3 ms·
This is my standard on new server setup (which is admittedly overkill but I'd rather have it slightly slower and safer): http://www.catb.org/esr/sshexport/ htt
by tw04 10y ago
This is my standard on new server setup (which is admittedly overkill but I'd rather have it slightly slower and safer):
http://www.catb.org/esr/sshexport/ http://www.catb.org/esr/sshexport/
https://stribika.github.io/2015/01/04/secure-secure-shell.html https://stribika.github.io/2015/01/04/secure-secure-shell.ht...
SERVER SIDE:
sources.list (if you're on an older version of debian)
deb http://http.debian.net/debian http://http.debian.net/debian wheezy-backports main
apt-get -t wheezy-backports install --reinstall ssh
====
cd /etc/ssh
rm ssh_host_key
ssh-keygen -t ed25519 -f ssh_host_ed25519_key -a 256 < /dev/null
ssh-keygen -t rsa -b 4096 -f ssh_host_rsa_key < /dev/null
(do not password protect server side keys)
====
/etc/ssh/sshd_config
Protocol 2
HostKey /etc/ssh/ssh_host_ed25519_key
HostKey /etc/ssh/ssh_host_rsa_key
KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com
====
CLIENT SIDE:
/etc/ssh/ssh_config
Host *
KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com
====
ssh-keygen -t ed25519 -a 256 -f yourkey.key -C whateveryouwant
- johnhenry 10y agoDo you have a link to a gist and/or your other work?
- tw04 10y agoTo be clear, the links at the top aren't mine (sorry if it seemed that way). Just sources I've used to create what I've got.
- sandGorgon 10y agowhy do you need to do client-side ? The server side will enforce the algorithms that are allowed.
- tw04 10y agoThat's because I don't always control the servers I'm connecting to. Setting that client-side will prevent me from ever connecting to something that's completely insecure unknowingly.
- pbowyer 10y agoFor people like me who create a new server and put our public SSH keys in ~/.ssh/authorized_keys, can you explain what doing this does, and why it's good? I can see you're limiting it to particular algorithms/cyphers, but the rest?
- tw04 10y agoThe stuff towards the top eliminates the insecure keys your server will try to default to. No reason to keep them on the server (IMO) - they're primarily there for backwards compatibility. I prefer to remove them entirely so I know my client/server won't ever negotiate an insecure connection.