20230808 sshd_config

sshd_config

###                           ###
# ----------------------------- #
#   Service-wide configs        #
# ----------------------------- #
###                           ###

# Listening port for the SSH server
Port 311

# Listening addresses
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

# Host keys
HostKey /etc/ssh/ssh_host_ed25519_key

# Allowed Key Exchange algorithms
#   - obtained on 21st July 2023 from Mozilla OpenSSH Guide
KexAlgorithms [email protected],ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256

# Allowed Ciphers
#   - obtained on 21st July 2023 from Mozilla OpenSSH Guide
Ciphers [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr

# Allowed message authentication code algorithms
#   - obtained on 21st July 2023 from Mozilla OpenSSH Guide
MACs [email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,[email protected]

# LogLevel
#   - obtained on 21st July 2023 from Mozilla OpenSSH Guide
#   - VERBOSE logs user's key fingerprint on login.
#     Needed to have a clear audit track of which key was using to log in.
LogLevel VERBOSE

###                           ###
# ----------------------------- #
#   Authentication configs      #
# ----------------------------- #
###                           ###

# Graceful timeout for each session auth
LoginGraceTime 30s

# Session key renegotiation
RekeyLimit 128K 60s

##
# Password based logins are disabled
#   - only public key based logins are allowed.
##
AuthenticationMethods publickey

# Temporary rule to allow root to login using SSH keys
PermitRootLogin prohibit-password

# Configure location for the 'authorized_keys' file
AuthorizedKeysFile  .ssh/authorized_keys

# Allow SSH service to authenticate user with PAM modules
UsePAM yes

# Print MOTD
PrintMotd no

###                           ###
# ----------------------------- #
#   Service subsystems          #
# ----------------------------- #
###                           ###

# SFTP service
Subsystem   sftp    /usr/lib/ssh/sftp-server -f AUTHPRIV -l INFO