mirror of
https://github.com/BagelHole/DevOps-Security-Agent-Skills.git
synced 2026-08-22 12:49:53 +02:00
112 lines
2.8 KiB
Plaintext
112 lines
2.8 KiB
Plaintext
# SSH Server Hardening Configuration
|
|
# Place in /etc/ssh/sshd_config.d/hardening.conf
|
|
# Restart SSH: systemctl restart sshd
|
|
|
|
#------------------------------------------------------------------------------
|
|
# AUTHENTICATION
|
|
#------------------------------------------------------------------------------
|
|
|
|
# Disable root login
|
|
PermitRootLogin no
|
|
|
|
# Disable password authentication
|
|
PasswordAuthentication no
|
|
|
|
# Enable public key authentication
|
|
PubkeyAuthentication yes
|
|
|
|
# Disable empty passwords
|
|
PermitEmptyPasswords no
|
|
|
|
# Disable keyboard-interactive authentication
|
|
KbdInteractiveAuthentication no
|
|
|
|
# Disable challenge-response authentication
|
|
ChallengeResponseAuthentication no
|
|
|
|
# Maximum authentication attempts
|
|
MaxAuthTries 3
|
|
|
|
# Maximum sessions per connection
|
|
MaxSessions 2
|
|
|
|
# Maximum simultaneous unauthenticated connections
|
|
MaxStartups 10:30:60
|
|
|
|
# Login grace time
|
|
LoginGraceTime 60
|
|
|
|
#------------------------------------------------------------------------------
|
|
# SESSION
|
|
#------------------------------------------------------------------------------
|
|
|
|
# Client alive settings (timeout)
|
|
ClientAliveInterval 300
|
|
ClientAliveCountMax 2
|
|
|
|
# Disable TCP forwarding
|
|
AllowTcpForwarding no
|
|
|
|
# Disable agent forwarding
|
|
AllowAgentForwarding no
|
|
|
|
# Disable stream local forwarding
|
|
AllowStreamLocalForwarding no
|
|
|
|
# Disable X11 forwarding
|
|
X11Forwarding no
|
|
|
|
# Disable user environment processing
|
|
PermitUserEnvironment no
|
|
|
|
# Disable tunnel device forwarding
|
|
PermitTunnel no
|
|
|
|
# Disable gateway ports
|
|
GatewayPorts no
|
|
|
|
#------------------------------------------------------------------------------
|
|
# CRYPTOGRAPHY
|
|
#------------------------------------------------------------------------------
|
|
|
|
# Protocol version (SSH-2 only)
|
|
Protocol 2
|
|
|
|
# Strong ciphers only
|
|
Ciphers aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr
|
|
|
|
# Strong MACs only
|
|
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256
|
|
|
|
# Strong key exchange algorithms
|
|
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
|
|
|
|
# Strong host key algorithms
|
|
HostKeyAlgorithms ssh-ed25519,rsa-sha2-512,rsa-sha2-256
|
|
|
|
#------------------------------------------------------------------------------
|
|
# LOGGING
|
|
#------------------------------------------------------------------------------
|
|
|
|
# Log level
|
|
LogLevel VERBOSE
|
|
|
|
# Enable sftp logging
|
|
Subsystem sftp /usr/lib/openssh/sftp-server -l INFO
|
|
|
|
#------------------------------------------------------------------------------
|
|
# ACCESS CONTROL
|
|
#------------------------------------------------------------------------------
|
|
|
|
# Use PAM
|
|
UsePAM yes
|
|
|
|
# Show banner
|
|
Banner /etc/issue.net
|
|
|
|
# Restrict to specific users (uncomment and customize)
|
|
# AllowUsers admin deploy
|
|
|
|
# Restrict to specific groups (uncomment and customize)
|
|
# AllowGroups sshusers admins
|