Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update and add annotations to sshd config for servers #5666

Merged
merged 3 commits into from
Feb 11, 2021
Merged

Update and add annotations to sshd config for servers #5666

merged 3 commits into from
Feb 11, 2021

Commits on Dec 17, 2020

  1. Updates sshd config 

    - Update supported algorthms
- Disable some agent forwarding and tunnelling options
- Annotate and reorder configuration for readability

Sources:
- https://github.com/dev-sec/ansible-ssh-hardening
- https://github.com/arthepsy/ssh-audit
    @emkll
    emkll committed Dec 17, 2020
    Configuration menu
    Copy the full SHA
    00ceaeb View commit details
    Browse the repository at this point in the history

  2. Use ditribution-default host key algorithms 

    ECDSA will be used by defaut for the client to authenticate the host.

Tor Onion Services will also provide another layer of authentication,
when using ssh over Tor.
    @emkll
    emkll committed Dec 17, 2020
    Configuration menu
    Copy the full SHA
    54abdb2 View commit details
    Browse the repository at this point in the history

Commits on Jan 7, 2021

  1. Update sshd config based on feedback 

    - As pointed out by @kushaldas, chacha20-poly1305 mostly mobile-specific cipher, and while historically present in the sshd configuration for SecureDrop, is not necessary to support Debian-based ssh clients.

- The UsePrivilegeSeparation option has been deprecated in OpenSSH 7.5 [1]. UsePrivilegeSeparation has defaulted to 'sandbox' since 6.1 [2] and to 'yes' since 3.3 [3].

[1] https://www.openssh.com/txt/release-7.5
[2] https://www.openssh.com/txt/release-6.1
[3] https://www.openssh.com/txt/release-3.3
    @emkll
    emkll committed Jan 7, 2021
    Configuration menu
    Copy the full SHA
    3f4f6ac View commit details
    Browse the repository at this point in the history