Chapter 1. Using secure communications between two systems with OpenSSH

Procedure

1. To configure the host key creation in RHEL, use the sshd-keygen@.service instantiated service. For example, to disable the automatic creation of the RSA key type:

   # systemctl mask sshd-keygen@rsa.service

   Note

   In images with the cloud-init method enabled, the ssh-keygen units are automatically disabled. This is because the ssh-keygen template service can interfere with the cloud-init tool and cause problems with host key generation. To prevent these problems, the etc/systemd/system/sshd-keygen@.service.d/disable-sshd-keygen-if-cloud-init-active.conf drop-in configuration file disables the ssh-keygen units if cloud-init is running.

2. Because OpenSSH creates RSA, ECDSA, and Ed25519 server host keys automatically if they are missing, remove the keys with less secure cryptography:

   # rm -f /etc/ssh/ssh_host_rsa_key

3. To allow only a particular key type for SSH connections, uncomment the relevant line in /etc/ssh/sshd_config. For example, to allow only Ed25519 host keys, the corresponding lines must be as follows:

   # HostKey /etc/ssh/ssh_host_rsa_key
   # HostKey /etc/ssh/ssh_host_ecdsa_key
   HostKey /etc/ssh/ssh_host_ed25519_key

4. Restart the sshd service:

   # systemctl restart sshd

Procedure

1. Create a new configuration file with a name that lexicographically precedes 50-redhat.conf, for example:

   # touch /etc/ssh/sshd_config.d/49-crypto-policy-override.conf

2. Open the file in a text editor, and specify ciphers and message authentication codes (MACs) you want to allow, for example:

   Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com
   MACs hmac-sha2-512,hmac-sha2-256

3. Save the changes, and reload the sshd service:

   # systemctl reload sshd

Procedure

1. Open the /etc/ssh/sshd_config configuration file in a text editor of your choice.

2. Remove the # character before the Port directive and specify a port number different from 22, for example:

   Port <49286>

3. Update the default SELinux policy to allow the use of a non-default port:

   # semanage port -a -t ssh_port_t -p tcp <49286>

4. Update the firewalld configuration:

   # firewall-cmd --add-port <49286>/tcp
   # firewall-cmd --remove-port=22/tcp
   # firewall-cmd --runtime-to-permanent

5. Restart the sshd service:

   # systemctl restart sshd

Procedure

1. Create a playbook file, for example, ~/playbook.yml, with the following content:

   ---
   - name: SSH server configuration
     hosts: managed-node-01.example.com
     tasks:
       - name: Configure sshd to prevent root and password login except from particular subnet
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.sshd
         vars:
           sshd_config:
             PermitRootLogin: no
             PasswordAuthentication: no
             Match:
               - Condition: "Address 192.0.2.0/24"
                 PermitRootLogin: yes
                 PasswordAuthentication: yes

   The settings specified in the example playbook include the following:

   PasswordAuthentication: yes|no

   Controls whether the OpenSSH server (sshd) accepts authentication from clients that use the username and password combination.

   Match:

   The match block allows the root user to log in by using a password only from the subnet 192.0.2.0/24.

   For details about the role variables and the OpenSSH configuration options used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.sshd/README.md file and the sshd_config(5) manual page on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Verification

1. Log in to the SSH server:

   $ ssh <username>@<ssh_server>

2. Verify the contents of the sshd_config file on the SSH server:

   $ cat /etc/ssh/sshd_config.d/00-ansible_system_role.conf
   #
   # Ansible managed
   #
   PasswordAuthentication no
   PermitRootLogin no
   Match Address 192.0.2.0/24
     PasswordAuthentication yes
     PermitRootLogin yes

3. Check that you can connect to the server as root from the 192.0.2.0/24 subnet:

   1. Determine your IP address:

      $ hostname -I
      192.0.2.1

      If the IP address is within the 192.0.2.1 - 192.0.2.254 range, you can connect to the server.

