Merge branch 'pr307_revision_2' into print_guide_v2

src/ssh_audit/globals.py

@@ -38,6 +38,3 @@
 
 # Error message when installed as a Snap package and a file access fails.
 SNAP_PERMISSIONS_ERROR = 'Error while accessing file.  It appears that ssh-audit was installed as a Snap package.  In that case, there are two options:  1.) only try to read & write files in the $HOME/snap/ssh-audit/common/ directory, or 2.) grant permissions to read & write files in $HOME using the following command: "sudo snap connect ssh-audit:home :home"'
-
-# Last update to Hardening Guides
-GUIDES_UPDATED = "2024-10-01"

src/ssh_audit/printconfig.py → src/ssh_audit/hardeningguides.py

@@ -1,140 +1,216 @@
+"""
+   The MIT License (MIT)
+
+   Copyright (C) 2020-2024 Joe Testa ([email protected])
+
+   Permission is hereby granted, free of charge, to any person obtaining a copy
+   of this software and associated documentation files (the "Software"), to deal
+   in the Software without restriction, including without limitation the rights
+   to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+   copies of the Software, and to permit persons to whom the Software is
+   furnished to do so, subject to the following conditions:
+
+   The above copyright notice and this permission notice shall be included in
+   all copies or substantial portions of the Software.
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+   IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+   AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+   LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+   OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+   THE SOFTWARE.
+"""
+from typing import Dict, Any
 import sys
 
 from ssh_audit import exitcodes
 from ssh_audit.globals import VERSION
-from ssh_audit.globals import GUIDES_UPDATED
 
 
-class PrintConfig:
+
+BUILTIN_GUIDES: Dict[str, Dict[str, Any]] = {
+
+    # Server
+    # Amazon Server
+    'Amazon 2023 Server (version 1)': {'version': '1', 'changelog': {'2024-10-01': 'Re-ordered host keys to prioritize ED25519 due to efficiency. Re-ordered cipher list to prioritize larger key sizes as a countermeasure to quantum attacks', '2024-04-22': 'added connection throttling instructions to counteract the DHEat denial-of-service attack.', '2024-03-15': 'Initial revision'}, 'server_policy': True},
+
+    # Debian Server
+    'Debian Bullseye Server (version 1)': {'version': '1', 'changelog': {'2021-09-17': 'Initial Revision.'}, 'server_policy': True},
+    'Debian Bookworm Server (version 1)': {'version': '1', 'changelog': {'2021-09-17': 'Initial Revision.'}, 'server_policy': True},
+
+    # Rocky Linux
+    'Rocky 9 Server (version 1)': {'version': '1', 'changelog': {'2024-10-01': 'Re-ordered host keys to prioritize ED25519 due to efficiency. Re-ordered cipher list to prioritize larger key sizes as a countermeasure to quantum attacks', '\n2024-04-24': 'Added connection throttling instructions to counteract the DHEat denial-of-service attack.'}, 'server_policy': True},
+
+    # Ubuntu Server
+    'Ubuntu 2004 Server (version 1)': {'version': '1', 'changelog': {'2024-04-24': '\nAdded connection throttling instructions to counteract the DHEat denial-of-service attack.'}, 'server_policy': True},
+    'Ubuntu 2204 Server (version 1)': {'version': '1', 'changelog': {'2024-10-01': '\nRe-ordered host keys to prioritize ED25519 due to efficiency. \nRe-ordered cipher list to prioritize larger key sizes as a countermeasure to quantum attacks', '\n2024-04-22': '\nAdded connection throttling instructions to counteract the DHEat denial-of-service attack.'}, 'server_policy': True},
+    'Ubuntu 2404 Server (version 1)': {'version': '1', 'changelog': {'2024-10-01': '\nAdded Required RSASize directive to enforce a minimum of 3072-bit user and host-based authentication keys.', '\n2024-04-29': '\nInitial revision. In comparison to Ubuntu 22.04 LTS guide, the following changes were made: \n1.) For key exchanges, diffie-hellman-group18-sha512 and diffie-hellman-group-exchange-sha256 were prioritized over diffie-hellman-group16-sha512 due to greater security strength; GSS algorithms were prioritized over their non-GSS equivalents in order to match the client guide, \n2.) For ciphers, 256-bit AES ciphers were prioritized over 192 and 128-bit AES ciphers due to their increased resistence against quantum computing attacks (previously, weaker GCM ciphers had priority over CTR ciphers), \n3.) The HostbasedAcceptedAlgorithms and PubkeyAcceptedAlgorithms settings are now the same as HostKeyAlgorithms setting, \n4.) The [email protected] MAC was increased in priority due to its increased resistence against quantum computing attacks, and \n5.) The ED25519 host keys were given priority over RSA host keys due to their greater efficiency.'}, 'server_policy': True},
+
+    # Client
+    # Amazon
+    'Amazon 2023 Client (version 1)': {'version': '1', 'changelog': {'2024-10-01': 'Re-ordered cipher list to prioritize larger key sizes as a countermeasure to quantum attacks.', '2024-04-22': 'added connection throttling instructions to counteract the DHEat denial-of-service attack.', '2024-03-15': 'Initial revision'}, 'server_policy': False},
+
+    # Debian
+    'Debian Bookworm Client (version 1)': {'version': '1', 'changelog': {'2024-10-01': 'Added RequiredRSASize directive to enforce a minimum of 3072-bit user and host-based authentication keys. Re-ordered cipher list to prioritize larger key sizes as a countermeasure to quantum attacks.', '2024-03-15': 'Initial Revision'}, 'server_policy': False},
+
+    # Rocky Linux
+    'Rocky 9 Client (version 1)': {'version': '1', 'changelog': {'2024-10-01': 'Added RequiredRSASize directive to enforce a minimum of 3072-bit user and host-based authentication keys. Re-ordered cipher list to prioritize larger key sizes as a countermeasure to quantum attacks.', '2024-03-15': 'Initial Revision'}, 'server_policy': False},
+
+    # Mint
+    'Mint 20 Client (version 1)': {'version': '1', 'changelog': {'2020-10-20': 'Initial Revision'}, 'server_policy': False},
+    'Mint 21 Client (version 1)': {'version': '1', 'changelog': {'2020-10-20': 'Initial Revision'}, 'server_policy': False},
+    'Mint 22 Client (version 1)': {'version': '1', 'changelog': {'2020-10-20': 'Initial Revision'}, 'server_policy': False},
+
+    # Ubuntu
+    'Ubuntu 2004 Client (version 1)': {'version': '1', 'changelog': {'2020-10-20': 'Initial Revision'}, 'server_policy': False},
+    'Ubuntu 2204 Client (version 1)': {'version': '1', 'changelog': {'2020-10-20': 'Initial Revision'}, 'server_policy': False},
+    'Ubuntu 2404 Client (version 1)': {'version': '1', 'changelog': {'2020-10-20': 'Initial Revision'}, 'server_policy': False},
+}
+
+
+
+class PrintHardeningGuides:
     def __init__(self, os_type: str, os_ver: str, clientserver: str) -> None:
         self.os_type = os_type
         self.os_ver = os_ver
         self.clientserver = clientserver
 
