client audit vs client hardening guide

[jugmac00]

Hi @jtesta

I just discovered the client hardening mode.

I run Ubuntu 18.04 on my laptop.

I applied the changes from your hardening guide

https://www.ssh-audit.com/hardening_guides.html#ubuntu_18_04_linux_mint_19

and then I started the client audit via python3.8 ssh-audit.py -c and then on a second terminal, I sshed into localhost port 2222.

Expected I expected all output to be green.

what I got

# general
(gen) client IP: 127.0.0.1
(gen) banner: SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.3
(gen) software: OpenSSH 7.6p1
(gen) compression: enabled (zlib@openssh.com, zlib)

# key exchange algorithms
(kex) curve25519-sha256                         -- [info] available since OpenSSH 7.4, Dropbear SSH 2018.76
(kex) curve25519-sha256@libssh.org              -- [info] available since OpenSSH 6.5, Dropbear SSH 2013.62
(kex) ecdh-sha2-nistp256                        -- [fail] using weak elliptic curves
                                                `- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
(kex) ecdh-sha2-nistp384                        -- [fail] using weak elliptic curves
                                                `- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
(kex) ecdh-sha2-nistp521                        -- [fail] using weak elliptic curves
                                                `- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
(kex) diffie-hellman-group-exchange-sha256      -- [info] available since OpenSSH 4.4
(kex) diffie-hellman-group16-sha512             -- [info] available since OpenSSH 7.3, Dropbear SSH 2016.73
(kex) diffie-hellman-group18-sha512             -- [info] available since OpenSSH 7.3
(kex) diffie-hellman-group-exchange-sha1        -- [fail] removed (in server) since OpenSSH 6.7, unsafe algorithm
                                                `- [warn] using weak hashing algorithm
                                                `- [info] available since OpenSSH 2.3.0
(kex) diffie-hellman-group14-sha256             -- [info] available since OpenSSH 7.3, Dropbear SSH 2016.73
(kex) diffie-hellman-group14-sha1               -- [warn] using weak hashing algorithm
                                                `- [info] available since OpenSSH 3.9, Dropbear SSH 0.53
(kex) ext-info-c

# host-key algorithms
(key) ecdsa-sha2-nistp256-cert-v01@openssh.com  -- [fail] using weak elliptic curves
                                                `- [warn] using weak random number generator could reveal the key
                                                `- [info] available since OpenSSH 5.7
(key) ecdsa-sha2-nistp384-cert-v01@openssh.com  -- [fail] using weak elliptic curves
                                                `- [warn] using weak random number generator could reveal the key
                                                `- [info] available since OpenSSH 5.7
(key) ecdsa-sha2-nistp521-cert-v01@openssh.com  -- [fail] using weak elliptic curves
                                                `- [warn] using weak random number generator could reveal the key
                                                `- [info] available since OpenSSH 5.7
(key) ssh-ed25519-cert-v01@openssh.com          -- [info] available since OpenSSH 6.5
(key) ssh-rsa-cert-v01@openssh.com              -- [info] available since OpenSSH 5.6
(key) ecdsa-sha2-nistp256                       -- [fail] using weak elliptic curves
                                                `- [warn] using weak random number generator could reveal the key
                                                `- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
(key) ecdsa-sha2-nistp384                       -- [fail] using weak elliptic curves
                                                `- [warn] using weak random number generator could reveal the key
                                                `- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
(key) ecdsa-sha2-nistp521                       -- [fail] using weak elliptic curves
                                                `- [warn] using weak random number generator could reveal the key
                                                `- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
(key) ssh-ed25519                               -- [info] available since OpenSSH 6.5
(key) rsa-sha2-512                              -- [info] available since OpenSSH 7.2
(key) rsa-sha2-256                              -- [info] available since OpenSSH 7.2
(key) ssh-rsa                                   -- [fail] using weak hashing algorithm
                                                `- [info] available since OpenSSH 2.5.0, Dropbear SSH 0.28

