Skip to content

add openssh config with post-quantum kex algorithms for RHEL 9.8 and above #583

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
mboisson wants to merge 1 commit into from
Closed

add openssh config with post-quantum kex algorithms for RHEL 9.8 and above #583

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions site/profile/files/base/opensshserver-9.8.config
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com
GSSAPIKexAlgorithms gss-curve25519-sha256-
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256,mlkem768x25519-sha256,sntrup761x25519-sha512
HostKeyAlgorithms ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-512
PubkeyAcceptedKeyTypes ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-512
15 changes: 14 additions & 1 deletion site/profile/manifests/ssh.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,7 +108,7 @@
source => 'puppet:///modules/profile/base/opensshserver.config',
notify => Service['sshd'],
}
} elsif versioncmp($::facts['os']['release']['major'], '9') >= 0 {
} elsif versioncmp($::facts['os']['release']['major'], '9') == 0 and versioncmp($::facts['os']['release']['minor'], '8') < 0 {
# In RedHat 9, the sshd policies are defined as an include of the
# crypto policies. Parameters defined before the include supersede
# the crypto policy. The include is done in a file named 50-redhat.conf.
Expand All @@ -120,6 +120,19 @@
notify => Service['sshd'],
require => File['/etc/ssh/sshd_config.d'],
}
} elsif versioncmp($::facts['os']['release']['major'], '9') == 0 and versioncmp($::facts['os']['release']['minor'], '8') >= 0 {
# In RedHat 9, the sshd policies are defined as an include of the
# crypto policies. Parameters defined before the include supersede
# the crypto policy. The include is done in a file named 50-redhat.conf.
# RedHat 9.8 introduces support for Post-quantum Kex algorithms
file { '/etc/ssh/sshd_config.d/49-magic_castle.conf':
mode => '0600',
owner => 'root',
group => 'root',
source => 'puppet:///modules/profile/base/opensshserver-9.8.config',
notify => Service['sshd'],
require => File['/etc/ssh/sshd_config.d'],
}
}

sshd_config { 'tf_sshd_AuthenticationMethods':
Expand Down