diff mbox series

[v2,2/2] use custom SSH client configuration in LFS file

Message ID 20180910142909.5725-2-peter.mueller@link38.eu
State Accepted
Commit cc3e41cb8b0b7d713ce15a7177d1bbda7778b2ca
Headers
Series [v2,1/2] add hardened SSH client configuration |

Commit Message

Peter Müller Sept. 11, 2018, 12:29 a.m. UTC 
  Include OpenSSH client configuration file during build.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
---
 lfs/openssh | 5 +++++
 1 file changed, 5 insertions(+)

Comments

Michael Tremer Sept. 11, 2018, 1:37 a.m. UTC | #1 
Hello,

did you notice that this file is excluded from being updated on existing
installations?

How do we handle any custom changes from users here?

I merged this for new installations already.

-Michael

On Mon, 2018-09-10 at 16:29 +0200, Peter Müller wrote:
> Include OpenSSH client configuration file during build.
> 
> Signed-off-by: Peter Müller <peter.mueller@link38.eu>
> ---
>  lfs/openssh | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/lfs/openssh b/lfs/openssh
> index a88b2d126..0e6acc227 100644
> --- a/lfs/openssh
> +++ b/lfs/openssh
> @@ -100,5 +100,10 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
>  		-e 's|^#\?HostKey /etc/ssh/ssh_host_ed25519_key$$||' \
>  		-e 's|^#\?HostKey /etc/ssh/ssh_host_rsa_key$$|HostKey
> /etc/ssh/ssh_host_ecdsa_key\nHostKey /etc/ssh/ssh_host_ed25519_key\nHostKey
> /etc/ssh/ssh_host_rsa_key|' \
>  		/etc/ssh/sshd_config
> +
> +	# install custom OpenSSH client configuration
> +	install -v -m 644 $(DIR_SRC)/config/ssh/ssh_config \
> +		/etc/ssh/ssh_config
> +
>  	@rm -rf $(DIR_APP)
>  	@$(POSTBUILD)
Peter Müller Sept. 11, 2018, 1:48 a.m. UTC | #2 
Hello Michael,

> Hello,
> 
> did you notice that this file is excluded from being updated on existing
> installations?
no - but I should have thought about that. :-\
> 
> How do we handle any custom changes from users here?
The only possibility of keeping the user's settings is to move existing
SSH client configurations to a new location, replace /etc/ssh/ssh_config
with this one and include the version before.

However, I strongly advise against this. (For example, some settings
in the original config might revert hardening options, causing no security
benefit after all.)

Since it is "just" the client configuration, I consider overwriting it
the best procedure. Of course, there has to be a yellow warning box in
the release notes, but it is better than no hardening at all.
> 
> I merged this for new installations already.
Great. SSH server configuration will follow.

Best regards,
Peter Müller
> 
> -Michael
> 
> On Mon, 2018-09-10 at 16:29 +0200, Peter Müller wrote:
>> Include OpenSSH client configuration file during build.
>>
>> Signed-off-by: Peter Müller <peter.mueller@link38.eu>
>> ---
>>  lfs/openssh | 5 +++++
>>  1 file changed, 5 insertions(+)
>>
>> diff --git a/lfs/openssh b/lfs/openssh
>> index a88b2d126..0e6acc227 100644
>> --- a/lfs/openssh
>> +++ b/lfs/openssh
>> @@ -100,5 +100,10 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
>>  		-e 's|^#\?HostKey /etc/ssh/ssh_host_ed25519_key$$||' \
>>  		-e 's|^#\?HostKey /etc/ssh/ssh_host_rsa_key$$|HostKey
>> /etc/ssh/ssh_host_ecdsa_key\nHostKey /etc/ssh/ssh_host_ed25519_key\nHostKey
>> /etc/ssh/ssh_host_rsa_key|' \
>>  		/etc/ssh/sshd_config
>> +
>> +	# install custom OpenSSH client configuration
>> +	install -v -m 644 $(DIR_SRC)/config/ssh/ssh_config \
>> +		/etc/ssh/ssh_config
>> +
>>  	@rm -rf $(DIR_APP)
>>  	@$(POSTBUILD)
>
diff mbox series

Patch

diff --git a/lfs/openssh b/lfs/openssh
index a88b2d126..0e6acc227 100644
--- a/lfs/openssh
+++ b/lfs/openssh
@@ -100,5 +100,10 @@  $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 		-e 's|^#\?HostKey /etc/ssh/ssh_host_ed25519_key$$||' \
 		-e 's|^#\?HostKey /etc/ssh/ssh_host_rsa_key$$|HostKey /etc/ssh/ssh_host_ecdsa_key\nHostKey /etc/ssh/ssh_host_ed25519_key\nHostKey /etc/ssh/ssh_host_rsa_key|' \
 		/etc/ssh/sshd_config
+
+	# install custom OpenSSH client configuration
+	install -v -m 644 $(DIR_SRC)/config/ssh/ssh_config \
+		/etc/ssh/ssh_config
+
 	@rm -rf $(DIR_APP)
 	@$(POSTBUILD)