-        self.Get_Config()
+        self.get_config()
+
+    def get_config(self) -> None:
 
-    def Get_Config(self) -> None:
         retval = exitcodes.GOOD
 
         os_type = self.os_type
         os_ver = self.os_ver
         clientserver = self.clientserver
+        policy_name = os_type + " " + os_ver + " " + clientserver
 
         supported_os = ["Amazon", "Debian", "Mint", "Rocky", "Ubuntu"]
         supported_edition = ["2404", "2204", "2004", "1804", "2023", "22", "21", "20", "9", "Bookworm", "Bullseye"]
         if clientserver not in ["Server", "Client"] or os_type not in supported_os and os_ver not in supported_edition:
-            PrintConfig.unknown_varient(os_type, os_ver, clientserver)
-            sys.exit(retval)
-        else:
-            print(" ")
-            print(f"\033[1mSSH-Audit Version : {VERSION}\033[0m")
             print(" ")
-            print(f"\033[1mBGuides Last modified : {GUIDES_UPDATED}\033[0m")
+            print(f"\033[1mssh-audit Version : {VERSION}\033[0m")
             print(" ")
-            print(f"\033[1mLocating configuration for {os_type} {os_ver} - {clientserver}\033[0m")
-            print(" ")
-
+            print(f"\033[1mConfiguration : {os_type} {os_ver} {clientserver} is not supported\033[0m")
+            PrintHardeningGuides.supported_varient()
+            sys.exit(retval)
 
