On 9/10/13 7:47 AM, Trevor Vaughan wrote:These are really good ideas. I've created a Trac ticket [1] to ensure this doesn't get stuck in mailing list limbo. Would you be willing to whip up a regex patch?
I need to look through the SCAP code but, since the order of ciphers is unimportant on the daemon side, wouldn't you want the check side of this to be a regex such that people can use the same cipher setting for both ssh_config and sshd_config?
I would modify the order of the remediation statement in this patch to match the strong -> weak order as well as a hint to the local admin.
I tend to list from strongest to weakest for ssh_config and just re-use the string in sshd_config for consistency.
There should be a check (I apologize if there is and I just didn't check enough) for the Ciphers setting in ssh_config as well to order the ciphers from strongest to weakest since order matters in the client file.
Yes, I know that the client file can be overridden by the user but, since most users don't do that, it's a good idea to set it appropriately.
[1] https://fedorahosted.org/scap-security-guide/ticket/413
_______________________________________________
scap-security-guide mailing list
scap-security-guide@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide