3 ms·
Coming here looking for genuine advice on hardening ssh (over the normal use a high numbered port, trim authorized_keys, etc), what then is some genuine advice?
by stevenjgarner 4y ago
Coming here looking for genuine advice on hardening ssh (over the normal use a high numbered port, trim authorized_keys, etc), what then is some genuine advice? Does ssh actually need hardening? In what ways has it been defeated?
- akerl_ 4y agoStart by just using ssh keys and disabling password auth. If you wanna go further, use something like Tailscale/WireGuard to move you SSH daemon off the public internet. Or use something like Teleport or Vault to issue short-lived per host keys backed by your centralized auth source. Or do both of the above.
- stevenjgarner 4y agoI understand how they all provide (good) value for MANAGING ssh keys, but respectfully, I don't understand how/that they harden ssh at all? Why does SSH need hardening? I get that if a user is mis-managing keys that is a problem, but it is not necessarily an ssh problem.
- akerl_ 4y agoHardening SSH doesn’t generally mean “making the openssh process more secure”. It means “making connecting to your servers more secure”. So turning off password auth, or restricting network access to the SSH daemon, or using stronger centralized auth all do that. Most of the risks that affect SSH are around credential lifecycles, weak credentials, and credential compromise.