sshd_config hardening

sshd_config

# Insert these at the beginning of an existing sshd_config file

KexAlgorithms [email protected]
Ciphers [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr
MACs [email protected],[email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,[email protected]
Protocol 2
HostKey /etc/ssh/ssh_host_ed25519_key
HostKey /etc/ssh/ssh_host_rsa_key
PasswordAuthentication no
ChallengeResponseAuthentication no
PubkeyAuthentication yes

# Optional group restriction:
# AllowGroups groupname

# If using Tor hidden services:
# ListenAddress 127.0.0.1:22
#
# Also add this to /etc/tor/torrc
# HiddenServiceDir /var/lib/tor/hidden_service/ssh
# HiddenServicePort 22 127.0.0.1:22

# Generate server keys:
# cd /etc/ssh
# rm ssh_host_*key*
# ssh-keygen -t ed25519 -f ssh_host_ed25519_key < /dev/null
# ssh-keygen -t rsa -b 4096 -f ssh_host_rsa_key < /dev/null