From mboxrd@z Thu Jan 1 00:00:00 1970 Return-path: Received: from mail.pqgruber.com ([178.189.19.235]) by metis.ext.pengutronix.de with esmtps (TLS1.2:DHE_RSA_AES_256_CBC_SHA256:256) (Exim 4.80) (envelope-from ) id 1ZtLRG-0007Lr-9o for ptxdist@pengutronix.de; Mon, 02 Nov 2015 21:10:46 +0100 From: Clemens Gruber Date: Mon, 2 Nov 2015 21:10:41 +0100 Message-Id: <1446495041-20759-1-git-send-email-clemens.gruber@pqgruber.com> Subject: [ptxdist] [PATCH] openssh: harden security options and host keys List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Errors-To: ptxdist-bounces@pengutronix.de Sender: "ptxdist" To: ptxdist@pengutronix.de Cc: Clemens Gruber VGhlIHJjLm9uY2UuZCBzY3JpcHQgZ2VuZXJhdGVzIHRoZSBob3N0IGtleXMgd2hpY2ggYXJlIGVu YWJsZWQgaW4KdGhlIHNzZF9jb25maWcgZmlsZS4KRWQyNTUxOSBhbmQgUlNBIGFyZSB0aGUgZGVm YXVsdCBob3N0IGtleSBzaWduYXR1cmUgYWxnb3JpdGhtcyBhcwpib3RoIGRvIG5vdCBzb2xlbHkg cmVseSB1cG9uIGdvb2QgZW50cm9weSBzb3VyY2VzLgpEU0EgYW5kIEVDRFNBIGFyZSBub3QgcmVj b21tZW5kZWQgb24gZW1iZWRkZWQgc3lzdGVtcy4KVGhlIFNTSCBjb25maWd1cmF0aW9uIGlzIGhh cmRlbmVkOiBFbmFibGVkIHNhbmRib3hpbmcsIHJlZHVjZWQKbG9naW4gZ3JhY2UgdGltZSwgc3Ry aWN0IG1vZGUsIGV0Yy4KClNpZ25lZC1vZmYtYnk6IENsZW1lbnMgR3J1YmVyIDxjbGVtZW5zLmdy dWJlckBwcWdydWJlci5jb20+Ci0tLQogcHJvamVjdHJvb3QvZXRjL3JjLm9uY2UuZC9vcGVuc3No IHwgNjggKysrKysrKysrKysrKysrKysrLS0tLS0tLS0tLQogcHJvamVjdHJvb3QvZXRjL3NzaC9z c2hkX2NvbmZpZyAgIHwgOTUgKysrKysrKysrKysrKysrKysrKysrKy0tLS0tLS0tLS0tLS0tLS0t CiAyIGZpbGVzIGNoYW5nZWQsIDk3IGluc2VydGlvbnMoKyksIDY2IGRlbGV0aW9ucygtKQoKZGlm ZiAtLWdpdCBhL3Byb2plY3Ryb290L2V0Yy9yYy5vbmNlLmQvb3BlbnNzaCBiL3Byb2plY3Ryb290 L2V0Yy9yYy5vbmNlLmQvb3BlbnNzaAppbmRleCA4M2U2ZTM3Li42ZWQzYjIzIDEwMDY0NAotLS0g YS9wcm9qZWN0cm9vdC9ldGMvcmMub25jZS5kL29wZW5zc2gKKysrIGIvcHJvamVjdHJvb3QvZXRj L3JjLm9uY2UuZC9vcGVuc3NoCkBAIC0xLDMzICsxLDUzIEBACiAjIS9iaW4vc2gKIAotUEFUSD0v dXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3NiaW46L2JpbjovdXNyL3NiaW46L3Vzci9i aW4KK1BBVEg9L3NiaW46L2JpbjovdXNyL3NiaW46L3Vzci9iaW4KIAotT1BFTlNTSF9SU0FLRVlf REVGQVVMVD0iL2V0Yy9zc2gvc3NoX2hvc3RfcnNhX2tleSIKLU9QRU5TU0hfRFNBS0VZX0RFRkFV TFQ9Ii9ldGMvc3NoL3NzaF9ob3N0X2RzYV9rZXkiCi0KLXRlc3QgLW4gIiRPUEVOU1NIX1JTQUtF WSIgfHwgXAotCU9QRU5TU0hfUlNBS0VZPSRPUEVOU1NIX1JTQUtFWV9ERUZBVUxUCi10ZXN0IC1u ICIkT1BFTlNTSF9EU0FLRVkiIHx8IFwKLQlPUEVOU1NIX0RTQUtFWT0kT1BFTlNTSF9EU0FLRVlf REVGQVVMVAotCi1nZW5fa2V5KCkgewotCi0Ja2V5X3R5cGU9JDEKLQlrZXlfZmlsZT0kMgotCi0J cm0gLWYgJGtleV9maWxlID4gL2Rldi9udWxsIDI+JjEKLQotCWVjaG8gLW4gImdlbmVyYXRpbmcg JGtleV90eXBlIGtleS4uLiIKLQlzc2gta2V5Z2VuIC10ICRrZXlfdHlwZSAtZiAka2V5X2ZpbGUg LU4gIiIgPiAvZGV2L251bGwgMj4mMQorZ2V0X2hvc3RrZXlzKCkgeworCVsgLWYgL2V0Yy9zc2gv c3NoZF9jb25maWcgXSB8fCByZXR1cm4KKwlzZWQgLW4gJ3MvXkhvc3RLZXlbIFx0XVsgXHRdKlwo LipcKS9cMS9wJyAvZXRjL3NzaC9zc2hkX2NvbmZpZworfQogCi0JaWYgWyAiJD8iID0gIjAiIF07 IHRoZW4KLQkJZWNobyAiZG9uZSIKK2hvc3Rfa2V5c19yZXF1aXJlZCgpIHsKKwlob3N0a2V5cz0i JChnZXRfaG9zdGtleXMpIgorCWlmIFsgIiRob3N0a2V5cyIgXTsgdGhlbgorCQllY2hvICIkaG9z dGtleXMiCiAJZWxzZQotCQllY2hvICJmYWlsZWQiCi0JCWV4aXQgMQorCQkjIE5vIEhvc3RLZXkg ZGlyZWN0aXZlcyBmb3VuZCwgc28gd2UgcGljayBzZWN1cmUgZGVmYXVsdHMKKwkJZWNobyAvZXRj L3NzaC9zc2hfaG9zdF9lZDI1NTE5X2tleQorCQllY2hvIC9ldGMvc3NoL3NzaF9ob3N0X3JzYV9r ZXkKIAlmaQogfQogCi1nZW5fa2V5IHJzYSAiJE9QRU5TU0hfUlNBS0VZIgotZ2VuX2tleSBkc2Eg IiRPUEVOU1NIX0RTQUtFWSIKK2NyZWF0ZV9rZXkoKSB7CisJbXNnPSIkMSIKKwlzaGlmdAorCWhv c3RrZXlzPSIkMSIKKwlzaGlmdAorCWZpbGU9IiQxIgorCXNoaWZ0CisKKwlpZiBlY2hvICIkaG9z dGtleXMiIHwgZ3JlcCAteCAiJGZpbGUiID4vZGV2L251bGw7IHRoZW4KKwkJZWNobyAiJG1zZzsg dGhpcyBtYXkgdGFrZSBzb21lIHRpbWUgLi4uIgorCQlybSAtZiAkZmlsZSAmJgorCQlzc2gta2V5 Z2VuIC1xIC1mICIkZmlsZSIgLU4gJycgIiRAIiB8fCByZXR1cm4KKwkJZWNobyAiJG1zZzsgZG9u