FreeBSD SSH Hardening

Post by shapefrog » Wed, Sep 15, 2021, 3:20 PM UTC

akerl_ wrote: post #58

shapefrog wrote: post #54

Earlier quoted context omitted.

I like it a lot ... I just dont know what to do about all my 'weak' results.

Generally they’re going to be for legacy ciphers/MACs/etc. If you don’t need them, you can turn them off. If you’re the only one accessing your servers, you can honestly just pick a single option for each based on the highest security option that’s supported by all your client devices. https://infosec.mozilla.org/guidelines/openssh.html is a good starting point. The lists of available options are sorted from left ->…

Post by egberts1 » Wed, Sep 15, 2021, 3:37 PM UTC

chasil wrote: post #34

crispyambulance wrote: post #25

Earlier quoted context omitted.

Thanks, that's an interesting tool. But geezus, it's daunting to address SSH weaknesses unless you know ssh and it's configuration top to bottom. I don't! And I am not afraid to admit it. I just use ssh "as-is" on mainstream platforms, for example, whatever Amazon gives me on lightsail linux images or windows-10 or whatever's on my Mac and hope for the best. I mean, there's 4 different groups of algorithms to think a…

If you like Wireguard's security, you can emulate it in your sshd_config: Ciphers chacha20-poly1305@openssh.com KexAlgorithms curve25519-sha256@libssh.org MACs hmac-sha2-512-etm@openssh.com The MAC is irrelevant, as that function is built into the AEAD cipher, which are to be preferred (the alternate is AES-GCM). This will shut off a lot of legacy SSH clients. Android Connectbot specifically needs the AES cipher; add…

Post by chasil » Wed, Sep 15, 2021, 3:53 PM UTC

egberts1 wrote: post #63

chasil wrote: post #34

Earlier quoted context omitted.

If you like Wireguard's security, you can emulate it in your sshd_config: Ciphers chacha20-poly1305@openssh.com KexAlgorithms curve25519-sha256@libssh.org MACs hmac-sha2-512-etm@openssh.com The MAC is irrelevant, as that function is built into the AEAD cipher, which are to be preferred (the alternate is AES-GCM). This will shut off a lot of legacy SSH clients. Android Connectbot specifically needs the AES cipher; add…

Exactly my finding too! Except certain version of MacOS (and Windows) ssh client would also be unable to connect.

    C:\>ssh -vv me@myDJBserver.myco.com
    OpenSSH_for_Windows_8.1p1, LibreSSL 3.0.2
    ...
    debug2: KEX algorithms: curve25519-sha256@libssh.org
    ...
    debug2: ciphers ctos: chacha20-poly1305@openssh.com
    debug2: ciphers stoc: chacha20-poly1305@openssh.com
    ...
    debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC:  compression: none
    debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC:  compression: none
    ...
    $

Post by 0xFFFE » Wed, Sep 15, 2021, 4:00 PM UTC

0xdeadb00f wrote: post #16

ipaddr wrote: post #15

Earlier quoted context omitted.

Safest setup disable password login. disable ssh login. Put the computer back in the box and put the box under your bed.

Then, using aluminum foil and unfolded crisp packets make your room into a Faraday cage. Never open the door for any reason whatsoever. In fact, remove the door altogether.

Post by drclau » Wed, Sep 15, 2021, 4:01 PM UTC

lamnk wrote: post #9

The first thing i do on a new remote box is to move SSH to another non-standard port other than 22. I use the same port for every remote boxes I have. Then add that port into `.ssh/config` on local box. Second is to disable root login. Third is to copy my private key over and disable password login. 3 essential steps to secure SSH.