| 1 |
# Mountaineer hardened sshd_config |
| 2 |
# |
| 3 |
# Defended in STACK.md (OpenSSH section) and assumed by the first-boot and |
| 4 |
# bastion routes. Per-host operator changes (AllowUsers, MaxStartups for |
| 5 |
# bastion role, etc.) belong in /etc/ssh/sshd_config.d/*.conf — this file |
| 6 |
# is the apkovl-supplied default and the operator does not edit it |
| 7 |
# directly. |
| 8 |
|
| 9 |
Include /etc/ssh/sshd_config.d/*.conf |
| 10 |
|
| 11 |
# Authentication: publickey only, root locked out. |
| 12 |
PermitRootLogin no |
| 13 |
PasswordAuthentication no |
| 14 |
KbdInteractiveAuthentication no |
| 15 |
ChallengeResponseAuthentication no |
| 16 |
PermitEmptyPasswords no |
| 17 |
AuthenticationMethods publickey |
| 18 |
PubkeyAuthentication yes |
| 19 |
HostbasedAuthentication no |
| 20 |
IgnoreRhosts yes |
| 21 |
|
| 22 |
# Modern KEX, ciphers, MACs. |
| 23 |
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,sntrup761x25519-sha512@openssh.com |
| 24 |
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr |
| 25 |
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com |
| 26 |
HostKeyAlgorithms ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256 |
| 27 |
|
| 28 |
# Host keys: ed25519 only by default. RSA host key is generated by the |
| 29 |
# installer for compatibility but disabled here; operators who need RSA |
| 30 |
# uncomment the HostKey line in a drop-in. |
| 31 |
HostKey /etc/ssh/ssh_host_ed25519_key |
| 32 |
|
| 33 |
# Connection hygiene. |
| 34 |
LoginGraceTime 30 |
| 35 |
MaxAuthTries 4 |
| 36 |
MaxSessions 4 |
| 37 |
ClientAliveInterval 300 |
| 38 |
ClientAliveCountMax 2 |
| 39 |
TCPKeepAlive no |
| 40 |
|
| 41 |
# Features we don't use. |
| 42 |
X11Forwarding no |
| 43 |
AllowAgentForwarding no |
| 44 |
PermitTunnel no |
| 45 |
PrintMotd no |
| 46 |
Banner none |
| 47 |
|
| 48 |
# AllowTcpForwarding is on (default). The bastion route overrides nothing; |
| 49 |
# inside hosts can drop a config snippet that turns it off if they prefer. |
| 50 |
|
| 51 |
# Logging |
| 52 |
SyslogFacility AUTH |
| 53 |
LogLevel VERBOSE |
| 54 |
|
| 55 |
# Subsystem |
| 56 |
Subsystem sftp /usr/lib/ssh/sftp-server -f AUTHPRIV -l INFO |
| 57 |
|
| 58 |
# Address family: both. The installer can drop a config snippet to restrict |
| 59 |
# this per-host. |
| 60 |
AddressFamily any |
| 61 |
|