[BUG] Multiple entries of ciphers/macs/kexalgorithms when server_option is an array or yaml list

[ReneTrippen]

When the server_option for Ciphers/MACs/KexAlgorithms are defined as array or as yaml list, the generated sshd_config config has
multiple entries for them, this does not work, because sshd picks only the first match.
From the man page of sshd_config(5)

"Multiple ciphers must be comma-separated." The same for MACs and KexAlgorithms.

Example:

As Array

class { 'ssh':
  storeconfigs_enabled => false,
  server_options => {
    'Ciphers'       => [ 'aes128-ctr', 'aes192-ctr', 'aes256-ctr', 'aes128-cbc', '3des-cbc', 'aes192-cbc', 'aes256-cbc' ],
    'Macs'          => [ '[email protected]', '[email protected]', 'hmac-sha2-512', 'hmac-sha2-256' ],
    'KexAlgorithms' => [ 'curve25519-sha256', '[email protected]', 'diffie-hellman-group14-sha256', 'diffie-hellman-group16-sha512' ],
  },
}

As Yaml list in hiera

Ciphers:
   - "aes128-ctr"
   - "aes192-ctr"
   - "aes256-ctr"
   - "aes128-cbc"
   - "3des-cbc"
   - "aes192-cbc"
   - "aes256-cbc"
MACs:
   - "[email protected]"
   - "[email protected]"
   - "hmac-sha2-512"
   - "hmac-sha2-256"
KexAlgorithms:
   - "curve25519-sha256"
   - "[email protected]"
   - "diffie-hellman-group14-sha256"
   - "diffie-hellman-group16-sha512"

generated sshd_config

AcceptEnv LANG LC_*
ChallengeResponseAuthentication no
Ciphers aes128-ctr
Ciphers aes192-ctr
Ciphers aes256-ctr
Ciphers aes128-cbc
Ciphers 3des-cbc
Ciphers aes192-cbc
Ciphers aes256-cbc
KexAlgorithms curve25519-sha256
KexAlgorithms [email protected]
KexAlgorithms diffie-hellman-group14-sha256
KexAlgorithms diffie-hellman-group16-sha512
Macs [email protected]
Macs [email protected]
Macs hmac-sha2-512
Macs hmac-sha2-256
PrintMotd no
Subsystem sftp /usr/libexec/openssh/sftp-server
UsePAM yes
X11Forwarding yes

sshd -T

sshd -T | grep -E "(^cipher|^kexal|^mac)"
ciphers aes128-ctr
macs [email protected]
kexalgorithms curve25519-sha256

As String

class { 'ssh':
  storeconfigs_enabled => false,
  server_options => {
    'Ciphers'       => 'aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc',
    'Macs'          => '[email protected],[email protected],hmac-sha2-512,hmac-sha2-256',
    'KexAlgorithms' => 'curve25519-sha256,[email protected],diffie-hellman-group14-sha256,diffie-hellman-group16-sha512',
  },
}

generated sshd_config

AcceptEnv LANG LC_*
ChallengeResponseAuthentication no
Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
KexAlgorithms curve25519-sha256,[email protected],diffie-hellman-group14-sha256,diffie-hellman-group16-sha512
Macs [email protected],[email protected],hmac-sha2-512,hmac-sha2-256
PrintMotd no
Subsystem sftp /usr/libexec/openssh/sftp-server
UsePAM yes
X11Forwarding yes

sshd -T

sshd -T | grep -E "(^cipher|^kexal|^mac)"
ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
macs [email protected],[email protected],hmac-sha2-512,hmac-sha2-256
kexalgorithms curve25519-sha256,[email protected],diffie-hellman-group14-sha256,diffie-hellman-group16-sha512