SSH

Configure
The settings of these section need to be writen in file

Custom port
SSH server are a common target for hackers. Changing the port away from the default will greatly reduce the noise in your logs.

Authentication
Let's limit the users that have access to the server using ssh.

Crypo
These settings are derived from secure secure shell.

KeepAlive
To make sure connections do not freeze in case of inactivity.

Generate server keys
Modify file  and make sure that the only lines to contains HostKey are:

Publish server keys
It is possible to publish the fingerprint of your ssh server keys in a DNS server. It allows to not have to blindly trust the key on first connection.

To get the records to publish in your dns server, run

Once published, you can check you records with

Now you can configure your client to use your published keys.

issue.net
One of the danger when doing remote administration is to mechanically log in to a machine, type a few command and realise after that you where on the wrong server.

This doesn't happen with physical computers as they look different on first sight (either the machine itself or the place it is). The solution, make your remote servers look different.

This can be done by uncommenting this line in

Then edit the file  and make it as distinctive as possible.

Some examples:

************ **********   ***********   **********   ************ ************  ************  ************   ***          ***      ***  ***      ***  ***      ***   ***          ***      ***  ***      ***  ***      ***   *******      ***      ***  ************  ***      ***   *******      ***      ***  ***********   ***      ***   ***          ***      ***  ***   ***     ***      ***   ***          ***      ***  ***    ***    ***      ***   ***          ************  ***     ***   ************   ***           **********   ***      ***  **********

##########  ###      ###           ###  ###  ###########   ############  ####     ###           ###  ###  ###########   ###      ###  #####    ###           ###  ###  ###   ###      ###  ######   ###           ###  ###  ###   ############  ### ###  ###           ###  ###  #######   ############  ###  ### ###           ###  ###  #######   ###      ###  ###   ######           ###  ###  ###   ###      ###  ###    #####  ###      ###  ###  ###   ###      ###  ###     ####   ###    ###   ###  ###########   ###      ###  ###      ###    ########    ###  ###########

Note that they are 3 files quite similar for this
 * : Displayed before login prompt on the physical consoles of the machines
 * : Displayed before login prompt for remote login
 * : Displayed after login (local and remote)

and  don't need any setup before being used. Just modify the content and you are ok to go.

Other
If you are using OpenSSH < 7.2 or are not using X11 forwarding, you can disable it with

Restart
Restarting the SSH server while connected through SSH is usually safe. However, you need to take some precautions to avoid being locked out of your server. Make sue you do that from a stable internet connection: in case your SSH server doesn't restart correctly, you don't want your active SSH connection to drop while you fix the issue. If you are connected through SSH, test that your server restarting correctly by opening a second connection The  option prevents the SSH client from reusing your active connection in case you have multiplexing enabled.

Fail2Ban
Fail2Ban configuration for SSH is active by default in Debian. However, if you changed the listening port of your server, you must reflect that in Fail2Ban. To do so, create file  with the following content

Configure
The settings of these section need to be written in file. Unless they contains a, they must be set under the existing   section.

Shortcuts
When it comes to typing, my motto is less is more. The following setting allows you to type  instead of

Port
If you changed the port of your servers, this settings allows you client to use the correct port automatically.

Crypo
These settings are derived from secure secure shell.

Generate user keys
This needs to be run by all users. It is strongly recommended to set a password to your keys. A passwordless keyfile is as secure as a post-it on the wall with your password. If a script need unattended access to another machine, create dedicated accounts and key for that usage.

Verify published server key
Make sure your server has some published keys.

Edit file  and add the line

ssh-agent
ssh-agent is a program that can keep your ssh keys in memory and avoid you to type your password several time.

Warning: Anybody which can run command as your user or as root on your machine can reuse or eve steal your keys. Don't run ssh-agent on a machine unless you trust it 100%.

Run the agent
By default Debian and Ubuntu start  when you log into a graphical session. However, the way it is done doesn't allow passing options to the agent.

To disable the default  startup script, edit file   and remove line.

Add the following line to  (create the file is it doesn't exist). This need to be done for each user that wants to run.

Add keys to agent
Note: You need OpenSSH version 7.2 or above for this to work.

SSH client is able to add keys to ssh-agent automatically. To do this, edit file  and add

Forward agent
If you want to be able to connect from machine A to machine B and then from machine B to machine C without typing password twice, you can use a feature called agent forwarding. With this feature machine B will be able to use the keys from the agent running on machine A.

Warning: As for running the agent, you must only forward your agent to a machine that you trust 100%. Anybody with access to root or the account you use on machine B will be able to use your keys.

To enable the feature, add this to

Reference Documents
Mozilla Guidelines

Secure Secure Shell