ssh_hardening.sh

#!/usr/bin/env bash
#
# This script hardens new Debian instance securing ssh.
#
# WARNING: You have to create users and store their ssh
# keys in ~/.ssh/authorized_keys on the server BEFORE run it.
# 
# created date:     02.2016
# last update date: 06.02.2017
# author:           @yugoslavskiy
#

ssh_options_to_deny=( 
  "PermitRootLogin" 
  "PasswordAuthentication" 
  "ChallengeResponseAuthentication" 
)

# ssh rsa key authentication and proxying options
ssh_options_to_allow=(
  "RSAAuthentication" 
  "PubkeyAuthentication" 
  "GatewayPorts" 
  "TCPKeepAlive" 
  "AllowTcpForwarding" 
)

ssh_file=/etc/ssh/sshd_config; [ -e "${ssh_file}" ] && cp -n $ssh_file{,.bkup}

for i in ${ssh_options_to_deny[@]} ; do
  sed -i "s/^${i}.*\|#${i}.*/${i} no/" ${ssh_file}
done

for j in ${ssh_options_to_allow[@]} ; do
  sed -i "s/^${j}.*\|#${j}.*/${j} yes/" ${ssh_file}
done

# allow ssh only for sshusers group
echo "AllowGroups sshusers" >> ${ssh_file}

# restart and exit
/etc/init.d/ssh restart

exit 0