ZS4iCisJZmkKK30KKworY3JlYXRlX2tleXMoKSB7CisJaG9zdGtleXM9IiQoaG9zdF9rZXlzX3Jl cXVpcmVkKSIKKworCWNyZWF0ZV9rZXkgIkNyZWF0aW5nIERTQSBrZXkiIFwKKwkJIiRob3N0a2V5 cyIgL2V0Yy9zc2gvc3NoX2hvc3RfZHNhX2tleSAtdCBkc2EgJiYKKwljcmVhdGVfa2V5ICJDcmVh dGluZyBFQ0RTQSBrZXkiIFwKKwkJIiRob3N0a2V5cyIgL2V0Yy9zc2gvc3NoX2hvc3RfZWNkc2Ff a2V5IC10IGVjZHNhICYmCisJY3JlYXRlX2tleSAiQ3JlYXRpbmcgRUQyNTUxOSBrZXkiIFwKKwkJ IiRob3N0a2V5cyIgL2V0Yy9zc2gvc3NoX2hvc3RfZWQyNTUxOV9rZXkgLXQgZWQyNTUxOSAmJgor CWNyZWF0ZV9rZXkgIkNyZWF0aW5nIFJTQSBrZXkiIFwKKwkJIiRob3N0a2V5cyIgL2V0Yy9zc2gv c3NoX2hvc3RfcnNhX2tleSAtdCByc2EKK30KIAoraWYgISBjcmVhdGVfa2V5czsgdGhlbgorCWVj aG8gIkdlbmVyYXRpbmcgU1NIIGtleXMgZmFpbGVkISIKKwlleGl0IDEKK2ZpCmRpZmYgLS1naXQg YS9wcm9qZWN0cm9vdC9ldGMvc3NoL3NzaGRfY29uZmlnIGIvcHJvamVjdHJvb3QvZXRjL3NzaC9z c2hkX2NvbmZpZwppbmRleCA3Y2Q3ODk3Li4xMzU3YzY4IDEwMDY0NAotLS0gYS9wcm9qZWN0cm9v dC9ldGMvc3NoL3NzaGRfY29uZmlnCisrKyBiL3Byb2plY3Ryb290L2V0Yy9zc2gvc3NoZF9jb25m aWcKQEAgLTEsNTMgKzEsNTIgQEAKLSMJJE9wZW5CU0Q6IHNzaGRfY29uZmlnLHYgMS43MyAyMDA1 LzEyLzA2IDIyOjM4OjI4IHJleWsgRXhwICQKLQotIyBUaGlzIGlzIHRoZSBzc2hkIHNlcnZlciBz eXN0ZW0td2lkZSBjb25maWd1cmF0aW9uIGZpbGUuICBTZWUKLSMgc3NoZF9jb25maWcoNSkgZm9y IG1vcmUgaW5mb3JtYXRpb24uCi0KLSMgVGhpcyBzc2hkIHdhcyBjb21waWxlZCB3aXRoIFBBVEg9 L3Vzci9iaW46L2JpbjovdXNyL3NiaW46L3NiaW4KKyMgVGhpcyBpcyB0aGUgc3NoZCBzZXJ2ZXIg c3lzdGVtLXdpZGUgY29uZmlndXJhdGlvbiBmaWxlLgogCiAjIFRoZSBzdHJhdGVneSB1c2VkIGZv ciBvcHRpb25zIGluIHRoZSBkZWZhdWx0IHNzaGRfY29uZmlnIHNoaXBwZWQgd2l0aAogIyBPcGVu U1NIIGlzIHRvIHNwZWNpZnkgb3B0aW9ucyB3aXRoIHRoZWlyIGRlZmF1bHQgdmFsdWUgd2hlcmUK LSMgcG9zc2libGUsIGJ1dCBsZWF2ZSB0aGVtIGNvbW1lbnRlZC4gIFVuY29tbWVudGVkIG9wdGlv bnMgY2hhbmdlIGEKKyMgcG9zc2libGUsIGJ1dCBsZWF2ZSB0aGVtIGNvbW1lbnRlZC4gVW5jb21t ZW50ZWQgb3B0aW9ucyBvdmVycmlkZSB0aGUKICMgZGVmYXVsdCB2YWx1ZS4KKyMgQWx0ZXJuYXRp