search

dev-sec / ssh-baseline

DevSec SSH Baseline - InSpec Profile
https://dev-sec.io/baselines/ssh/
Apache License 2.0
283 stars 78 forks source link

Should compression be opt-in? #78

Open lpirl opened 7 years ago

lpirl commented 7 years ago

According to this thread, compression can be vulnerable to CRIME/BREACH attacks (if the encrypted data carries public data as well).

I am not into crypto but I guess compression should be opt-in, at least, shouldn't it?

(This issue was migrated here from dev-sec/ansible-ssh-hardening#90)

artem-sidorenko commented 7 years ago

@lpirl thanks for raising this question

@atomic111 opinion?

atomic111 commented 7 years ago

@lpirl we can add the attribute, but the default value should be no. there was some vulnerabilities in the zlib compression. my approach is to reduce attack surface and only activate features that you relly need. i agree to the thread, that it would be really hard to exploit this flaw. My recommendation is to disable the compression stuff.

lpirl commented 7 years ago

@atomic111 right, I completely agree with your comment why it should be turned off – even if it is not a big thing.

So you say including the attribute is not crucial since it is disabled per default anyway?

I'd expect that explicitly disabling compression would suggest users/admins that it is generally a good idea to disable it since the hardening profile disabled it explicitly.

atomic111 commented 7 years ago

@lpirl perfect.

sgupta commented 6 years ago

Looks there is no more discussion on this but just checking if option to disable compression added in future releases.

chris-rock commented 6 years ago

Any PR to get this option in is welcome!