# encryption algorithms (ciphers)
(enc) chacha20-poly1305@openssh.com             -- [info] available since OpenSSH 6.5
                                                `- [info] default cipher since OpenSSH 6.9.
(enc) aes128-ctr                                -- [info] available since OpenSSH 3.7, Dropbear SSH 0.52
(enc) aes192-ctr                                -- [info] available since OpenSSH 3.7
(enc) aes256-ctr                                -- [info] available since OpenSSH 3.7, Dropbear SSH 0.52
(enc) aes128-gcm@openssh.com                    -- [info] available since OpenSSH 6.2
(enc) aes256-gcm@openssh.com                    -- [info] available since OpenSSH 6.2

# message authentication code algorithms
(mac) umac-64-etm@openssh.com                   -- [warn] using small 64-bit tag size
                                                `- [info] available since OpenSSH 6.2
(mac) umac-128-etm@openssh.com                  -- [info] available since OpenSSH 6.2
(mac) hmac-sha2-256-etm@openssh.com             -- [info] available since OpenSSH 6.2
(mac) hmac-sha2-512-etm@openssh.com             -- [info] available since OpenSSH 6.2
(mac) hmac-sha1-etm@openssh.com                 -- [warn] using weak hashing algorithm
                                                `- [info] available since OpenSSH 6.2
(mac) umac-64@openssh.com                       -- [warn] using encrypt-and-MAC mode
                                                `- [warn] using small 64-bit tag size
                                                `- [info] available since OpenSSH 4.7
(mac) umac-128@openssh.com                      -- [warn] using encrypt-and-MAC mode
                                                `- [info] available since OpenSSH 6.2
(mac) hmac-sha2-256                             -- [warn] using encrypt-and-MAC mode
                                                `- [info] available since OpenSSH 5.9, Dropbear SSH 2013.56
(mac) hmac-sha2-512                             -- [warn] using encrypt-and-MAC mode
                                                `- [info] available since OpenSSH 5.9, Dropbear SSH 2013.56
(mac) hmac-sha1                                 -- [warn] using encrypt-and-MAC mode
                                                `- [warn] using weak hashing algorithm
                                                `- [info] available since OpenSSH 2.1.0, Dropbear SSH 0.28

# algorithm recommendations (for OpenSSH 7.6)
(rec) -diffie-hellman-group-exchange-sha1       -- kex algorithm to remove 
(rec) -ecdh-sha2-nistp256                       -- kex algorithm to remove 
(rec) -ecdh-sha2-nistp384                       -- kex algorithm to remove 
(rec) -ecdh-sha2-nistp521                       -- kex algorithm to remove 
(rec) -ecdsa-sha2-nistp256                      -- key algorithm to remove 
(rec) -ecdsa-sha2-nistp256-cert-v01@openssh.com -- key algorithm to remove 
(rec) -ecdsa-sha2-nistp384                      -- key algorithm to remove 
(rec) -ecdsa-sha2-nistp384-cert-v01@openssh.com -- key algorithm to remove 
(rec) -ecdsa-sha2-nistp521                      -- key algorithm to remove 
(rec) -ecdsa-sha2-nistp521-cert-v01@openssh.com -- key algorithm to remove 
(rec) -ssh-rsa                                  -- key algorithm to remove 
(rec) -diffie-hellman-group14-sha1              -- kex algorithm to remove 
(rec) -hmac-sha1                                -- mac algorithm to remove 
(rec) -hmac-sha1-etm@openssh.com                -- mac algorithm to remove 
(rec) -hmac-sha2-256                            -- mac algorithm to remove 
(rec) -hmac-sha2-512                            -- mac algorithm to remove 
(rec) -umac-128@openssh.com                     -- mac algorithm to remove 
(rec) -umac-64-etm@openssh.com                  -- mac algorithm to remove 
(rec) -umac-64@openssh.com                      -- mac algorithm to remove 

# additional info
(nfo) For hardening guides on common OSes, please see: <https://www.ssh-audit.com/hardening_guides.html>

My ssh config contains some jumphost configurtations, and then on the bottom your suggested changes which I echoed into the file.

# lots of hosts...

Host xxx
    Hostname 192.168.1.220
    ProxyJump yyy

Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256
MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com
HostKeyAlgorithms ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com

I tried to google about client hardening, but almost all information out there is about server hardening.

Any hint for me what to do?

Thanks!

[jtesta]

I tried to google about client hardening, but almost all information out there is about server hardening.

Well, there's my blog post on this topic: https://www.positronsecurity.com/blog/2020-01-07-ssh-client-auditing-and-hardening/

Any hint for me what to do?

I suppose I don't understand what the problem is. Did my hardening guide not result in all green output?

[jugmac00]

I suppose I don't understand what the problem is. Did my hardening guide not result in all green output?

Yes, that is the problem.

I followed your instruction by echoing your recommendations into my ~/.ssh/config file.

Then I started the client audit mode.. (Python 3.8 - and latest commit from your dev branch)

When I ssh into localhost -p 22222 in a second terminal, I get this output in the first terminal (where I started the client audit )...

I know your blog article, but it also did not solve my problem. I tried to look for other information on how the config file has to be structured so I could get a hint where the problem is, but I did not find any info out there.

As I assume your hardening information are correct (as you tried them), I can only guess my config file does not get used or there is a syntax error inside so some information get ignored. Or maybe there is a os-wide setting which weighs heigher?

On the other hand, my ~/.ssh/config file works - as I use the jump hosts for my work.

So I am left clueless at the moment.

[jugmac00]

Ok. I figured it out.

The cipher (et al) config has to be put on the top of the ssh-config file - otherwise it seems it gets ignored.

This is the reason I tried to find information about how the structure of a client config file has to look.

Damn you SSH for not throwing an error :-)

Maybe it is possible that you update your hardening guides?

I guess I am not the only one with some basic ssh config.

[jugmac00]

I guess I figured it out.

In man 5 ssh_config you can read

Host Restricts the following declarations (up to the next Host or Match keyword) to be only for those hosts that match one of the patterns given after the keyword.

Yep. So I configured some hosts - then I echoed your configurations into my config file and thus the hardening infos only apply to my last configured host oO

[jtesta]

Oh ok. Yes, I suppose I do need to update the guides so they put the options at the top of the config file.

[sleepnmojo]

The guide just needs to add "Host *\n" before "Ciphers". The current guide just adds the values to the last host.

If you put it at the top of the file, that will become the default for all hosts. If you need to override any of the values, then those hosts would need to go above the defaults.

[MestreLion]

@sleepnmojo : so you suggest that the best solution is to add Host *\n at the beginning of the block but keep the block itself at the end of the file?

[sleepnmojo]

@MestreLion correct

People would need to understand if they put Ciphers, KexAlgorithms, MACs, or HostKeyAlgorithms in any Host above, then that value will be used for that Host. This is true for the topmost Host * as well.

Example:

# This host will use the defaults in the first Host *
Host tank
  HostName 192.168.0.5
  Port 2222
  User user1

# Override MACs for an old system
Host www
  HostName www.example.com
  MACs hmac-sha2-256

# user defaults
Host *
  Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
  KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256
  MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com
  HostKeyAlgorithms ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com

# preferred order for my system, will be ignored
Host *
  Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,chacha20-poly1305@openssh.com
  KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
  MACs umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
  HostKeyAlgorithms ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-512

[MestreLion]

Ok, just did this (using the Host * trick), and the local audit (installing from pip) gives me all green.

But... https://www.sshaudit.com/ Client Audit gives me C- 70/100. Looking at the results, i see this in "Host Key Types": ssh-rsa-cert-v01@openssh.com SHA-1 has exploitable weaknesses. Score capped at 70.

Problem is: rsa-cert-v01@openssh.com is indeed included in HostKeyAlgorithms from the Hardening Guide for Ubuntu 18.14. Why is the guide suggesting a SHA-1 algo that is considered by its own website to be exploitable/weak?

Furthermore: if the website complains about this, why doesn't the local tool installed from pip?

[jtesta]

@jugmac00 @MestreLion I fixed the hardening guides months ago, but forgot to update you about it. Please let me know if you notice any other problems!

@sleepnmojo Thanks for the suggestion! I've updated the hardening guides with them.

[jugmac00]

@jtesta Thanks a lot. Works like a charm. Thanks for updating the guide!