Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FreeBSD SSH Hardening

gist.github.com

Post reply on HN
Print view View original

31–40 of 121 posts

Re: FreeBSD SSH Hardening

#31

Post by tiffanyh »

NanoBSD?

I feel like an important part of "hardening" a server is to remove/disable unused services. Does anyone know if NanoBSD is actively worked-on by the FreeBSD team and/or still in use? For those note aware, NanoBSD is an official build from FreeBSD team that allows you to compile a slimmed down FreeBSD build that is read-only yet can run any/all FreeBSD software.

I can find very little about NanoBSD other than a handful of posts from 10 years ago. It seems like a great foundation for hardening a server.

https://docs.freebsd.org/en/articles/nanobsd/

Re: FreeBSD SSH Hardening

#32

Post by BelenusMordred »

hannob wrote: post #13

SSH hardening guide bonus edition: Disable password login if you can, leave the algorithm settings as they are and use an up to date version of OpenSSH. OpenSSH already agressively deprecates algorithms that are problematic. None of the algorithms enabled by default has any known security issue. But your manual tweaks from a random document you read on the Internet may enable an algorithm that we may later learn to b…

> None of the algorithms enabled by default has any known security issue.

For the tinfoil among us, jump on the post-quantum key exchange train, there's little overhead, it still uses traditional elliptic curve crypto, best of both worlds.

The jump-off: sntrup4591761x25519-sha512@tinyssh.org

Re: FreeBSD SSH Hardening

#33

Post by cpach »

tiffanyh wrote: post #30
acatton wrote: post #23

Earlier quoted context omitted.

In the same vein, protecting your SSH server with spiped[1] does 99% of the job. (= No need to setup fail2ban, password auth is not a big deal anymore, protects against out-of-date SSH servers and/or zero-days exploits, ...) [1] https://www.tarsnap.com/spiped.html

Is Spiped similar in-concept to a VPN?

Yes. When spiped was released (2011) there were no really good VPN solutions out there.

Now there is WireGuard, but it wasn’t launched until 2016.

Re: FreeBSD SSH Hardening

#34

Post by chasil »

crispyambulance wrote: post #25
lou1306 wrote: post #8

Relevant: If your SSH server is public, you can give its address to https://sshcheck.com/ and it will report any weak spots in your config.

Thanks, that's an interesting tool. But geezus, it's daunting to address SSH weaknesses unless you know ssh and it's configuration top to bottom. I don't! And I am not afraid to admit it. I just use ssh "as-is" on mainstream platforms, for example, whatever Amazon gives me on lightsail linux images or windows-10 or whatever's on my Mac and hope for the best. I mean, there's 4 different groups of algorithms to think a…

If you like Wireguard's security, you can emulate it in your sshd_config:

    Ciphers chacha20-poly1305@openssh.com
    KexAlgorithms curve25519-sha256@libssh.org
    MACs hmac-sha2-512-etm@openssh.com
The MAC is irrelevant, as that function is built into the AEAD cipher, which are to be preferred (the alternate is AES-GCM).

This will shut off a lot of legacy SSH clients. Android Connectbot specifically needs the AES cipher; adding it causes problems for putty.

Otherwise, this is the classic "best practice" site for SSH:

https://stribika.github.io/2015/01/04/secure-secure-shell.ht...

Re: FreeBSD SSH Hardening

#36

Post by cperciva »

tiffanyh wrote: post #30
acatton wrote: post #23

Earlier quoted context omitted.

In the same vein, protecting your SSH server with spiped[1] does 99% of the job. (= No need to setup fail2ban, password auth is not a big deal anymore, protects against out-of-date SSH servers and/or zero-days exploits, ...) [1] https://www.tarsnap.com/spiped.html

Is Spiped similar in-concept to a VPN?

Sort of. Not really. spiped operates at the level of individual stream connections, so you can e.g. make one end a local socket in a filesystem and use UNIX permissions to control access to it.

In fact that's exactly why I wrote it -- so I could have a set of daemons designed to communicate via local sockets and transparently (aside from performance) have them running on different systems.

Re: FreeBSD SSH Hardening

#38

Post by beermonster »

Not everyone knows that you can use MFA with SSH. I’ve successfully used Google authenticator via PAM[1] and YubiKey[2].

You can also setup SSH certificate authorities instead of using self-signed ones [3]

[1] https://wiki.archlinux.org/title/Google_Authenticator

[2] https://developers.yubico.com/SSH/

[3] https://jameshfisher.com/2018/03/16/how-to-create-an-ssh-cer...

Re: FreeBSD SSH Hardening

#39

Post by enduser »

tiffanyh wrote: post #31

NanoBSD? I feel like an important part of "hardening" a server is to remove/disable unused services. Does anyone know if NanoBSD is actively worked-on by the FreeBSD team and/or still in use? For those note aware, NanoBSD is an official build from FreeBSD team that allows you to compile a slimmed down FreeBSD build that is read-only yet can run any/all FreeBSD software. I can find very little about NanoBSD other than…

I looked into this for a project a couple of years ago (to boot VMs from minimal customized ISO) and ended up using mfsbsd instead.

https://github.com/mmatuska/mfsbsd

Re: FreeBSD SSH Hardening

#40

Post by tiffanyh »

cperciva wrote: post #36
tiffanyh wrote: post #30

Earlier quoted context omitted.

Is Spiped similar in-concept to a VPN?

Sort of. Not really. spiped operates at the level of individual stream connections, so you can e.g. make one end a local socket in a filesystem and use UNIX permissions to control access to it. In fact that's exactly why I wrote it -- so I could have a set of daemons designed to communicate via local sockets and transparently (aside from performance) have them running on different systems.

Thanks Colin! Love all the things you create :)
Post reply on HN