3 ms·
I like to refer to: https://infosec.mozilla.org/guidelines/openssh https://infosec.mozilla.org/guidelines/openssh
by alphabettsy 5y ago
I like to refer to:
https://infosec.mozilla.org/guidelines/openssh https://infosec.mozilla.org/guidelines/openssh
- haarts 5y agoThat's brilliant!
- chasil 5y agoI prefer limiting to DJB ciphers where possible (the AES-GCM suites might also be helpful, but otherwise anything below is legacy crypto): Ciphers chacha20-poly1305@openssh.com KexAlgorithms curve25519-sha256@libssh.org AFAIK, if RSA is off the table, then the moduli file isn't necessary. RSAAuthentication no SFTP-only accounts are advised in "SSH Mastery" by Michael Lucas to follow this form: Match Group sftponly ChrootDirectory %h ForceCommand internal-sftp AllowTcpForwarding no I'm still seeing the external sftp subsystem in latest loads (last seen is Microsoft). Internal is better, and required for chroot. Subsystem sftp internal-sftp I like to put SFTP users on a separate server, just for them, and turn some other things off: PermitTunnel no X11Forwarding no PermitRootLogin no AllowTcpForwarding no Those are some settings that I would prefer.
- cjcampbell 5y agoModuli would be relevant to DH kex, though you’re safe when limiting to ed25519.