diff --git a/tasks/configure-ssh-hardening.yml b/tasks/configure-ssh-hardening.yml index 1ce0dc2ebd46607450a6eda125385984dd3ce9da..cb01036b539b161ff751ffeb898b0f259bca74d1 100644 --- a/tasks/configure-ssh-hardening.yml +++ b/tasks/configure-ssh-hardening.yml @@ -47,5 +47,14 @@ MaxAuthTries 3 TCPKeepAlive no {{ "PasswordAuthentication no" if ansible_os_family == "Debian" else "PasswordAuthentication yes" }} + # disable weak host key algorithm ssh-dss (Digital Signature Algorithm (DSA) / Digital Signature Standard (DSS)) + # NVT OID: 1.3.6.1.4.1.25623.1.0.117687 + HostKeyAlgorithms -ssh-dss + # disable weak KEX algorithms + # NVT OID: 1.3.6.1.4.1.25623.1.0.150713 + KexAlgorithms -diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 + # disable weak Ciphers (crypto algorithms) + # NVT OID: 1.3.6.1.4.1.25623.1.0.105611 + Ciphers -3des-cbc,aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc notify: - restart sshd