diff --git a/CHANGELOG.md b/CHANGELOG.md index 299f787..1c13a7b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -16,6 +16,7 @@ All notable changes to this project will be documented in this file. ### Fixed +- Changed ssh config file to allow ssh while FIPS is activated. ([#184](https://github.com/wazuh/wazuh-virtual-machines/pull/184)) - Fixed Vagrant synced folder error in OVA. ([#183](https://github.com/wazuh/wazuh-virtual-machines/pull/183)) - Fix the ova workflow for stages support and AWS instance deletion. ([#175](https://github.com/wazuh/wazuh-virtual-machines/pull/176)) - Fixed the OVA workflow to add support in stages. ([#173](https://github.com/wazuh/wazuh-virtual-machines/pull/173)) diff --git a/ova/workflow_assets/ova_configurer.py b/ova/workflow_assets/ova_configurer.py index 4da95a7..ba99c30 100644 --- a/ova/workflow_assets/ova_configurer.py +++ b/ova/workflow_assets/ova_configurer.py @@ -76,6 +76,32 @@ def create_network_config(): subprocess.run("sudo systemctl restart systemd-networkd", shell=True, check=True) +def change_ssh_config(): + """ + Changes the /etc/crypto-policies/back-ends/opensshserver.config file to make the ssh compatible with FIPS + """ + config_path = "/etc/crypto-policies/back-ends/opensshserver.config" + new_values = { + "Ciphers": "Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com", + "MACs": "MACs hmac-sha2-256,hmac-sha2-512", + "GSSAPIKexAlgorithms": "GSSAPIKexAlgorithms gss-nistp256-sha256-,gss-group14-sha256-,gss-group16-sha512-", + "KexAlgorithms": "KexAlgorithms ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521" + } + + with open(config_path, "r") as file: + lines = file.readlines() + + with open(config_path, "w") as file: + for line in lines: + key = line.split()[0] if line.strip() else "" + if key in new_values: + file.write(new_values[key] + "\n") + else: + file.write(line) + + subprocess.run("sudo systemctl restart sshd", shell=True, check=True) + + def clean(): """ Cleans the VM after the installation @@ -130,6 +156,7 @@ def main(): build_wazuh_install("/home/ec2-user/wazuh-installation-assistant", args.wia_branch) run_provision_script(args.wvm_branch, args.repository, args.debug) create_network_config() + change_ssh_config() clean() if __name__ == "__main__":