         # Server Configs
         if clientserver in ["Server"]:
             # Amazon Linux
             if os_type in ["Amazon"] and os_ver in ["2023"]:
-                PrintConfig.server_modern_common()
-                PrintConfig.amazon_server_2023()
+                PrintHardeningGuides.print_ver_changelog(policy_name)
+                PrintHardeningGuides.server_modern_common()
+                PrintHardeningGuides.amazon_server_2023()
                 sys.exit(retval)
             # Debian
             elif os_type in ["Debian"] and os_ver in ["Bookworm"]:
-                PrintConfig.server_modern_common()
-                PrintConfig.bookworm_server()
-                PrintConfig.debian_ubuntu_rate_throttling()
+                PrintHardeningGuides.print_ver_changelog(policy_name)
+                PrintHardeningGuides.server_modern_common()
+                PrintHardeningGuides.bookworm_server()
+                PrintHardeningGuides.debian_ubuntu_rate_throttling()
                 sys.exit(retval)
             elif os_type in ["Debian"] and os_ver in ["Bullseye"]:
-                PrintConfig.server_modern_common()
-                PrintConfig.bullseye_server()
+                PrintHardeningGuides.print_ver_changelog(policy_name)
+                PrintHardeningGuides.server_modern_common()
+                PrintHardeningGuides.bullseye_server()
                 sys.exit(retval)
             # Rocky Linux
             elif os_type in ["Rocky"] and os_ver in ["9"]:
-                PrintConfig.server_modern_common()
-                PrintConfig.rocky_9_server()
+                PrintHardeningGuides.print_ver_changelog(policy_name)
+                PrintHardeningGuides.server_modern_common()
+                PrintHardeningGuides.rocky_9_server()
                 sys.exit(retval)
             # Ubuntu
             elif os_type in ["Ubuntu"] and os_ver in ["2404"]:
-                PrintConfig.server_modern_common()
-                PrintConfig.ubuntu_server_2404()
-                PrintConfig.debian_ubuntu_rate_throttling()
+                PrintHardeningGuides.print_ver_changelog(policy_name)
+                PrintHardeningGuides.server_modern_common()
+                PrintHardeningGuides.ubuntu_server_2404()
+                PrintHardeningGuides.debian_ubuntu_rate_throttling()
                 sys.exit(retval)
             elif os_type in ["Ubuntu"] and os_ver in ["2204"]:
-                PrintConfig.server_modern_common()
-                PrintConfig.ubuntu_server_2204()
-                PrintConfig.debian_ubuntu_rate_throttling()
+                PrintHardeningGuides.print_ver_changelog(policy_name)
+                PrintHardeningGuides.server_modern_common()
+                PrintHardeningGuides.ubuntu_server_2204()
+                PrintHardeningGuides.debian_ubuntu_rate_throttling()
                 sys.exit(retval)
             elif os_type in ["Ubuntu"] and os_ver in ["2004"]:
-                PrintConfig.server_modern_common()
-                PrintConfig.ubuntu_server_2004()
-                PrintConfig.debian_ubuntu_rate_throttling()
+                PrintHardeningGuides.print_ver_changelog(policy_name)
+                PrintHardeningGuides.server_modern_common()
+                PrintHardeningGuides.ubuntu_server_2004()
+                PrintHardeningGuides.debian_ubuntu_rate_throttling()
                 sys.exit(retval)
             elif os_type in ["Ubuntu"] and os_ver in ["1804"]:
-                PrintConfig.server_legacy_common()
-                PrintConfig.ubuntu_server_1804()
+                PrintHardeningGuides.print_ver_changelog(policy_name)
+                PrintHardeningGuides.server_legacy_common()
+                PrintHardeningGuides.ubuntu_server_1804()
                 sys.exit(retval)
             else:
-                PrintConfig.unknown_varient(os_type, os_ver, clientserver)
+                PrintHardeningGuides.supported_varient()
                 sys.exit(retval)
 