dmUgb3B0aW9ucyB3aGljaCBhcmUgbm90IG9uIGJ5IGRlZmF1bHQgYXJlIGNvbW1lbnRlZCBvdXQg d2l0aCAjIy4KKworIyBOb3RlOiBPbmx5IFNTSCBwcm90b2NvbCB2ZXJzaW9uIDIgaXMgc3VwcG9y dGVkLgogCi1Qb3J0IDIyCi1Qcm90b2NvbCAyCisjUG9ydCAyMgogI0FkZHJlc3NGYW1pbHkgYW55 CiAjTGlzdGVuQWRkcmVzcyAwLjAuMC4wCiAjTGlzdGVuQWRkcmVzcyA6OgogCi0jIEhvc3RLZXkg Zm9yIHByb3RvY29sIHZlcnNpb24gMQotI0hvc3RLZXkgL2V0Yy9zc2gvc3NoX2hvc3Rfa2V5Ci0j IEhvc3RLZXlzIGZvciBwcm90b2NvbCB2ZXJzaW9uIDIKKyMgSG9zdCBrZXlzCiBIb3N0S2V5IC9l dGMvc3NoL3NzaF9ob3N0X3JzYV9rZXkKLUhvc3RLZXkgL2V0Yy9zc2gvc3NoX2hvc3RfZHNhX2tl eQorSG9zdEtleSAvZXRjL3NzaC9zc2hfaG9zdF9lZDI1NTE5X2tleQogCi0jIExpZmV0aW1lIGFu ZCBzaXplIG9mIGVwaGVtZXJhbCB2ZXJzaW9uIDEgc2VydmVyIGtleQotI0tleVJlZ2VuZXJhdGlv bkludGVydmFsIDFoCi0jU2VydmVyS2V5Qml0cyA3NjgKKyMgRFNBIGFuZCBFQ0RTQSBob3N0IGtl eXMgKE5vdCByZWNvbW1lbmRlZCkKKyMjSG9zdEtleSAvZXRjL3NzaC9zc2hfaG9zdF9kc2Ffa2V5 CisjI0hvc3RLZXkgL2V0Yy9zc2gvc3NoX2hvc3RfZWNkc2Ffa2V5CisKKyMgQ2lwaGVycyBhbmQg a2V5aW5nCisjUmVrZXlMaW1pdCBkZWZhdWx0IG5vbmUKIAogIyBMb2dnaW5nCi0jIG9ic29sZXRl cyBRdWlldE1vZGUgYW5kIEZhc2Npc3RMb2dnaW5nCiAjU3lzbG9nRmFjaWxpdHkgQVVUSAogI0xv Z0xldmVsIElORk8KIAogIyBBdXRoZW50aWNhdGlvbjoKLQotI0xvZ2luR3JhY2VUaW1lIDJtCitM b2dpbkdyYWNlVGltZSAxbQogUGVybWl0Um9vdExvZ2luIHllcwotI1N0cmljdE1vZGVzIHllcwor U3RyaWN0TW9kZXMgeWVzCiAjTWF4QXV0aFRyaWVzIDYKKyNNYXhTZXNzaW9ucyAxMAogCiAjUlNB QXV0aGVudGljYXRpb24geWVzCiAjUHVia2V5QXV0aGVudGljYXRpb24geWVzCi0jQXV0aG9yaXpl ZEtleXNGaWxlCS5zc2gvYXV0aG9yaXplZF9rZXlzCisKK0F1dGhvcml6ZWRLZXlzRmlsZSAuc3No L2F1dGhvcml6ZWRfa2V5cworI0F1dGhvcml6ZWRLZXlzQ29tbWFuZCBub25lCisjQXV0aG9yaXpl ZEtleXNDb21tYW5kVXNlciBub2JvZHkKKyNBdXRob3JpemVkUHJpbmNpcGFsc0ZpbGUgbm9uZQog CiAjIEZvciB0aGlzIHRvIHdvcmsgeW91IHdpbGwgYWxzbyBuZWVkIGhvc3Qga2V5cyBpbiAvZXRj L3NzaC9zc2hfa25vd25faG9zdHMKLSNSaG9zdHNSU0FBdXRoZW50aWNhdGlvbiBubwotIyBzaW1p bGFyIGZvciBwcm90b2NvbCB2ZXJzaW9uIDIKICNIb3N0YmFzZWRBdXRoZW50aWNhdGlvbiBubwog