Dear Maintainer,

I've written up a few new tests to extend those available for SSH in
Lynis.

The tests perform the following checks:
    1.  Verify LoginGraceTime is configured and recommends a shorter on
        than the default.
    2.  Verify that MaxAuthTries is configured in sshd_config and
        recommends fewer than the default.
    3.  Tests to see if DebianBanner is disabled in sshd_config.
    4.  Tests KexAlgorithms to verify that only those that are
        sufficiently secure are enabled.
    5.  Tests MACs to verify that only those that are
        sufficiently secure are enabled.
    6.  Tests Ciphers to verify that only those that are
        sufficiently secure are enabled.

I had the idea for the last three tests after reading the
recommendations to harden SSH on:

https://stribika.github.io/2015/01/04/secure-secure-shell.html

Additionally, a Nessus scan offered two warnings:
    1.  SSH Weak MAC Algorithms Enabled
    2.  SSH Server CBC Mode Ciphers Enabled

This inspired me to see if a few changes would improve the security of
the SSH server and from the limited results I detail below, I think you
will agree that these changes were worth doing so I wanted a few tests
for Lynis to make them easier to verify are in place on any systems I
manage.

I tested the settings for KexAlgorithms, MACs and Ciphers on a system
exposed on the internet, where I found that by modifying KexAlgorithms
from the default to what was recommended that the number of attempts to
guess passwords on my system when down by approximately 1/80.  Rather
than be able to guess a username & password, the vast majority of
brute-force attempts were denied with a "fatal: Unable to negotiate a
key exchange method" log message.  A few made it passed that and were
caught by the MACs or Ciphers options but it drove down the number of
attempts that were seen to fail2ban needed to deal with.  So far down
that the attempts did not occur frequently enough to exceed fail2ban's
thresholds.

I also tested connecting to my system with default configurations with
SSH on a Debian host, putty on Windows and Juice SSH on Android.  All
were able to connect with the modified KexAlgorithms, MACs and Ciphers.
I was unable to test it with SSH from an Apple host but I don't believe
it should be an issue.

So what do you think, are these tests worth including in tests_ssh for
Lynis?

Thanks,

Dave

I just installed the latest update to Lynis 2.0 on my Sid workstation.
When I installed the package, your note was present by apt-listchanges.
Thanks for highlighting my submission.

However, one point in your note jumped out to my attention and that was
the idea that updates to the tests should be included in the Debian
plugin whenever possible.  And that makes a lot of sense for these
tests, especially the DebianBanner test.  Therefore, if you will hold
off on testing these tests, I will work to move them into the Debian
plugin and hopefully submit the updates before another update to Lynis
is in the works.

With any luck, I will have these ready for resubmission in a day or two
but no promises.  Wish me luck!

OK, I've basically finished moving the SSH tests to the Debian Plugin.
I've attached a diff for adding them to plugin_debian_phase1 for your
consideration.

There are a few other updates to previous tests (for example for
dm-crypt & cryptmount) and I've added initial tests for Fail2ban.

What do you think, should we add these to the Debian plugin?

Thanks,

Dave

Hi Dave,

El vie, 03-04-2015 a las 10:06 -0600, Dave Vehrs escribió:

By now, I think ssh tests available in upstream release will be in
their location. I'll add the rest of your test to plugin_debian_phase1.

This way I avoid to have to patch original tests file.
Why did you add ssh test (SSH-7402) to plugin_debian_phase1?.


All your test are really fine.
Thank you for your work.

I am working with your tests and testing the new Debian revision to
upload it.


Regards,
Francisco.