On 9/10/13 7:47 AM, Trevor Vaughan wrote:
I need to look through the SCAP code but, since the order of ciphers
is unimportant on the daemon side, wouldn't you want the check side of
this to be a regex such that people can use the same cipher setting
for both ssh_config and sshd_config?
I would modify the order of the remediation statement in this patch to
match the strong -> weak order as well as a hint to the local admin.
I tend to list from strongest to weakest for ssh_config and just
re-use the string in sshd_config for consistency.
There should be a check (I apologize if there is and I just didn't
check enough) for the Ciphers setting in ssh_config as well to order
the ciphers from strongest to weakest since order matters in the
client file.
Yes, I know that the client file can be overridden by the user but,
since most users don't do that, it's a good idea to set it appropriately.
These are really good ideas. I've created a Trac ticket [1] to ensure
this doesn't get stuck in mailing list limbo. Would you be willing to
whip up a regex patch?
[1]
https://fedorahosted.org/scap-security-guide/ticket/413