dev-sec / dev-sec/chef-ssh-hardening
Allow setting a different port for the client and the server
Nobody has claimed this yet.
- Dominant language
- Ruby
- Stars
- 168
- Forks
- 66
- Avg merge
- 9h 10m
- Merged PRs (30d)
- 2
Description
Is your feature request related to a problem? Please describe.
I have changed the ports attribute in order to avoid attackers to find it to easily but this cookbook change both the server and client config.
This makes any commands, depending on ssh, to use the server port as client so that a git ls-remote command fails because of the client Port config which isn't 22 anymore.
Describe the solution you'd like
In order to avoid a breaking change, the default['ssh-hardening']['ssh']['ports'] Array should allow integers and Hashes, so that both should work, with the Hash one allowing to tell a port for the sever, and a port for the client like that:
default['ssh-hardening']['ssh']['ports'] = [
{ server: 12345, client: 54321 }
]
or to tell only the sever or the client port:
default['ssh-hardening']['ssh']['ports'] = [
{ server: 12345 }
]
Implementing this is easy and gives flexibility to the operator to configure SSH.
Describe alternatives you've considered
A workaround is to create a file ~/.ssh/config containing Port 22.
Additional context
In my case, I'm deploying a Rails app with Capistrano which first tries the git ls-remote git@gitlab.com:group/project.git and it fails.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the default['ssh-hardening']['ssh']['ports'] attribute and the cookbook entry points that generate client and server SSH configuration. Trace how integer port values are handled today, then verify that hash forms can specify either or both ports while existing integer configuration remains valid; done means client commands can use a different port without changing the server port.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ruby
- Domain
- devops, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100