SSH/Kryptografie/Konfiguration: Unterschied zwischen den Versionen
Keine Bearbeitungszusammenfassung |
Keine Bearbeitungszusammenfassung |
||
Zeile 1: | Zeile 1: | ||
; /etc/ssh/sshd_config | ; /etc/ssh/sshd_config | ||
<syntaxhighlight lang="python" line> | <syntaxhighlight lang="python" line> | ||
# Package generated configuration file | |||
# See the sshd_config(5) manpage for details | |||
# What ports, IPs and protocols we listen for | |||
Port 22 | |||
# Use these options to restrict which interfaces/protocols sshd will bind to | |||
#ListenAddress :: | |||
#ListenAddress 0.0.0.0 | |||
Protocol 2 | |||
# HostKeys for protocol version 2 | |||
HostKey /etc/ssh/ssh_host_rsa_key | |||
#HostKey /etc/ssh/ssh_host_dsa_key | |||
#HostKey /etc/ssh/ssh_host_ecdsa_key | |||
HostKey /etc/ssh/ssh_host_ed25519_key | |||
#Privilege Separation is turned on for security | |||
UsePrivilegeSeparation yes | |||
# Lifetime and size of ephemeral version 1 server key | |||
KeyRegenerationInterval 3600 | |||
ServerKeyBits 1024 | |||
# Logging | |||
SyslogFacility AUTH | |||
LogLevel INFO | |||
# Authentication: | |||
LoginGraceTime 120 | |||
PermitRootLogin no # or 'without-password' to allow SSH key based login | |||
StrictModes yes | |||
RSAAuthentication yes | |||
PubkeyAuthentication yes | |||
#AuthorizedKeysFile %h/.ssh/authorized_keys | |||
# Don't read the user's ~/.rhosts and ~/.shosts files | |||
IgnoreRhosts yes | |||
# For this to work you will also need host keys in /etc/ssh_known_hosts | |||
RhostsRSAAuthentication no | |||
# similar for protocol version 2 | |||
HostbasedAuthentication no | |||
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication | |||
#IgnoreUserKnownHosts yes | |||
# To enable empty passwords, change to yes (NOT RECOMMENDED) | |||
PermitEmptyPasswords no | |||
# Change to yes to enable challenge-response passwords (beware issues with | |||
# some PAM modules and threads) | |||
ChallengeResponseAuthentication no | |||
# Change to no to disable tunnelled clear text passwords | |||
#PasswordAuthentication yes | |||
# Kerberos options | |||
#KerberosAuthentication no | |||
#KerberosGetAFSToken no | |||
#KerberosOrLocalPasswd yes | |||
#KerberosTicketCleanup yes | |||
# GSSAPI options | |||
#GSSAPIAuthentication no | |||
#GSSAPICleanupCredentials yes | |||
# Cipher selection | |||
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr | |||
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160 | |||
KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1 | |||
X11Forwarding yes | |||
X11DisplayOffset 10 | |||
PrintMotd no | |||
PrintLastLog yes | |||
TCPKeepAlive yes | |||
#UseLogin no | |||
#MaxStartups 10:30:60 | |||
#Banner /etc/issue.net | |||
# Allow client to pass locale environment variables | |||
AcceptEnv LANG LC_* | |||
Subsystem sftp /usr/lib/openssh/sftp-server | |||
# Set this to 'yes' to enable PAM authentication, account processing, | |||
# and session processing. If this is enabled, PAM authentication will | |||
# be allowed through the ChallengeResponseAuthentication and | |||
# PasswordAuthentication. Depending on your PAM configuration, | |||
# PAM authentication via ChallengeResponseAuthentication may bypass | |||
# the setting of "PermitRootLogin without-password". | |||
# If you just want the PAM account and session checks to run without | |||
# PAM authentication, then enable this but set PasswordAuthentication | |||
# and ChallengeResponseAuthentication to 'no'. | |||
UsePAM yes | |||
</syntaxhighlight> | </syntaxhighlight> | ||
Version vom 28. April 2024, 10:45 Uhr
- /etc/ssh/sshd_config
# Package generated configuration file
# See the sshd_config(5) manpage for details
# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes
# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 1024
# Logging
SyslogFacility AUTH
LogLevel INFO
# Authentication:
LoginGraceTime 120
PermitRootLogin no # or 'without-password' to allow SSH key based login
StrictModes yes
RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile %h/.ssh/authorized_keys
# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes
# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no
# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no
# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication yes
# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
# Cipher selection
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160
KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1
X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no
#MaxStartups 10:30:60
#Banner /etc/issue.net
# Allow client to pass locale environment variables
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes
- Curve25519
- OpenSSH 6.6p1 supports Curve25519
- Tested Version
- OpenSSH 6.5 (Debian Jessie)
Kompatibilität
- Older Linux systems won’t support SHA2
- PuTTY (Windows) does not support RIPE-MD160
- Curve25519, AES-GCM and UMAC are only available upstream (OpenSSH 6.6p1)
- DSA host keys have been removed on purpose, the DSS standard does not support for DSA keys stronger than 1024bit [5] which is far below current standards (see section #section:keylengths)
- Legacy systems can use this configuration and simply omit unsupported ciphers, key exchange algorithms and MACs
References
- Cisco SSH is a basic SSH reference for all routers and switches
- Refer to the specific documentation of the device and IOS version that you are configuring
How to test
Connect a client with verbose logging enabled to the SSH server
$ ssh -vvv myserver.com
and observe the key exchange in the output.