From 0df9b916c2d5760ce9a8b9cd85d3985f22e8ef9f Mon Sep 17 00:00:00 2001 From: Takwa Date: Thu, 12 Nov 2026 15:16:21 +0100 Subject: [PATCH] hardening: turn off sshd compression 99-hardening.conf left Compression at its default, which in OpenSSH is zlib after login. It buys nothing on these links, and OpenSSH before 10.6 has two decompression bugs behind it (CVE-2026-106582, CVE-2026-106585). Ubuntu 24.04's 9.6p1 has the fixes backported; Debian 13's 10.0p1 does not, and Debian has marked both minor with no backport planned. Set Compression no on every box the hardening role manages, so a logged-in peer cannot reach the zlib code at all. Co-Authored-By: Claude Opus 5.5 --- roles/hardening/tasks/main.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/roles/hardening/tasks/main.yml b/roles/hardening/tasks/main.yml index c687be7..f94f722 100644 --- a/roles/hardening/tasks/main.yml +++ b/roles/hardening/tasks/main.yml @@ -295,6 +295,10 @@ AllowAgentForwarding no AllowTcpForwarding yes MaxAuthTries 3 + # zlib after login buys nothing on these links, and OpenSSH before 10.6 + # has decompression bugs behind it (CVE-2026-106582, CVE-2026-106585) + # that Debian 13's 10.0 has not had backported. + Compression no MaxSessions 10 LoginGraceTime 30 ClientAliveInterval 300