dev-sec / dev-sec/chef-ssh-hardening

Allow setting a different port for the client and the server

Open
#240 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Ruby
Stars
168
Forks
66
Avg merge
9h 10m
Merged PRs (30d)
2

Description

Is your feature request related to a problem? Please describe.
I have changed the ports attribute in order to avoid attackers to find it to easily but this cookbook change both the server and client config.
This makes any commands, depending on ssh, to use the server port as client so that a git ls-remote command fails because of the client Port config which isn't 22 anymore.

Describe the solution you'd like
In order to avoid a breaking change, the default['ssh-hardening']['ssh']['ports'] Array should allow integers and Hashes, so that both should work, with the Hash one allowing to tell a port for the sever, and a port for the client like that:

default['ssh-hardening']['ssh']['ports'] = [
  { server: 12345, client: 54321 }
]

or to tell only the sever or the client port:

default['ssh-hardening']['ssh']['ports'] = [
  { server: 12345 }
]

Implementing this is easy and gives flexibility to the operator to configure SSH.

Describe alternatives you've considered

A workaround is to create a file ~/.ssh/config containing Port 22.

Additional context

In my case, I'm deploying a Rails app with Capistrano which first tries the git ls-remote git@gitlab.com:group/project.git and it fails.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the default['ssh-hardening']['ssh']['ports'] attribute and the cookbook entry points that generate client and server SSH configuration. Trace how integer port values are handled today, then verify that hash forms can specify either or both ports while existing integer configuration remains valid; done means client commands can use a different port without changing the server port.

Written by the indexing model from the issue text.

Assessment

Tech stack
ruby
Domain
devops, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.