Different crypto policies in RHEL&clones 7/8/9 and openSUSE (15.3)/15.4 #16

New issue

Open

opened 2023-03-17 07:19:49 +00:00 by svelt · 0 comments

svelt commented

2023-03-17 07:19:49 +00:00

Owner

RHEL7:

no includes in /etc/ssh/sshd_config due to 7.4
Snippets have to go to /etc/ssh/sshd_config
classic config

RHEL8:

no includes in /etc/ssh/sshd_config, 8.0 knows "Include"
/usr/lib/systemd/system/sshd(@).service has EnvironmentFile=-/etc/crypto-policies/back-ends/opensshserver.config
- sets CRYPTO_POLICY=-o... -o...
- command line: ExecStart=/usr/sbin/sshd -D $OPTIONS $CRYPTO_POLICY
variable based crypto policy (old: RedHat crypto policy way)

RHEL9:

Include /etc/ssh/sshd_config.d/*.conf (8.7)
- /etc/ssh/sshd_config.d/50-redhat.conf has /etc/ssh/sshd_config.d/50-redhat.conf
  - sshd_config-style snippet
settings based crypto policy (old: Fedora-template based)

openSUSE15.3:

no includes in /etc/ssh/sshd_config, 8.4 knows "Include"
classic config

openSUSE15.4:

no includes in /etc/ssh/sshd_config, 8.4 knows "Include"
/etc/crypto-policies/back-ends/opensshserver.config exists!
- but NOT included anywhere!
classic config FIXME

RHEL7: * no includes in `/etc/ssh/sshd_config` due to 7.4 * Snippets have to go to `/etc/ssh/sshd_config` * **classic config** RHEL8: * no includes in `/etc/ssh/sshd_config`, 8.0 knows "Include" * `/usr/lib/systemd/system/sshd(@).service` has `EnvironmentFile=-/etc/crypto-policies/back-ends/opensshserver.config` * sets `CRYPTO_POLICY=-o... -o...` * command line: `ExecStart=/usr/sbin/sshd -D $OPTIONS $CRYPTO_POLICY` * **variable based crypto policy** (old: RedHat crypto policy way) RHEL9: * `Include /etc/ssh/sshd_config.d/*.conf` (8.7) * `/etc/ssh/sshd_config.d/50-redhat.conf` has `/etc/ssh/sshd_config.d/50-redhat.conf ` * `sshd_config`-style snippet * **settings based crypto policy** (old: Fedora-template based) openSUSE15.3: * no includes in `/etc/ssh/sshd_config`, 8.4 knows "Include" * **classic config** openSUSE15.4: * no includes in `/etc/ssh/sshd_config`, 8.4 knows "Include" * `/etc/crypto-policies/back-ends/opensshserver.config` exists! * but NOT included anywhere! * **classic config** FIXME