IyBDaGFuZ2UgdG8geWVzIGlmIHlvdSBkb24ndCB0cnVzdCB+Ly5zc2gva25vd25faG9zdHMgZm9y Ci0jIFJob3N0c1JTQUF1dGhlbnRpY2F0aW9uIGFuZCBIb3N0YmFzZWRBdXRoZW50aWNhdGlvbgor IyBIb3N0YmFzZWRBdXRoZW50aWNhdGlvbgogI0lnbm9yZVVzZXJLbm93bkhvc3RzIG5vCiAjIERv bid0IHJlYWQgdGhlIHVzZXIncyB+Ly5yaG9zdHMgYW5kIH4vLnNob3N0cyBmaWxlcwogI0lnbm9y ZVJob3N0cyB5ZXMKQEAgLTY4LDM4ICs2Nyw1MCBAQCBQZXJtaXRSb290TG9naW4geWVzCiAjIEdT U0FQSSBvcHRpb25zCiAjR1NTQVBJQXV0aGVudGljYXRpb24gbm8KICNHU1NBUElDbGVhbnVwQ3Jl ZGVudGlhbHMgeWVzCi0KLSMgU2V0IHRoaXMgdG8gJ3llcycgdG8gZW5hYmxlIFBBTSBhdXRoZW50 aWNhdGlvbiwgYWNjb3VudCBwcm9jZXNzaW5nLCAKLSMgYW5kIHNlc3Npb24gcHJvY2Vzc2luZy4g SWYgdGhpcyBpcyBlbmFibGVkLCBQQU0gYXV0aGVudGljYXRpb24gd2lsbCAKLSMgYmUgYWxsb3dl ZCB0aHJvdWdoIHRoZSBDaGFsbGVuZ2VSZXNwb25zZUF1dGhlbnRpY2F0aW9uIG1lY2hhbmlzbS4g Ci0jIERlcGVuZGluZyBvbiB5b3VyIFBBTSBjb25maWd1cmF0aW9uLCB0aGlzIG1heSBieXBhc3Mg dGhlIHNldHRpbmcgb2YgCi0jIFBhc3N3b3JkQXV0aGVudGljYXRpb24sIFBlcm1pdEVtcHR5UGFz c3dvcmRzLCBhbmQgCi0jICJQZXJtaXRSb290TG9naW4gd2l0aG91dC1wYXNzd29yZCIuIElmIHlv dSBqdXN0IHdhbnQgdGhlIFBBTSBhY2NvdW50IGFuZCAKLSMgc2Vzc2lvbiBjaGVja3MgdG8gcnVu IHdpdGhvdXQgUEFNIGF1dGhlbnRpY2F0aW9uLCB0aGVuIGVuYWJsZSB0aGlzIGJ1dCBzZXQgCi0j IENoYWxsZW5nZVJlc3BvbnNlQXV0aGVudGljYXRpb249bm8KKyNHU1NBUElTdHJpY3RBY2NlcHRv ckNoZWNrIHllcworI0dTU0FQSUtleUV4Y2hhbmdlIG5vCisKKyMgU2V0IHRoaXMgdG8gJ3llcycg dG8gZW5hYmxlIFBBTSBhdXRoZW50aWNhdGlvbiwgYWNjb3VudCBwcm9jZXNzaW5nLAorIyBhbmQg c2Vzc2lvbiBwcm9jZXNzaW5nLiBJZiB0aGlzIGlzIGVuYWJsZWQsIFBBTSBhdXRoZW50aWNhdGlv biB3aWxsCisjIGJlIGFsbG93ZWQgdGhyb3VnaCB0aGUgQ2hhbGxlbmdlUmVzcG9uc2VBdXRoZW50 aWNhdGlvbiBhbmQKKyMgUGFzc3dvcmRBdXRoZW50aWNhdGlvbi4gIERlcGVuZGluZyBvbiB5b3Vy IFBBTSBjb25maWd1cmF0aW9uLAorIyBQQU0gYXV0aGVudGljYXRpb24gdmlhIENoYWxsZW5nZVJl c3BvbnNlQXV0aGVudGljYXRpb24gbWF5IGJ5cGFzcworIyB0aGUgc2V0dGluZyBvZiAiUGVybWl0 