-cryptographic-policies_security-hardening#excluding-an-application-from-following-the-system-wide-crypto-policies_using-the-system-wide-cryptographic-policies

[rndmh3ro]

Fixed by #309