 
         # Client Configs
         if clientserver in ["Client"]:
             # Amazon
             if os_type in ["Amazon"] and os_ver in ["2023"]:
-                PrintConfig.amazon_2023_client()
+                PrintHardeningGuides.print_ver_changelog(policy_name)
+                PrintHardeningGuides.amazon_2023_client()
                 sys.exit(retval)
             # Debian
             elif os_type in ["Debian"] and os_ver in ["Bookworm"]:
-                PrintConfig.debian_bookworm_client()
+                PrintHardeningGuides.print_ver_changelog(policy_name)
+                PrintHardeningGuides.debian_bookworm_client()
                 sys.exit(retval)
             # Mint
             elif os_type in ["Mint"] and os_ver in ["22"]:
-                PrintConfig.ubuntu_2404_mint_22_client()
+                PrintHardeningGuides.print_ver_changelog(policy_name)
+                PrintHardeningGuides.ubuntu_2404_mint_22_client()
                 sys.exit(retval)
             elif os_type in ["Mint"] and os_ver in ["21"]:
-                PrintConfig.ubuntu_2204_mint_21_client()
+                PrintHardeningGuides.print_ver_changelog(policy_name)
+                PrintHardeningGuides.ubuntu_2204_mint_21_client()
                 sys.exit(retval)
             elif os_type in ["Mint"] and os_ver in ["20"]:
-                PrintConfig.ubuntu_2004_mint_20_client()
+                PrintHardeningGuides.print_ver_changelog(policy_name)
+                PrintHardeningGuides.print_ver_changelog(policy_name)
+                PrintHardeningGuides.ubuntu_2004_mint_20_client()
                 sys.exit(retval)
             # Rocky
             elif os_type in ["Rocky"] and os_ver in ["9"]:
-                PrintConfig.rocky_9_client()
+                PrintHardeningGuides.print_ver_changelog(policy_name)
+                PrintHardeningGuides.rocky_9_client()
                 sys.exit(retval)
             # Ubuntu
             elif os_type in ["Ubuntu"] and os_ver in ["2404"]:
-                PrintConfig.ubuntu_2404_mint_22_client()
+                PrintHardeningGuides.print_ver_changelog(policy_name)
+                PrintHardeningGuides.ubuntu_2404_mint_22_client()
                 sys.exit(retval)
             elif os_type in ["Ubuntu"] and os_ver in ["2204"]:
-                PrintConfig.ubuntu_2204_mint_21_client()
+                PrintHardeningGuides.print_ver_changelog(policy_name)
+                PrintHardeningGuides.ubuntu_2204_mint_21_client()
                 sys.exit(retval)
             elif os_type in ["Ubuntu"] and os_ver in ["2004"]:
-                PrintConfig.ubuntu_2004_mint_20_client()
+                PrintHardeningGuides.print_ver_changelog(policy_name)
+                PrintHardeningGuides.ubuntu_2004_mint_20_client()
                 sys.exit(retval)
             else:
-                PrintConfig.unknown_varient(os_type, os_ver, clientserver)
+                PrintHardeningGuides.supported_varient()
                 sys.exit(retval)
 
 
 
     @staticmethod
-    def unknown_varient(os_type: str, os_ver: str, clientserver: str) -> None:
-        print(" ")
-        print(f"\033[1mSSH-Audit Version : {VERSION}\033[0m")
-        print(" ")
-        print(f"\033[1mGuides Last modified : {GUIDES_UPDATED}\033[0m")
-        print(" ")
-        print(f"\033[1mError unknown varient : {os_type} {os_ver} {clientserver} \033[0m")
+    def supported_varient() -> None:
+        retval = exitcodes.GOOD
         print(" ")
         print("For current, community developed and legacy guides")
         print("check the website : https://www.ssh-audit.com/hardening_guides.html")
         print(" ")
         print("\033[1mSupported Server Configurations : \033[0m")
+        print(" ")
         print(r"Amazon 2023 Server")
         print(r"Debian Bookworm Server")
         print(r"Debian Bullseye Server")
@@ -153,6 +229,11 @@ def unknown_varient(os_type: str, os_ver: str, clientserver: str) -> None:
         print(r"Ubuntu 2404 Client")
         print(r"Ubuntu 2204 Client")
         print(r"Ubuntu 2004 Client")
+        print(" ")
+        print("\033[1mExample Usage : \033[0m ")
+        print(r"python3 ssh-audit.py --get-hardening-guides Ubuntu 2404 Server")
+        print(" ")
+        sys.exit(retval)
 
 
     # Client Configurations
@@ -373,3 +454,24 @@ def amazon_server_2023() -> None:
         print("systemctl start iptables")
         print("systemctl start ip6tables")
         print(" ")
+
+    @staticmethod
+    def print_ver_changelog(policy_name: str) -> None:
+        '''Prints ssh-audit version and change log for a supported configuration'''
+
+        for key_name, policy in BUILTIN_GUIDES.items():
+            if policy_name in key_name:
+
+                policy_struct = policy
+                policy_name_without_version = policy_name.split('(')[0]
+                name = policy_name_without_version  # pylint: disable=protected-access
+                changelog_struct = policy_struct['changelog']  # pylint: disable=protected-access
+                print(" ")
+                print(f"\033[1mssh-audit Version : {VERSION}\033[0m")
+                print(" ")
+                print(f"\033[1mLocating configuration for {name}\033[0m")
+                print(" ")
+                print("\033[1mChange Log :\033[0m")
+                for date, change in changelog_struct.items():
+                    print(f"\033[1m{date} : {change}\033[0m")
+                print(" ")