Repository navigation
accept TCPKeepAlive false in sshd-35 - #219
Open
jimmykarily wants to merge 1 commit into
Open
jimmykarily wants to merge 1 commit into
jimmykarily wants to merge 1 commit into
Conversation
OpenSSH 10.6 made TCPKeepAlive multi-valued, and `sshd -T` now prints the disabled state as "false" rather than "no". Accept both spellings of the off state. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Dimitris Karakasilis <dimitris@karakasilis.me>
jimmykarily
added a commit
to kairos-io/kairos
that referenced
this pull request
Oct 23, 2026
OpenSSH 10.6, which hadron v0.6.0 brought in, prints a disabled TCPKeepAlive as "false" in sshd -T, and DevSec's sshd-35 only accepts "no". Map that spelling back so the control keeps checking that keepalives are off. Won't be needed if this lands: dev-sec/ssh-baseline#219 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Dimitris Karakasilis <dimitris@karakasilis.me>
jimmykarily
added a commit
to kairos-io/kairos
that referenced
this pull request
Oct 23, 2026
OpenSSH 10.6, which hadron v0.6.0 brought in, prints a disabled TCPKeepAlive as "false" in sshd -T, and DevSec's sshd-35 only accepts "no". Map that spelling back so the control keeps checking that keepalives are off. Won't be needed if this lands: dev-sec/ssh-baseline#219 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Dimitris Karakasilis <dimitris@karakasilis.me>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
sshd-35 fails on OpenSSH 10.6 when the profile reads the output of
sshd -T, although keepalives are disabled.OpenSSH 10.6 extended
TCPKeepAlivefrom a yes/no flag to a multi-valued option (yes,no,true,false,transport,all):falseis now a valid value, andsshd -Tprints the disabled state asfalserather thanno. The value table listsfalsebeforeno(servconf.c L1115-L1122), andsshd -Tprints the first name that matches the value (L4145-L4154, L4177-L4178). In 10.5 the option was parsed as a plain yes/no flag.This change makes sshd-35 accept both
noandfalse.yes,true,transportandallstill fail.We hit this in Kairos, where the ssh hardening test runs this profile against
sshd -Toutput on an OpenSSH 10.6 image: kairos-io/kairos#5571.Tested with Cinc Auditor 7.1.7 running only sshd-35 against an
sshd_configholding each value:TCPKeepAlivenofalsetrueyesRubocop reports the same offenses on
controls/sshd_spec.rbbefore and after the change.This change was written with Claude Code and reviewed by me before submitting.