Heh, I knew that was coming.

I'll put it on my list of patches I'm supposed to work on for the coming weekend, but unfortunately no promises at this point.

Trevor


On Tue, Sep 10, 2013 at 10:42 AM, Shawn Wells <shawn@redhat.com> wrote:
On 9/10/13 7:47 AM, Trevor Vaughan wrote:
I need to look through the SCAP code but, since the order of ciphers is unimportant on the daemon side, wouldn't you want the check side of this to be a regex such that people can use the same cipher setting for both ssh_config and sshd_config?

I would modify the order of the remediation statement in this patch to match the strong -> weak order as well as a hint to the local admin.

I tend to list from strongest to weakest for ssh_config and just re-use the string in sshd_config for consistency.

There should be a check (I apologize if there is and I just didn't check enough) for the Ciphers setting in ssh_config as well to order the ciphers from strongest to weakest since order matters in the client file.

Yes, I know that the client file can be overridden by the user but, since most users don't do that, it's a good idea to set it appropriately.

These are really good ideas. I've created a Trac ticket [1] to ensure this doesn't get stuck in mailing list limbo. Would you be willing to whip up a regex patch?

[1] https://fedorahosted.org/scap-security-guide/ticket/413

_______________________________________________
scap-security-guide mailing list
scap-security-guide@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide



--
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699
tvaughan@onyxpoint.com

-- This account not approved for unencrypted proprietary information --