ssh — format of ssh component configuration
General syntax rules of Kernun Firewall configuration files are described in configuration(7). This man page describes types, sections and items specific for the ssh component configuration.
Repeatable sections/items are marked by
the '*' before section/item name.
Configuration directives have attributes of several value-types. For the basic types description, see configuration(7).
Enumeration is a list of words (names) representing integer values. Some enumerations accept both names and direct integer values; in this case, enumeration description contains values for every name (in parenthesis next to name). For other enumerations, using of names is obligatory.
The following enumerations are used in ssh configuration directives:
ip-version (see common(5))osi4-proto (see common(5))listen-on-sock (see listen-on(5))ssh-key-type (name-usage obligatory)SSH key types.
ssh-rsa, ssh-ed25519
ssh-proto (name-usage optional)SSH protocol numbers.
ssh-2 (2)
Configuration of ssh library component consists of following prototypes:
* ssh-key2 ... ;
* ssh-server name { ... }
ssh-key2 email type key [ignored];SSH Version 2 key.
email (type: str)Owner email address.
type (type: ssh-key-type)key (type: str)ignored (type: str, optional, default: <NULL>)Elem ignored, retained due to backward compatibility.
ssh-server name {
phase ... ;
* tag ... ;
listen-on { ... }
protocol ... ;
passwd-auth ... ;
ciphers ... ;
kex-algorithms ... ;
macs ... ;
* option ... ;
* subsystem ... ;
}
SSH server definition.
Each configured ssh server is started via standard Kernun startup mechanism (e.g. has its own rc-script) and as such will be handled by KAT program like regular proxy.
The ssh server configuration created by CML is based on values of this section configuration items. Additionally, following options are hardcoded as changes of default values:
PermitRootLogin without-password
ChallengeResponseAuthentication no
Addresses to listen on must be specified.
phase [number];Application Startup Phase.
number (type: uint8, optional, default: 30)Phase number; the lower one, the earlier start.
tag value;Configuration factorization tag.
This feature allows admin to create groups of Kernun applications (specially proxies and servers) according to various aspects (belonging to one customer, applications of particular network traffic etc.).
Each application can have several tag attributes and the KAT tool can run some commands (like 'ps', 'start' atc.) for applications with or without given tag.
value (type: str)Tag must contain letters, digits, hyphens and dots, only.
listen-on {
* socket ... ;
}
listen-on section is derived from
listen-on section prototype.
For detail description of it, see listen-on(5).
listen-on section:Item non-transparent used as socket.
Item transparent is not valid.
At least one address to listen on must be specified.
socket (see listen-on(5))Element port is optional, default: 22.
Element proto is optional, default: tcp.
protocol list;Protocol ordering.
If omitted, only SSHv2 is accepted.
list (type: ssh-proto-list)List of protocol numbers.
Protocol list must contain just one item (ssh-2).
passwd-auth;Enable password authentication for non-root users.
This item affects setting of PasswordAuthentication option to YES.
ciphers [list];List of allowed ciphers.
list (type: str, optional, default: "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc")kex-algorithms [list];List of allowed key exchange algorithms.
list (type: str, optional, default: "diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521")macs [list];List of allowed MAC (message authentication code) algorithms.
list (type: str, optional, default: "umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128@openssh.com,hmac-sha2-256")option name value;Additional server configuration options.
name (type: str)Option name.
value (type: str)Option value.
subsystem name cmd;External subsystem definition.
name (type: str)Subsystem name.
cmd (type: str)Command to execute.
[End of section ssh-server description.]