hologram-openssh.pkg.toml

[package]
name        = "hologram-openssh"
version     = "1.6.0"
description = "hologram: hardened OpenSSH server"
requires    = [ "openssh" ]

# enable SSH daemon
[[symlink]]
path   = "/etc/systemd/system/multi-user.target.wants/sshd.service"
target = "/usr/lib/systemd/system/sshd.service"

# open SSH port when using hologram-ferm
[[file]]
path = "/etc/ferm.d/incoming-ssh"
content = "proto tcp dport ssh ACCEPT;"

# extend the default SSH configuration with recommendations from
# https://stribika.github.io/2015/01/04/secure-secure-shell.html
# NOTE: support for hmac-ripemd160 MAC has been removed in OpenSSH 7.6
#
# XXX WARNING: There's a typo in here; it should be "ed25519" instead of "ed22519".
# I will fix this when I rotate SSH keys the next time.
# Ref: https://github.com/majewsky/system-configuration/issues/3
[[file]]
path   = "/usr/share/holo/files/10-openssh/etc/ssh/sshd_config.holoscript"
mode   = "0755"
content = """
    #!/bin/sh
    cat
    cat <<-'EOF'

    # custom settings
    KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256

    Protocol 2
    HostKey /etc/ssh/ssh_host_ed22519_key
    HostKey /etc/ssh/ssh_host_rsa_key

    PasswordAuthentication no
    ChallengeResponseAuthentication no
    PubkeyAuthentication yes

    Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr

    MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com
    EOF
"""

# filter weak moduli
[[file]]
path   = "/usr/share/holo/run-scripts/10-openssh-filter-weak-moduli.sh"
mode   = "0755"
content = """
    #!/bin/sh
    awk '$5 > 2000' < /etc/ssh/moduli > /tmp/ssh-moduli
    mv /tmp/ssh-moduli /etc/ssh/moduli
"""

# disable weak host keys by placing invalid symlinks at their location
[[symlink]]
path   = "/etc/ssh/ssh_host_key"
target = "ssh_host_key"
[[symlink]]
path   = "/etc/ssh/ssh_host_key.pub"
target = "ssh_host_key.pub"
[[symlink]]
path   = "/etc/ssh/ssh_host_dsa_key"
target = "ssh_host_dsa_key"
[[symlink]]
path   = "/etc/ssh/ssh_host_dsa_key.pub"
target = "ssh_host_dsa_key.pub"
[[symlink]]
path   = "/etc/ssh/ssh_host_ecdsa_key"
target = "ssh_host_ecdsa_key"
[[symlink]]
path   = "/etc/ssh/ssh_host_ecdsa_key.pub"
target = "ssh_host_ecdsa_key.pub"