Mozilla Guidelines to Secure SSH
infosec.mozilla.org
Mozilla Guidelines to Secure SSH
1–10 of 18 posts
Re: Mozilla Guidelines to Secure SSH
#2What are some other high quality “harden your server” guides? Many seem to be out of date
Re: Mozilla Guidelines to Secure SSH
#3> Mozilla Guidelines to Secure [Secure Shell]
Re: Mozilla Guidelines to Secure SSH
#4The guide is outdated if you rely on the latest version of OpenSSH. You must update such guides with every new version of OpenSSH.
Adding legacy configuration to your OpenSSH config files can even result in a false sense of security (e.g., if the server/client just skip the legacy part and you think it adds some protection).
Newer options to secure OpenSSH are also missing (e.g., using U2F for 2FA, introduced in OpenSSH 8.2 (Feb 2020).
Re: Mozilla Guidelines to Secure SSH
#5Secure Secure Shell?
Re: Mozilla Guidelines to Secure SSH
#6The guide is outdated if you rely on the latest version of OpenSSH. You must update such guides with every new version of OpenSSH. Adding legacy configuration to your OpenSSH config files can even result in a false sense of security (e.g., if the server/client just skip the legacy part and you think it adds some protection). Newer options to secure OpenSSH are also missing (e.g., using U2F for 2FA, introduced in Open…
Are there any updated guides you’re aware of that you could share?
Re: Mozilla Guidelines to Secure SSH
#7It doesn't address the Trust On First Use (TOFU) issue.
Re: Mozilla Guidelines to Secure SSH
#8[deleted]
Re: Mozilla Guidelines to Secure SSH
#9It doesn't address the Trust On First Use (TOFU) issue.
A SSH Certificate Authority signing host keys handles that, but requires additional setup.
Re: Mozilla Guidelines to Secure SSH
#10It doesn't address the Trust On First Use (TOFU) issue.
A quick and dirty way to do this is by syncing the known hosts file between all your clients. Make it writable by only the IT staff in charge of provisioning new systems and have them add the pubkeys during provisioning.