Good parts: - Upgrade your keys to the new format. Better: put them on a Yubikey, or use short-lived keys via Teleport or BLESS. - Disable non-key/cert based

Good parts: - Upgrade your keys to the new format. Better: put them on a Yubikey, or use short-lived keys via Teleport or BLESS. - Disable non-key/cert based auth (like passwords). You can do this on both clients and servers if you like, but it doesn't really matter as long as you do one of them. Bad parts: - NIST is fine. SP 800-63B is a good example of how they're saving a gazillion companies from shitty third party password requirements. - Don't hardcode ciphersuites. SSH is pretty OK at this. Just make sure you have recent SSH cients/servers. Patch your boxes (or rotate images or whatever). I dunno, don't run RHEL? Try ssh -vvv sometime. You'll see what SSH tried to do. Odds are that if you're up to date with your patches you're already getting chacha20poly1305 with ECDH. Stuff like disabling roaming: sure, whatever, this is fine. I'm guessing this advice is targeted at a different audience than startups (I also don't think you should run SSH over Tor). But you can just go be on top of patching and then you are also protected from bugs in things you can't just turn off. Turning off a bunch of optional obscure features is a good technique if you actually thing Mossad is after your SSH sessions. That's not the case for most of you.