<commit_before>[package]
name        = "hologram-openssh"
version     = "1.4.1"
description = "hologram: hardened OpenSSH server"
requires    = [
    "holo>=0.10",
    "openssh",
]

# enable SSH daemon
[[symlink]]
path   = "/etc/systemd/system/multi-user.target.wants/sshd.service"
target = "/usr/lib/systemd/system/sshd.service"

# extend the default SSH configuration with recommendations from
# https://stribika.github.io/2015/01/04/secure-secure-shell.html
#
# XXX WARNING: There's a typo in here; it should be "ed25519" instead of "ed22519".
# I will fix this when I rotate SSH keys the next time.
# Ref: https://github.com/majewsky/system-configuration/issues/3
[[file]]
path   = "/usr/share/holo/files/10-openssh/etc/ssh/sshd_config.holoscript"
mode   = "0755"
content = """
    #!/bin/sh
    cat
    cat <<-'EOF'

    # custom settings
    KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256

    Protocol 2
    HostKey /etc/ssh/ssh_host_ed22519_key
    HostKey /etc/ssh/ssh_host_rsa_key

    PasswordAuthentication no
    ChallengeResponseAuthentication no
    PubkeyAuthentication yes

    Ciphers <EMAIL>,<EMAIL>,<EMAIL>,aes256-ctr,aes192-ctr,aes128-ctr

    MACs <EMAIL>-sha2-512-etm<EMAIL>,<EMAIL>-sha2-256-etm@<EMAIL>,<EMAIL>,<EMAIL>,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,<EMAIL>
    EOF
"""

# protect against CVE-2016-0777
[[file]]
path    = "/usr/share/holo/files/10-openssh/etc/ssh/ssh_config.holoscript"
mode    = "0755"
content = """
    #!/bin/sh
    echo 'UseRoaming no'
    cat
"""<commit_msg>hologram-openssh: OpenSSH 7.6 compatibility, remove old cruft<commit_after>[package]
name        = "hologram-openssh"
version     = "1.5.0"
description = "hologram: hardened OpenSSH server"
requires    = [ "openssh" ]

# enable SSH daemon
[[symlink]]
path   = "/etc/systemd/system/multi-user.target.wants/sshd.service"
target = "/usr/lib/systemd/system/sshd.service"

# extend the default SSH configuration with recommendations from
# https://stribika.github.io/2015/01/04/secure-secure-shell.html
# NOTE: support for hmac-ripemd160 MAC has been removed in OpenSSH 7.6
#
# XXX WARNING: There's a typo in here; it should be "ed25519" instead of "ed22519".
# I will fix this when I rotate SSH keys the next time.
# Ref: https://github.com/majewsky/system-configuration/issues/3
[[file]]
path   = "/usr/share/holo/files/10-openssh/etc/ssh/sshd_config.holoscript"
mode   = "0755"
content = """
    #!/bin/sh
    cat
    cat <<-'EOF'

    # custom settings
    KexAlgorithms <EMAIL>25519-sha256<EMAIL>,diffie-hellman-group-exchange-sha256

    Protocol 2
    HostKey /etc/ssh/ssh_host_ed22519_key
    HostKey /etc/ssh/ssh_host_rsa_key

    PasswordAuthentication no
    ChallengeResponseAuthentication no
    PubkeyAuthentication yes

    Ciphers <EMAIL>,<EMAIL>,<EMAIL>,aes256-ctr,aes192-ctr,aes128-ctr

    MACs hmac-sha2-512-etm<EMAIL>,hmac-sha2-256-etm@openssh.com,umac-128-etm<EMAIL>,hmac-sha2-512,hmac-sha2-256,umac-128<EMAIL>
    EOF
"""
{'fraction_non_alphanumeric': 0.13855421686746988, 'fraction_numerical': 0.05789825970548862, 'mean_word_length': 3.7747603833865813, 'pattern_counts': {'":': 0, '<': 25, '<?xml version=': 0, '>': 22, 'https://': 4, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 2, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6686389', 'n_tokens_mistral': 1250, 'n_tokens_neox': 1097, 'n_words': 208}