Skip to content

Instantly share code, notes, and snippets.

@tankmek

tankmek/sshd_config

Created June 3, 2018 20:50
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save tankmek/877fcdd257d8fe1ffa8c40b16e97ba16 to your computer and use it in GitHub Desktop.
Save tankmek/877fcdd257d8fe1ffa8c40b16e97ba16 to your computer and use it in GitHub Desktop.
Download ZIP
More secure key exchange algorithms, ciphers and message authentication codes. Less secure choices are disabled. MITM could enable weak choices if not disabled.
Raw
sshd_config
## Better SSH Security
# @c0demech // Michael Edie
# If using the following key exchange protocol:
# diffie-hellman-group-exchange-sha256: Custom DH with SHA2
# run the following:
# ssh-keygen -G /tmp/moduli -b 4096
# ssh-keygen -T /etc/ssh/moduli -f /tmp/moduli
# Generate rsa key with:
# ssh-keygen -t rsa -b 4096 -f ssh_host_rsa_key < /dev/null
Protocol 2
HostKey /etc/ssh/ssh_host_ed25519_key
HostKey /etc/ssh/ssh_host_rsa_key
## Use at least 128 bits
KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment