-
Notifications
You must be signed in to change notification settings - Fork 198
Macs kex ciphers #139
Macs kex ciphers #139
Conversation
| - name: set hostkeys according to openssh-version | ||
| set_fact: | ||
| ssh_host_key_files: ['/etc/ssh/ssh_host_rsa_key'] | ||
| when: sshd_version.stdout >= '5.3' and not ssh_host_key_files |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I would do that using one set_fact or even better in the defaults file. Something like:
ssh_host_key_files: '{{ ['/etc/ssh/ssh_host_rsa_key'] if sshd_version.stdout >= '6.0' else ... }}'This way, the whole file can be reduced to Jinja2 templating in defaults/main.yml. This also helps with performance :)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I tried and did not find a proper solution with the correct syntax.
"[/etc/ssh/ssh_host_rsa_key, /etc/ssh/ssh_host_ecdsa_key]" if sshd_version.stdout >= 6.0 else \ }}
"[/etc/ssh/ssh_host_rsa_key, /etc/ssh/ssh_host_ecdsa_key, /etc/ssh/ssh_host_ed25519_key]" if sshd_version.stdout >= 6.3 }}'```
This and variations of it do not work. They always give some error like:
``` fatal: [localhost]: FAILED! => {"msg": "Unexpected templating type error occurred on ({{ssh_host_key_files}}): __init__() takes at least 3 arguments (2 given)"}
| - "openssh-client" | ||
| - "openssh-server" | ||
| ignore_errors: true | ||
| - file: path="/var/run/sshd" state=directory |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please always use YAML syntax.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'll fix this in a separate PR where I'll change it everywhere.
templates/opensshd.conf.j2
Outdated
| {{ item.rules | indent(4) }} | ||
| {% endfor %} | ||
| {% endif %} | ||
|
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why add a trailing empty line :) ? This is usually unneeded. Maybe you will find https://github.com/ypid/dotfiles/blob/33ec82ad4bf59409a37891086c765e58c06713a6/vimrc#L888-L898 useful depending on your editor.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Fixed, thanks.
|
@ypid can you take a look again? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@rndmh3ro it looks good from my point of view. great!!! any objection? otherwise i would merge it
|
thanks @rndmh3ro, great work!!! |
This PR changes the logic, which macs, kex and cipher to use. For one, it moves the evaluation to the tasks instead of the templates (similar to the hostkey-logic).
It also lets the conficuration depend on the installed ssh-version, not the operating system.
It also add support for ssh 7.6 where ripemd is removed (fixes #135).