2021-01-30 19:47:21 +01:00
|
|
|
# RSA and Ed25519 are fine, but DSA is broken and ecdsa is suspicious
|
2021-01-30 20:31:38 +01:00
|
|
|
# Missing keys?
|
|
|
|
|
# ssh-keygen -t ed25519 -N "" -f /etc/ssh/ssh_host_ed25519_key
|
|
|
|
|
# ssh-keygen -t rsa -N "" -f /etc/ssh/ssh_host_rsa_key
|
2021-01-30 19:47:21 +01:00
|
|
|
HostKey /etc/ssh/ssh_host_rsa_key
|
|
|
|
|
HostKey /etc/ssh/ssh_host_ed25519_key
|
|
|
|
|
|
|
|
|
|
# Includes public keys in logins
|
|
|
|
|
LogLevel VERBOSE
|
|
|
|
|
|
2021-01-30 20:18:41 +01:00
|
|
|
# No direct root login, keys might be ok, but audit trail
|
|
|
|
|
PermitRootLogin no
|
2021-01-30 19:47:21 +01:00
|
|
|
# Passwords are bad
|
|
|
|
|
PasswordAuthentication no
|
2021-01-30 20:18:41 +01:00
|
|
|
AuthenticationMethods publickey
|
|
|
|
|
|
2021-01-30 20:31:38 +01:00
|
|
|
# Log sftp level file access (read/write/etc.) that would not be easily logged otherwise.
|
|
|
|
|
# Debian
|
2021-01-30 20:18:41 +01:00
|
|
|
#Subsystem sftp /usr/lib/ssh/sftp-server -f AUTHPRIV -l INFO
|
2021-01-30 20:31:38 +01:00
|
|
|
# Fedora
|
|
|
|
|
#Subsystem sftp /usr/libexec/openssh/sftp-server -f AUTHPRIV -l INFO
|