   2. Connect to the server as root:

      $ ssh root@<ssh_server>

Procedure

1. Create a playbook file, for example, ~/playbook.yml, with the following content:

   • For managed nodes that run RHEL 8 or earlier:

     ---
     - name: Non-exclusive sshd configuration
       hosts: managed-node-01.example.com
       tasks:
         - name: Configure SSHD to accept environment variables
           ansible.builtin.include_role:
             name: redhat.rhel_system_roles.sshd
           vars:
             sshd_config_namespace: <my_application>
             sshd_config:
               # Environment variables to accept
               AcceptEnv:
                 LANG
                 LS_COLORS
                 EDITOR

   • For managed nodes that run RHEL 9 or later:

     - name: Non-exclusive sshd configuration
       hosts: managed-node-01.example.com
       tasks:
         - name: Configure sshd to accept environment variables
           ansible.builtin.include_role:
             name: redhat.rhel_system_roles.sshd
           vars:
             sshd_config_file: /etc/ssh/sshd_config.d/<42-my_application>.conf
             sshd_config:
               # Environment variables to accept
               AcceptEnv:
                 LANG
                 LS_COLORS
                 EDITOR

     The settings specified in the example playbooks include the following:

     sshd_config_namespace: <my_application>

     The role places the configuration that you specify in the playbook to configuration snippets in the existing configuration file under the given namespace. You need to select a different namespace when running the role from a different context.

     sshd_config_file: /etc/ssh/sshd_config.d/<42-my_application>.conf

     In the sshd_config_file variable, define the .conf file into which the sshd system role writes the configuration options. Use a two-digit prefix, for example 42- to specify the order in which the configuration files are applied.

     AcceptEnv:

     Controls which environment variables the OpenSSH server (sshd) accepts from a client:

     • LANG: defines the language and locale settings.
     • LS_COLORS: defines the displaying color scheme for the ls command on the command line.
     • EDITOR: specifies the default text editor for the command-line programs that need to open an editor.

     For details about the role variables and the OpenSSH configuration options used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.sshd/README.md file and the sshd_config(5) manual page on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Procedure

1. Create a playbook file, for example, ~/playbook.yml, with the following content:

   - name: Deploy SSH configuration for OpenSSH server
     hosts: managed-node-01.example.com
     tasks:
       - name: Overriding the system-wide cryptographic policy
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.sshd
         vars:
           sshd_sysconfig: true
           sshd_sysconfig_override_crypto_policy: true
           sshd_KexAlgorithms: ecdh-sha2-nistp521
           sshd_Ciphers: aes256-ctr
           sshd_MACs: hmac-sha2-512-etm@openssh.com
           sshd_HostKeyAlgorithms: rsa-sha2-512,rsa-sha2-256

   The settings specified in the example playbook include the following:

   sshd_KexAlgorithms

   You can choose key exchange algorithms, for example, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521,diffie-hellman-group14-sha1, or diffie-hellman-group-exchange-sha256.

   sshd_Ciphers

   You can choose ciphers, for example, aes128-ctr, aes192-ctr, or aes256-ctr.

   sshd_MACs

   You can choose MACs, for example, hmac-sha2-256, hmac-sha2-512, or hmac-sha1.

   sshd_HostKeyAlgorithms

   You can choose a public key algorithm, for example, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521, or ssh-rsa.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.sshd/README.md file on the control node.

   Note

   On RHEL 9 managed nodes, the system role writes the configuration into the /etc/ssh/sshd_config.d/00-ansible_system_role.conf file, where cryptographic options are applied automatically. You can change the file by using the sshd_config_file variable. However, to ensure the configuration is effective, use a file name that lexicographically precedes the /etc/ssh/sshd_config.d/50-redhat.conf file, which includes the configured crypto policies.

   On RHEL 8 managed nodes, you must enable override by setting the sshd_sysconfig_override_crypto_policy and sshd_sysconfig variables to true.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Procedure

1. Create a playbook file, for example, ~/playbook.yml, with the following content:

   ---
   - name: SSH client configuration
     hosts: managed-node-01.example.com
     tasks:
       - name: Configure ssh clients
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.ssh
         vars:
           ssh_user: root
           ssh:
             Compression: true
             GSSAPIAuthentication: no
             ControlMaster: auto
             ControlPath: ~/.ssh/.cm%C
             Host:
               - Condition: example
                 Hostname: server.example.com
                 User: user1
           ssh_ForwardX11: no

   The settings specified in the example playbook include the following:

   ssh_user: root

   Configures the root user’s SSH client preferences on the managed nodes with certain configuration specifics.

   Compression: true

   Compression is enabled.

   ControlMaster: auto

   ControlMaster multiplexing is set to auto.

   Host

   Creates alias example for connecting to the server.example.com host as a user called user1.

   ssh_ForwardX11: no

   X11 forwarding is disabled.

   For details about the role variables and the OpenSSH configuration options used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.ssh/README.md file and the ssh_config(5) manual page on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml