SSH - Revision history

Vincent: Ed25519 keys always use the new private key format

2018-01-25T06:28:26Z

Ed25519 keys always use the new private key format

← Older revision		Revision as of 06:28, 25 January 2018
Line 194:		Line 194:
	This needs to be run by all users. It is strongly recommended to set a password to your keys. A passwordless keyfile is as secure as a post-it on the wall with your password. If a script need unattended access to another machine, create dedicated accounts and key for that usage.		This needs to be run by all users. It is strongly recommended to set a password to your keys. A passwordless keyfile is as secure as a post-it on the wall with your password. If a script need unattended access to another machine, create dedicated accounts and key for that usage.
	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
	$ ssh-keygen -t ed25519 -o -a 100		$ ssh-keygen -t ed25519 -a 100
	$ ssh-keygen -t rsa -b 4096 -o -a 100		$ ssh-keygen -t rsa -b 4096 -o -a 100
	</syntaxhighlight>		</syntaxhighlight>

Vincent: disable root login

2017-10-08T14:13:26Z

disable root login

← Older revision		Revision as of 14:13, 8 October 2017
Line 23:		Line 23:
	Let's limit the users that have access to the server using ssh.		Let's limit the users that have access to the server using ssh.
	<syntaxhighlight lang="apache">		<syntaxhighlight lang="apache">
	AllowUsers ~~root~~ myusername		AllowUsers myusername
	PermitRootLogin ~~prohibit-password~~		PermitRootLogin no
	# Make sure you have setup authentication using keys before disabling passwords		# Make sure you have setup authentication using keys before disabling passwords
	PasswordAuthentication no		PasswordAuthentication no

Vincent: ssh-agent

2016-09-27T07:20:00Z

ssh-agent

@@ Line 204: / Line 204: @@
 <syntaxhighlight lang="apache">
      VerifyHostKeyDNS yes
 </syntaxhighlight>
@@ Line 211: / Line 243: @@
 [https://stribika.github.io/2015/01/04/secure-secure-shell.html Secure Secure Shell][[Category:Linux Server]]
 [[Category:Fail2Ban]]

Vincent: Links

2016-05-02T06:50:27Z

Links

← Older revision		Revision as of 06:50, 2 May 2016
Line 206:		Line 206:
	</syntaxhighlight>		</syntaxhighlight>

	[[Category:Linux Server]]		== Reference Documents ==
			[https://wiki.mozilla.org/Security/Guidelines/OpenSSH Mozilla Guidelines]

			[https://stribika.github.io/2015/01/04/secure-secure-shell.html Secure Secure Shell][[Category:Linux Server]]
	[[Category:Fail2Ban]]		[[Category:Fail2Ban]]

Vincent: sshd security

2016-05-01T10:01:59Z

sshd security

← Older revision		Revision as of 10:01, 1 May 2016
Line 37:		Line 37:
	MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160		MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160
	KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256		KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
			</syntaxhighlight>

			==== Sandbox ====
			<syntaxhighlight lang="apache">
			UsePrivilegeSeparation sandbox
	</syntaxhighlight>		</syntaxhighlight>

Line 126:		Line 131:

	<code>/etc/issue</code> and <code>/etc/motd</code> don't need any setup before being used. Just modify the content and you are ok to go.		<code>/etc/issue</code> and <code>/etc/motd</code> don't need any setup before being used. Just modify the content and you are ok to go.

			==== Other ====
			If you are using OpenSSH < 7.2 or are not using X11 forwarding, you can disable it with<syntaxhighlight lang="apache">
			X11Forwarding no
			</syntaxhighlight>

	=== Restart ===		=== Restart ===

Vincent: without-password => prohibit-password

2016-03-30T08:58:11Z

without-password => prohibit-password

← Older revision		Revision as of 08:58, 30 March 2016
Line 24:		Line 24:
	<syntaxhighlight lang="apache">		<syntaxhighlight lang="apache">
	AllowUsers root myusername		AllowUsers root myusername
	PermitRootLogin ~~without~~-password		PermitRootLogin prohibit-password
	# Make sure you have setup authentication using keys before disabling passwords		# Make sure you have setup authentication using keys before disabling passwords
	PasswordAuthentication no		PasswordAuthentication no

