Merge pull request dev-sec#254 from lunarthegrey/patch-1

Support KEX for OpenSSH 8.0+ & quantum resistant KEX
divialth · Jan 17, 2020 · bdec4fa · bdec4fa
2 parents 6c8259f + 83882de
commit bdec4fa
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 0 deletions.
diff --git a/defaults/main.yml b/defaults/main.yml
@@ -209,6 +209,11 @@ ssh_kex_59_default:
 ssh_kex_66_default:
   - [email protected]
   - diffie-hellman-group-exchange-sha256
+
+ssh_kex_80_default:
+  - [email protected]
+  - [email protected]
+  - diffie-hellman-group-exchange-sha256
 
 # directory where to store ssh_password policy
 ssh_custom_selinux_dir: '/etc/selinux/local-policies'

diff --git a/tasks/crypto.yml b/tasks/crypto.yml
@@ -51,6 +51,11 @@
 
 ###
 
+- name: set kex according to openssh-version if openssh >= 8.0
+  set_fact:
+    ssh_kex: '{{ ssh_kex_80_default }}'
+  when: sshd_version.stdout is version('8.0', '>=') and not ssh_kex
+
 - name: set kex according to openssh-version if openssh >= 6.6
   set_fact:
     ssh_kex: '{{ ssh_kex_66_default }}'