4 ms·

> 1. Install Linux on the box. Turn everything off but sshd. Turn off password access to sshd. Also, test that it's properly disabled with something like `ssh

> 1. Install Linux on the box. Turn everything off but sshd. Turn off password access to sshd. Also, test that it's properly disabled with something like `ssh -v yourserver : 2>&1 | grep continue`, because there are a surprising number of ways for that to go wrong (did you know that sshd lets you Include multiple config files together in a way that can override the main one? I know that now.)

Maledictus 2y ago
and `sshd -T | grep -i password`
a-french-anon 2y ago
This. OVH's VPS had two .confs reenabling passwords. Now I know too.
- a-french-anon 2y ago
  I should specify that this was with AlmaLinux 9. The offending files were a 50-redhat.conf and a 50-cloud-init.conf.
- omgtehlion 2y ago
  default ubuntu 22.04 has at least one, too
omgtehlion 2y ago
I always remove all 'includes' in sshd config, just to be sure I will not get any surprises later...
- zokier 2y ago
  I think doing the opposite is better usually, never making changes to the main /etc/ssh/sshd_config and always add your own customizations to /etc/ssh/sshd_config.d/; that way you have clear separation of your own and distro configs, which makes life easier especially when upgrading sshd. Although I'll readily admit that I don't myself follow that advise all the time.
  - xyse53 2y ago
    This. And give your drop-in a prefix like 00-*.conf. Fwiw I don't think SSH adds the include line upstream. Most distros add it now.
    - jgalt212 2y ago
      Yes. I had a hard time figuring out if a low numbered prefix got final say, or the high numbered one.
hedora 2y ago
In situations where I have more than one box, one (usually a little embedded SoC) gets openbsd on it, and is used as a bastion host, for exactly the reasons outlined here. The problems I hit with using Linux for this were different ten years ago, but, based on this thread, things got worse on that side of the fence.
ycombinatrix 2y ago
iirc the double config file nonsense is another genius move brought to you by debian maintainers. it seriously bothered me that an update automatically re-enabled password authentication. i ended up switching to a different OS.
- taskforcegemini 2y ago
  on updates you are asked if your conf file should be kept or overwritten, with further options like diff-comparison

Maledictus 2y ago

and `sshd -T | grep -i password`

a-french-anon 2y ago

This. OVH's VPS had two .confs reenabling passwords. Now I know too.

a-french-anon 2y ago
I should specify that this was with AlmaLinux 9. The offending files were a 50-redhat.conf and a 50-cloud-init.conf.
omgtehlion 2y ago
default ubuntu 22.04 has at least one, too

omgtehlion 2y ago

I always remove all 'includes' in sshd config, just to be sure I will not get any surprises later...

zokier 2y ago
I think doing the opposite is better usually, never making changes to the main /etc/ssh/sshd_config and always add your own customizations to /etc/ssh/sshd_config.d/; that way you have clear separation of your own and distro configs, which makes life easier especially when upgrading sshd. Although I'll readily admit that I don't myself follow that advise all the time.
- xyse53 2y ago
  This. And give your drop-in a prefix like 00-*.conf. Fwiw I don't think SSH adds the include line upstream. Most distros add it now.
  - jgalt212 2y ago
    Yes. I had a hard time figuring out if a low numbered prefix got final say, or the high numbered one.

hedora 2y ago

In situations where I have more than one box, one (usually a little embedded SoC) gets openbsd on it, and is used as a bastion host, for exactly the reasons outlined here. The problems I hit with using Linux for this were different ten years ago, but, based on this thread, things got worse on that side of the fence.

ycombinatrix 2y ago

iirc the double config file nonsense is another genius move brought to you by debian maintainers. it seriously bothered me that an update automatically re-enabled password authentication. i ended up switching to a different OS.

taskforcegemini 2y ago
on updates you are asked if your conf file should be kept or overwritten, with further options like diff-comparison