Comment on Simple SSH SecurityComments−alphabettsy4yI like to refer to: https://infosec.mozilla.org/guidelines/openssh−chasil4yI prefer limiting to DJB ciphers where possible (the AES-GCM suites might also be helpful, but otherwise anything below is legacy crypto): Ciphers chacha20-poly1305@openssh.com KexAlgorithms curve25519-sha256@libssh.org AFAIK, if RSA is off the table, then the moduli file isn't necessary. RSAAuthentication no SFTP-only accounts are advised in "SSH Mastery" by Michael Lucas to follow this form: Match Group sftponly ChrootDirectory %h ForceCommand internal-sftp AllowTcpForwarding no I'm still seeing the external sftp subsystem in latest loads (last seen is Microsoft). Internal is better, and required for chroot. Subsystem sftp internal-sftp I like to put SFTP users on a separate server, just for them, and turn some other things off: PermitTunnel no X11Forwarding no PermitRootLogin no AllowTcpForwarding no Those are some settings that I would prefer.−cjcampbell4yModuli would be relevant to DH kex, though you’re safe when limiting to ed25519.−haartsOP4yThat's brilliant!
Comments
I like to refer to: https://infosec.mozilla.org/guidelines/openssh
I prefer limiting to DJB ciphers where possible (the AES-GCM suites might also be helpful, but otherwise anything below is legacy crypto):
AFAIK, if RSA is off the table, then the moduli file isn't necessary. SFTP-only accounts are advised in "SSH Mastery" by Michael Lucas to follow this form: I'm still seeing the external sftp subsystem in latest loads (last seen is Microsoft). Internal is better, and required for chroot. I like to put SFTP users on a separate server, just for them, and turn some other things off: Those are some settings that I would prefer.Moduli would be relevant to DH kex, though you’re safe when limiting to ed25519.
That's brilliant!