Merge pull request #437 from BenjaminBoehm/bugfix/ssh-kex-sntrup-openssh8.5

schurzi · web-flow · commit add303f2be6c · 2021-04-01T21:13:50.000+02:00
Fix ssh kex sntrup761x25519-sha512@openssh.com for openssh &gt;= 8.5
diff --git a/roles/ssh_hardening/tasks/crypto_kex.yml b/roles/ssh_hardening/tasks/crypto_kex.yml
@@ -13,3 +13,8 @@
   set_fact:
     ssh_kex: '{{ ssh_kex_80_default }}'
   when: sshd_version is version('8.0', '>=')
+
+- name: Set kex according to openssh-version if openssh >= 8.5
+  set_fact:
+    ssh_kex: '{{ ssh_kex_85_default }}'
+  when: sshd_version is version('8.5', '>=')
diff --git a/roles/ssh_hardening/vars/main.yml b/roles/ssh_hardening/vars/main.yml
@@ -50,3 +50,8 @@ ssh_kex_80_default:
   - sntrup4591761x25519-sha512@tinyssh.org
   - curve25519-sha256@libssh.org
   - diffie-hellman-group-exchange-sha256
+
+ssh_kex_85_default:
+  - sntrup761x25519-sha512@openssh.com
+  - curve25519-sha256@libssh.org
+  - diffie-hellman-group-exchange-sha256

-Original file line number
+Diff line change
   - [email protected]
   - [email protected]
   - diffie-hellman-group-exchange-sha256
++
 +ssh_kex_85_default:
 +  - [email protected]
 +  - [email protected]
 +  - diffie-hellman-group-exchange-sha256