1
0

sshd_config 1.3 KB

123456789101112131415161718192021222324252627282930313233343536373839
  1. LogLevel INFO
  2. #LogLevel DEBUG
  3. PidFile none
  4. Port 2200
  5. Protocol 2
  6. HostKey /etc/ssh/host_keys/rsa
  7. HostKey /etc/ssh/host_keys/ed25519
  8. # https://www.ssh-audit.com/hardening_guides.html#ubuntu_20_04_lts
  9. KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256
  10. Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
  11. MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com
  12. HostKeyAlgorithms ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-512,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com
  13. UsePAM no
  14. PermitRootLogin no
  15. AllowUsers git
  16. PubkeyAuthentication yes
  17. # > RSA: The length of the modulus n shall be 2048 bits or more to meet the
  18. # > minimum security-strength requirement of 112 bits [...]
  19. # https://csrc.nist.gov/publications/detail/sp/800-131a/rev-2/final
  20. RequiredRSASize 2048
  21. PasswordAuthentication no
  22. ChallengeResponseAuthentication no
  23. StrictModes no
  24. DisableForwarding yes
  25. AllowAgentForwarding no
  26. AllowStreamLocalForwarding no
  27. AllowTcpForwarding no
  28. GatewayPorts no
  29. PermitTunnel no
  30. X11Forwarding no
  31. PermitUserEnvironment no
  32. PrintMotd no
  33. PermitTTY no