SSH - Revision history

Johnno at 03:01, 28 December 2018

2018-12-28T03:01:08Z

Johnno: Nitrokey

2018-12-27T23:28:44Z

Nitrokey

Johnno at 23:04, 27 December 2018

2018-12-27T23:04:24Z

Johnno: Created page with "Harden your SSH, consider these in your `/etc/ssh/sshd_config` file. PubkeyAuthentication yes PasswordAuthentication no PermitRootLogin no PermitEmptyPasswords no ..."

2016-04-07T01:44:04Z

Created page with "Harden your SSH, consider these in your <tt>/etc/ssh/sshd_config</tt> file. PubkeyAuthentication yes PasswordAuthentication no PermitRootLogin no PermitEmptyPasswords no ..."

New page

Harden your SSH, consider these in your <tt>/etc/ssh/sshd_config</tt> file.

PubkeyAuthentication yes
PasswordAuthentication no
PermitRootLogin no
PermitEmptyPasswords no
AllowUsers alice bob carol
X11Forwarding no

Use keys, it's the 21st Century now. Also, you can tar-pit wankers trying to hammer their way in. This will drop anyone trying to connect more than three times in 30 seconds:

iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set
iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --update --seconds 30 --hitcount 3 -j DROP

← Older revision		Revision as of 03:01, 28 December 2018
Line 36:		Line 36:
	iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set		iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set
	iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --update --seconds 30 --hitcount 3 -j DROP		iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --update --seconds 30 --hitcount 3 -j DROP
		+
		+	== References ==
		+
		+	* Boelen, M. [https://linux-audit.com/audit-and-harden-your-ssh-configuration/ "OpenSSH security and hardening"] Linux Audit, July 2018.

@@ Line 30: / Line 30: @@
   X11Forwarding no
-Running on a port other than 22 will more or less eliminate the zombie hoardes of hammer bots, but disabling password auth altogether will achieve the same thing. Also consider a U2F auth gadget, e.g. Yubikey, or probably [https://github.com/Yubico/ykneo-openpgp/issues/2#issuecomment-218446368 something else].
+Running on a port other than 22 will more or less eliminate the zombie hoardes of hammer bots, but disabling password auth altogether will achieve the same thing. Also consider a U2F auth gadget, e.g. Yubikey, or [https://github.com/Yubico/ykneo-openpgp/issues/2#issuecomment-218446368 better yet] Nitrokey which is fully open source.
 You can tar-pit hammer bots with fail2ban, or these two rules will just drop anyone failing to connect more than three times in 30 seconds:

@@ Line 1: / Line 1: @@
-Harden your SSH, consider these in your <tt>/etc/ssh/sshd_config</tt> file.
+To harden your SSH, step 1 is disable protocol v1 connections and remove any v1 only options. Most of these options are deprecated but are probably cluttering your auth log with deprecation warnings since on most distros they are still in the default <tt>/etc/ssh/sshd_config</tt> file. Ensure something like this:
   PubkeyAuthentication yes
   PasswordAuthentication no
   PermitRootLogin no
   PermitEmptyPasswords no
   AllowUsers alice bob carol
   X11Forwarding no
-Use keys, it's the 21st Century now. Also, you can tar-pit wankers trying to hammer their way in. This will drop anyone trying to connect more than three times in 30 seconds:
+Running on a port other than 22 will more or less eliminate the zombie hoardes of hammer bots, but disabling password auth altogether will achieve the same thing. Also consider a U2F auth gadget, e.g. Yubikey, or probably [https://github.com/Yubico/ykneo-openpgp/issues/2#issuecomment-218446368 something else].
   iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set
   iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --update --seconds 30 --hitcount 3 -j DROP

SSH - Revision history

Johnno at 03:01, 28 December 2018

Johnno: Nitrokey

Johnno at 23:04, 27 December 2018

Johnno: Created page with "Harden your SSH, consider these in your /etc/ssh/sshd_config file. PubkeyAuthentication yes PasswordAuthentication no PermitRootLogin no PermitEmptyPasswords no ..."

Johnno: Created page with "Harden your SSH, consider these in your `/etc/ssh/sshd_config` file. PubkeyAuthentication yes PasswordAuthentication no PermitRootLogin no PermitEmptyPasswords no ..."