Merge pull request dev-sec#270 from foonix/rhel6-sha2-hmacs

Use sha2 HMACs on RHEL 6 / CentOS 6.
divialth · Apr 13, 2020 · ac9fd3a · ac9fd3a
2 parents 26676a2 + fc854b4
commit ac9fd3a
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 0 deletions.
diff --git a/defaults/main.yml b/defaults/main.yml
@@ -171,6 +171,10 @@ ssh_macs_53_default:
   - hmac-ripemd160
   - hmac-sha1
 
+ssh_macs_53_el_6_5_default:
+  - hmac-sha2-512
+  - hmac-sha2-256
+
 ssh_macs_59_default:
   - hmac-sha2-512
   - hmac-sha2-256

diff --git a/tasks/crypto.yml b/tasks/crypto.yml
@@ -32,6 +32,14 @@
     ssh_macs: '{{ ssh_macs_59_default }}'
   when: sshd_version is version('5.9', '>=') and not ssh_macs
 
+- name: set macs for Enterprise Linux >= 6.5 (openssh 5.3 with backports)
+  set_fact:
+    ssh_macs: '{{ ssh_macs_53_el_6_5_default }}'
+  when:
+    - ansible_distribution in ['CentOS', 'OracleLinux', 'RedHat']
+    - ansible_distribution_version is version('6.5', '>=')
+    - not ssh_macs
+
 - name: set macs according to openssh-version
   set_fact:
     ssh_macs: '{{ ssh_macs_53_default }}'