Um9vdExvZ2luIHdpdGhvdXQtcGFzc3dvcmQiLgorIyBJZiB5b3UganVzdCB3YW50IHRoZSBQQU0g YWNjb3VudCBhbmQgc2Vzc2lvbiBjaGVja3MgdG8gcnVuIHdpdGhvdXQKKyMgUEFNIGF1dGhlbnRp Y2F0aW9uLCB0aGVuIGVuYWJsZSB0aGlzIGJ1dCBzZXQgUGFzc3dvcmRBdXRoZW50aWNhdGlvbgor IyBhbmQgQ2hhbGxlbmdlUmVzcG9uc2VBdXRoZW50aWNhdGlvbiB0byAnbm8nLgogI1VzZVBBTSBu bwogCisjQWxsb3dBZ2VudEZvcndhcmRpbmcgeWVzCiAjQWxsb3dUY3BGb3J3YXJkaW5nIHllcwog I0dhdGV3YXlQb3J0cyBubwogI1gxMUZvcndhcmRpbmcgbm8KICNYMTFEaXNwbGF5T2Zmc2V0IDEw CiAjWDExVXNlTG9jYWxob3N0IHllcworI1Blcm1pdFRUWSB5ZXMKICNQcmludE1vdGQgeWVzCiAj UHJpbnRMYXN0TG9nIHllcwogI1RDUEtlZXBBbGl2ZSB5ZXMKICNVc2VMb2dpbiBubwotI1VzZVBy aXZpbGVnZVNlcGFyYXRpb24geWVzCitVc2VQcml2aWxlZ2VTZXBhcmF0aW9uIHNhbmRib3gKICNQ ZXJtaXRVc2VyRW52aXJvbm1lbnQgbm8KICNDb21wcmVzc2lvbiBkZWxheWVkCiAjQ2xpZW50QWxp dmVJbnRlcnZhbCAwCiAjQ2xpZW50QWxpdmVDb3VudE1heCAzCi0jVXNlRE5TIHllcworI1VzZURO UyBubwogI1BpZEZpbGUgL3Zhci9ydW4vc3NoZC5waWQKLSNNYXhTdGFydHVwcyAxMAorTWF4U3Rh cnR1cHMgMTA6MzA6NjAKICNQZXJtaXRUdW5uZWwgbm8KLQotIyBubyBkZWZhdWx0IGJhbm5lciBw YXRoCi0jQmFubmVyIC9zb21lL3BhdGgKLQotIyBvdmVycmlkZSBkZWZhdWx0IG9mIG5vIHN1YnN5 c3RlbXMKLVN1YnN5c3RlbQlzZnRwCS91c3Ivc2Jpbi9zZnRwLXNlcnZlcgorI0Nocm9vdERpcmVj dG9yeSBub25lCisjVmVyc2lvbkFkZGVuZHVtIG5vbmUKKyNCYW5uZXIgbm9uZQorCisjIERpc2Fi bGUgVENQS2VlcEFsaXZlIHRvIHByZXZlbnQgVENQIHNwb29maW5nIGF0dGFja3MuIEl0IGlzIHJl cGxhY2VkIGJ5CisjIENsaWVudEFsaXZlSW50ZXJ2YWwsIHdoaWNoIHNlbmRzIGEgbnVsbCBwYWNr ZXQgZXZlcnkgNjAgc2Vjb25kcyBvdmVyIHRoZQorIyBlbmNyeXB0ZWQgY2hhbm5lbC4gVW5yZXNw b25zaXZlIGNsaWVudHMgYXJlIGRpc2Nvbm5lY3RlZCBhZnRlciAzIG1pbnV0ZXMuCisjI1RDUEtl ZXBBbGl2ZSBubworIyNDbGllbnRBbGl2ZUludGVydmFsIDYwCisjI0NsaWVudEFsaXZlQ291bnRN YXggMworCisjIEVuYWJsZSB0aGUgU1NIIEZpbGUgVHJhbnNmZXIgUHJvdG9jb2wKK1N1YnN5c3Rl bSBzZnRwIC91c3IvbGliZXhlYy9zZnRwLXNlcnZlcgotLSAKMi42LjIKCgotLSAKcHR4ZGlzdCBt YWlsaW5nIGxpc3QKcHR4ZGlzdEBwZW5ndXRyb25peC5kZQo=