SSH/Kryptografie/Konfiguration: Unterschied zwischen den Versionen
Keine Bearbeitungszusammenfassung |
Keine Bearbeitungszusammenfassung |
||
Zeile 50: | Zeile 50: | ||
# some PAM modules and threads) | # some PAM modules and threads) | ||
ChallengeResponseAuthentication no | ChallengeResponseAuthentication no | ||
# Change to no to disable tunnelled clear text passwords | # Change to no to disable tunnelled clear text passwords | ||
#PasswordAuthentication yes | #PasswordAuthentication yes | ||
# Kerberos options | # Kerberos options | ||
#KerberosAuthentication no | #KerberosAuthentication no | ||
Zeile 57: | Zeile 59: | ||
#KerberosOrLocalPasswd yes | #KerberosOrLocalPasswd yes | ||
#KerberosTicketCleanup yes | #KerberosTicketCleanup yes | ||
# GSSAPI options | # GSSAPI options | ||
#GSSAPIAuthentication no | #GSSAPIAuthentication no | ||
#GSSAPICleanupCredentials yes | #GSSAPICleanupCredentials yes | ||
# Cipher selection | # Cipher selection | ||
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr | Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr | ||
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160 | MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160 | ||
KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1 | KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1 | ||
X11Forwarding yes | X11Forwarding yes | ||
X11DisplayOffset 10 | X11DisplayOffset 10 | ||
PrintMotd no | PrintMotd no | ||
Zeile 72: | Zeile 80: | ||
#MaxStartups 10:30:60 | #MaxStartups 10:30:60 | ||
#Banner /etc/issue.net | #Banner /etc/issue.net | ||
# Allow client to pass locale environment variables | # Allow client to pass locale environment variables | ||
AcceptEnv LANG LC_* | AcceptEnv LANG LC_* | ||
Subsystem sftp /usr/lib/openssh/sftp-server | Subsystem sftp /usr/lib/openssh/sftp-server | ||
# Set this to 'yes' to enable PAM authentication, account processing, | # Set this to 'yes' to enable PAM authentication, account processing, | ||
# and session processing. If this is enabled, PAM authentication will | # and session processing. If this is enabled, PAM authentication will |
Version vom 28. April 2024, 11:10 Uhr
- /etc/ssh/sshd_config
# Package generated configuration file
# See the sshd_config(5) manpage for details
# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes
# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 1024
# Logging
SyslogFacility AUTH
LogLevel INFO
# Authentication:
LoginGraceTime 120
PermitRootLogin no # or 'without-password' to allow SSH key based login
StrictModes yes
RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile %h/.ssh/authorized_keys
# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes
# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no
# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no
# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication yes
# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
# Cipher selection
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160
KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1
X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no
#MaxStartups 10:30:60
#Banner /etc/issue.net
# Allow client to pass locale environment variables
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes
- Curve25519
- OpenSSH 6.6p1 supports Curve25519
- Tested Version
- OpenSSH 6.5 (Debian Jessie)
Kompatibilität
- Older Linux systems won’t support SHA2
- PuTTY (Windows) does not support RIPE-MD160
- Curve25519, AES-GCM and UMAC are only available upstream (OpenSSH 6.6p1)
- DSA host keys have been removed on purpose, the DSS standard does not support for DSA keys stronger than 1024bit [5] which is far below current standards (see section #section:keylengths)
- Legacy systems can use this configuration and simply omit unsupported ciphers, key exchange algorithms and MACs
References
- Cisco SSH is a basic SSH reference for all routers and switches
- Refer to the specific documentation of the device and IOS version that you are configuring
How to test
Connect a client with verbose logging enabled to the SSH server
$ ssh -vvv myserver.com
and observe the key exchange in the output.