Vincent: Fail2Ban

2016-03-16T23:38:58Z

Fail2Ban

← Older revision		Revision as of 23:38, 16 March 2016
Line 134:		Line 134:
	</syntaxhighlight>The <code>-o "ControlMaster=yes"</code> option prevents the SSH client from reusing your active connection in case you have multiplexing enabled.		</syntaxhighlight>The <code>-o "ControlMaster=yes"</code> option prevents the SSH client from reusing your active connection in case you have multiplexing enabled.

	=== ~~Fail2ban~~ ===		=== Fail2Ban ===
	~~Fail2ban~~ configuration for ~~ssh~~ is active by default in Debian. However, if you changed the listening port of your server, you must reflect that in ~~fail2ban~~. To do so, create file <code>/etc/fail2ban/jail.d/sshd.conf</code> with the following content<syntaxhighlight lang="ini">		[[Fail2Ban]] configuration for SSH is active by default in Debian. However, if you changed the listening port of your server, you must reflect that in Fail2Ban. To do so, create file <code>/etc/fail2ban/jail.d/sshd.conf</code> with the following content
			<syntaxhighlight lang="ini">
	[sshd]		[sshd]
	enabled = true		enabled = true

Vincent: issue.net

2016-03-16T07:15:47Z

issue.net

← Older revision		Revision as of 07:15, 16 March 2016
Line 83:		Line 83:

	Now you can configure your client to [[#Verify published server key\|use your published keys]].		Now you can configure your client to [[#Verify published server key\|use your published keys]].

			==== issue.net ====
			One of the danger when doing remote administration is to mechanically log in to a machine, type a few command and realise after that you where on the wrong server.

			This doesn't happen with physical computers as they look different on first sight (either the machine itself or the place it is). The solution, make your remote servers look different.

			This can be done by uncommenting this line in <code>/etc/ssh/sshd_config</code>
			<syntaxhighlight lang="apache">
			Banner /etc/issue.net
			</syntaxhighlight>

			Then edit the file <code>/etc/issue.net</code> and make it as distinctive as possible.

			Some examples:

			********** ****** ******* ********
			********** ******** ******** **********
			* * * * * * ***
			* * * * * * ***
			***** * * ******** * ***
			***** * * ******* * ***
			* * * * * * ***
			* * * * * * ***
			* ******** * * **********
			* ****** * * ********

			########## ### ### ### ### ###########
			############ #### ### ### ### ###########
			### ### ##### ### ### ### ###
			### ### ###### ### ### ### ###
			############ ### ### ### ### ### #######
			############ ### ### ### ### ### #######
			### ### ### ###### ### ### ###
			### ### ### ##### ### ### ### ###
			### ### ### #### ### ### ### ###########
			### ### ### ### ######## ### ###########

			Note that they are 3 files quite similar for this
			* <code>/etc/issue</code>: Displayed before login prompt on the physical consoles of the machines
			* <code>/etc/issue.net</code>: Displayed before login prompt for remote login
			* <code>/etc/motd</code>: Displayed after login (local and remote)

			<code>/etc/issue</code> and <code>/etc/motd</code> don't need any setup before being used. Just modify the content and you are ok to go.

	=== Restart ===		=== Restart ===

Vincent: Category:Linux Server

2016-03-11T06:46:09Z

Category:Linux Server

← Older revision		Revision as of 06:46, 11 March 2016
Line 152:		Line 152:
	</syntaxhighlight>		</syntaxhighlight>

			[[Category:Linux Server]]
	[[Category:~~Install~~]]
	[[Category:Fail2Ban]]		[[Category:Fail2Ban]]

Vincent: Remove WIP

2016-03-06T23:03:22Z

Remove WIP

← Older revision		Revision as of 23:03, 6 March 2016
Line 1:		Line 1:
	{{Debian~~}}{{WIP~~}}		{{Debian}}

	== Server ==		== Server ==