# SSH Server Hardening Configuration
# Place in /etc/ssh/sshd_config.d/hardening.conf
# Restart SSH: systemctl restart sshd

#------------------------------------------------------------------------------
# AUTHENTICATION
#------------------------------------------------------------------------------

# Disable root login
PermitRootLogin no

# Disable password authentication
PasswordAuthentication no

# Enable public key authentication
PubkeyAuthentication yes

# Disable empty passwords
PermitEmptyPasswords no

# Disable keyboard-interactive authentication
KbdInteractiveAuthentication no

# Disable challenge-response authentication
ChallengeResponseAuthentication no

# Maximum authentication attempts
MaxAuthTries 3

# Maximum sessions per connection
MaxSessions 2

# Maximum simultaneous unauthenticated connections
MaxStartups 10:30:60

# Login grace time
LoginGraceTime 60

#------------------------------------------------------------------------------
# SESSION
#------------------------------------------------------------------------------

# Client alive settings (timeout)
ClientAliveInterval 300
ClientAliveCountMax 2

# Disable TCP forwarding
AllowTcpForwarding no

# Disable agent forwarding
AllowAgentForwarding no

# Disable stream local forwarding
AllowStreamLocalForwarding no

# Disable X11 forwarding
X11Forwarding no

# Disable user environment processing
PermitUserEnvironment no

# Disable tunnel device forwarding
PermitTunnel no

# Disable gateway ports
GatewayPorts no

#------------------------------------------------------------------------------
# CRYPTOGRAPHY
#------------------------------------------------------------------------------

# Protocol version (SSH-2 only)
Protocol 2

# Strong ciphers only
Ciphers aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr

# Strong MACs only
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256

# Strong key exchange algorithms
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512

# Strong host key algorithms
HostKeyAlgorithms ssh-ed25519,rsa-sha2-512,rsa-sha2-256

#------------------------------------------------------------------------------
# LOGGING
#------------------------------------------------------------------------------

# Log level
LogLevel VERBOSE

# Enable sftp logging
Subsystem sftp /usr/lib/openssh/sftp-server -l INFO

#------------------------------------------------------------------------------
# ACCESS CONTROL
#------------------------------------------------------------------------------

# Use PAM
UsePAM yes

# Show banner
Banner /etc/issue.net

# Restrict to specific users (uncomment and customize)
# AllowUsers admin deploy

# Restrict to specific groups (uncomment and customize)
# AllowGroups sshusers admins