could ssh-audit print desired config or add Generic guide documentation

[daniejstriata]

Can ssh-audit not print out the desired sshd config as an option or will it be possible to add a generic section to the guides? There are no guides for RHEL 9 based distros yet. I have some items I'm unsure how to resolve. Like:

• key algorithm to change (increase modulus size to 3072 bits or larger)
  I have updated my moduli from the commands given in the hardening guide.

[jtesta]

an ssh-audit not print out the desired sshd config as an option

This would require ssh-audit to be able to precisely identify the server's precise OpenSSH version. This isn't as easy as it sounds, as some distros back-port changes without bumping version numbers.

will it be possible to add a generic section to the guides?

I'm not sure what you mean here. The guides are very specific to each OS/platform otherwise the commands would fail.

I have some items I'm unsure how to resolve. Like: key algorithm to change (increase modulus size to 3072 bits or larger)

Sounds like this is a failure related to your RSA host keys. This would be fixed by re-generating them using ssh-keygen -t rsa -b 3072 -f /path/to/your/RSA/key

[daniejstriata]

@jtesta
I'm happy with the existing process and just thought if there could be a desired config for a distro as is currently done from the website then I could harden sites without access to the internet but then I can just as well get the commands before the hardening is applied.
I thought something like:

ssh-audit --Centos7-sshd_config or
ssh-audit --RHEL9-sshd_config
ssh-audit --RHEL9-ssh_config
and print out the same command you'd find on the web for those distros.

What I mean with a generic guide is that I have / had some older hosts where I compile openssh from source and replace the default package. When I apply the guide matching the OS (like Centos 7) I don't get a flawless audit but what you mentioned last, about regenerating the rsa key. Now that makes sense as I could not do that step for the host in question without reaching out to external parties connecting to the server first.

[jtesta]

I thought something like:

ssh-audit --Centos7-sshd_config or
ssh-audit --RHEL9-sshd_config
ssh-audit --RHEL9-ssh_config

Ahh, I see what you mean. Sure, that would be pretty straightforward to add, but that would also increase my ongoing maintenance costs. I already feel like I'm always slightly behind, so perhaps this won't get implemented for the time being.

However, if enough people want this feature, I'll certainly reconsider. Feel free to vote on this issue by adding a thumbs-up emoji to this comment.