Skip to content
This repository was archived by the owner on Dec 26, 2020. It is now read-only.

Macs kex ciphers #139

Merged
merged 6 commits into from
Dec 29, 2017
Merged

Macs kex ciphers #139

merged 6 commits into from
Dec 29, 2017

Conversation

rndmh3ro
Copy link
Member

@rndmh3ro rndmh3ro commented Oct 29, 2017

This PR changes the logic, which macs, kex and cipher to use. For one, it moves the evaluation to the tasks instead of the templates (similar to the hostkey-logic).
It also lets the conficuration depend on the installed ssh-version, not the operating system.

It also add support for ssh 7.6 where ripemd is removed (fixes #135).

@rndmh3ro rndmh3ro changed the title Macs kex ciphers [WIP] Macs kex ciphers Oct 29, 2017
@rndmh3ro rndmh3ro changed the title [WIP] Macs kex ciphers Macs kex ciphers Oct 29, 2017
- name: set hostkeys according to openssh-version
set_fact:
ssh_host_key_files: ['/etc/ssh/ssh_host_rsa_key']
when: sshd_version.stdout >= '5.3' and not ssh_host_key_files
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would do that using one set_fact or even better in the defaults file. Something like:

ssh_host_key_files: '{{ ['/etc/ssh/ssh_host_rsa_key'] if sshd_version.stdout >= '6.0' else ... }}'

This way, the whole file can be reduced to Jinja2 templating in defaults/main.yml. This also helps with performance :)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tried and did not find a proper solution with the correct syntax.

                       "[/etc/ssh/ssh_host_rsa_key, /etc/ssh/ssh_host_ecdsa_key]" if sshd_version.stdout >= 6.0 else \  }}
                       "[/etc/ssh/ssh_host_rsa_key, /etc/ssh/ssh_host_ecdsa_key, /etc/ssh/ssh_host_ed25519_key]" if sshd_version.stdout >= 6.3 }}'```

This and variations of it do not work. They always give some error like:
```       fatal: [localhost]: FAILED! => {"msg": "Unexpected templating type error occurred on ({{ssh_host_key_files}}): __init__() takes at least 3 arguments (2 given)"}

- "openssh-client"
- "openssh-server"
ignore_errors: true
- file: path="/var/run/sshd" state=directory
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please always use YAML syntax.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll fix this in a separate PR where I'll change it everywhere.

@@ -275,3 +240,4 @@ Match User {{ item.user }}
{{ item.rules | indent(4) }}
{% endfor %}
{% endif %}

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why add a trailing empty line :) ? This is usually unneeded. Maybe you will find https://github.com/ypid/dotfiles/blob/33ec82ad4bf59409a37891086c765e58c06713a6/vimrc#L888-L898 useful depending on your editor.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed, thanks.

@rndmh3ro
Copy link
Member Author

@ypid can you take a look again?

Copy link
Member

@atomic111 atomic111 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rndmh3ro it looks good from my point of view. great!!! any objection? otherwise i would merge it

@atomic111
Copy link
Member

thanks @rndmh3ro, great work!!!

@atomic111 atomic111 merged commit eaab080 into master Dec 29, 2017
@rndmh3ro rndmh3ro deleted the macs_kex_ciphers branch December 29, 2017 09:50
# for free to subscribe to this conversation on GitHub. Already have an account? #.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

line 56: Bad SSH2 mac spec
4 participants