KNEL/FetchApply
2
0
Fork 0
Code Pull Requests Actions Packages Releases Activity

more ssh hardening bits

Browse Source
This commit is contained in:
Charles N Wyble
2025-06-23 22:34:52 -05:00
parent 4a38cd404f
commit 1a8980afc6
3 changed files with 46 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
newSrv.sh
View File

@ -55,6 +55,8 @@ echo Now running "$FUNCNAME"....
curl --silent https://dl.knownelement.com/FetchApplyDistPoint/tsys-zshrc > /etc/zshrc curl --silent https://dl.knownelement.com/FetchApplyDistPoint/tsys-zshrc > /etc/zshrc
curl --silent https://dl.knownelement.com/FetchApplyDistPoint/aliases > /etc/aliases curl --silent https://dl.knownelement.com/FetchApplyDistPoint/aliases > /etc/aliases
curl --silent https://dl.knownelement.com/FetchApplyDistPoint/rsyslog.conf > /etc/rsyslog.conf curl --silent https://dl.knownelement.com/FetchApplyDistPoint/rsyslog.conf > /etc/rsyslog.conf
curl --silent https://dl.knownelement.com/FetchApplyDistPoint/tsys-sshd-config > /etc/ssh/sshd_config
curl --silent https://dl.knownelement.com/FetchApplyDistPoint/ssh-audit_hardening.conf > /etc/ssh/sshd_config.d/ssh-audit_hardening.conf
export ROOT_SSH_DIR="/root/.ssh" export ROOT_SSH_DIR="/root/.ssh"
export LOCALUSER_SSH_DIR="/home/localuser/.ssh" export LOCALUSER_SSH_DIR="/home/localuser/.ssh"
@ -144,6 +146,7 @@ lldpd \
net-tools \ net-tools \
gpg \ gpg \
molly-guard \ molly-guard \
fail2ban \
lshw \ lshw \
sudo \ sudo \
mailutils \ mailutils \
@ -167,6 +170,9 @@ usermin \
iotop \ iotop \
tuned \ tuned \
cockpit \ cockpit \
iptables \
netfilter-persistent \
iptables-persistent \
telnet \ telnet \
postfix postfix
@ -317,6 +323,14 @@ function secharden-ssh()
{ {
echo Now running "$FUNCNAME".... echo Now running "$FUNCNAME"....
iptables -I INPUT -p tcp --dport 22 -m state --state NEW -m recent --set
iptables -I INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 10 --hitcount 10 -j DROP
ip6tables -I INPUT -p tcp --dport 22 -m state --state NEW -m recent --set
ip6tables -I INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 10 --hitcount 10 -j DROP
service netfilter-persistent save
echo Completed running "$FUNCNAME" echo Completed running "$FUNCNAME"
} }

19
ssh-audit_hardening.conf Normal file
View File

@ -0,0 +1,19 @@
# Restrict key exchange, cipher, and MAC algorithms, as per sshaudit.com
# hardening guide.
KexAlgorithms sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,gss-curve25519-sha256-,diffie-hellman-group16-sha512,gss-group16-sha512-,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-gcm@openssh.com,aes128-ctr
MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com
HostKeyAlgorithms sk-ssh-ed25519-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-512,rsa-sha2-256
RequiredRSASize 3072
CASignatureAlgorithms sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-512,rsa-sha2-256
GSSAPIKexAlgorithms gss-curve25519-sha256-,gss-group16-sha512-
HostbasedAcceptedAlgorithms sk-ssh-ed25519-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-256
PubkeyAcceptedAlgorithms sk-ssh-ed25519-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-256

13
tsys-sshd-config Normal file
View File

@ -0,0 +1,13 @@
Include /etc/ssh/sshd_config.d/*.conf
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
KbdInteractiveAuthentication no
X11Forwarding yes
PrintMotd no
PasswordAuthentication no
ChallengeResponseAuthentication no
Banner none
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server
UsePAM yes
PermitRootLogin prohibit-password