2024-07-01 15:36:36 -04:00
|
|
|
# Encryption hardening
|
2023-10-10 15:20:29 -04:00
|
|
|
HostKey /etc/ssh/ssh_host_ed25519_key
|
|
|
|
|
HostKeyAlgorithms ssh-ed25519
|
2024-07-01 15:36:36 -04:00
|
|
|
KexAlgorithms sntrup761x25519-sha512@openssh.com
|
2023-10-10 15:20:29 -04:00
|
|
|
PubkeyAcceptedKeyTypes ssh-ed25519
|
|
|
|
|
Ciphers aes256-gcm@openssh.com
|
|
|
|
|
MACs -*
|
2024-07-01 15:36:36 -04:00
|
|
|
|
2024-07-01 15:57:20 -04:00
|
|
|
# Security hardening
|
|
|
|
|
AuthorizedKeysFile .ssh/authorized_keys
|
|
|
|
|
LoginGraceTime 15s
|
|
|
|
|
MaxAuthTries 1
|
|
|
|
|
StrictModes yes
|
|
|
|
|
|
|
|
|
|
## Use PAM for session checks here but authentication is disabled below
|
|
|
|
|
UsePAM yes
|
|
|
|
|
|
2024-07-01 15:36:36 -04:00
|
|
|
# Disabling unused authentication methods
|
2024-07-01 15:57:20 -04:00
|
|
|
ChallengeResponseAuthentication no
|
2024-02-13 18:05:52 -05:00
|
|
|
PasswordAuthentication no
|
2023-10-10 15:20:29 -04:00
|
|
|
PermitRootLogin no
|
2024-07-01 15:57:20 -04:00
|
|
|
KbdInteractiveAuthentication no
|
2023-10-10 15:20:29 -04:00
|
|
|
KerberosAuthentication no
|
|
|
|
|
GSSAPIAuthentication no
|
2024-07-01 15:36:36 -04:00
|
|
|
|
|
|
|
|
# Disabling unused features
|
|
|
|
|
AllowAgentForwarding no
|
|
|
|
|
AllowTcpForwarding no
|
|
|
|
|
PermitTunnel no
|
|
|
|
|
X11Forwarding no
|
|
|
|
|
|
|
|
|
|
# Displaying info
|
|
|
|
|
Banner /etc/issue.net
|
|
|
|
|
PrintLastLog yes
|
|
|
|
|
PrintMotd yes
|
