rpriven
31ee08b0a0
- README: full category index (was missing ~23 files incl. the richest privacy sheets) - sandboxing.cheat: firejail, bubblewrap, Flatpak/Flatseal, distrobox/podman - firewall.cheat: ufw, nftables, iptables (with the Tailscale-flush warning) - dns-privacy.cheat: DoH/DoT, dnscrypt, unbound, Pi-hole - ssh-hardening.cheat: keys-only, modern crypto, fail2ban, FIDO2 - Red-teamed clean (no real PII/secrets) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
61 lines
1.7 KiB
Text
61 lines
1.7 KiB
Text
% ssh, hardening, sshd, openssh, security
|
|
|
|
# Harden SSH: keys-only, no root, modern crypto, rate-limited.
|
|
# ALWAYS keep a second session open while editing sshd_config so a typo can't lock you out.
|
|
|
|
# --- KEYS ---
|
|
|
|
# Generate a modern key (ed25519)
|
|
ssh-keygen -t ed25519 -C "<comment>"
|
|
|
|
# Hardware-backed key (FIDO2 / YubiKey — requires a touch to use)
|
|
ssh-keygen -t ed25519-sk -C "<comment>"
|
|
|
|
# Copy your public key to a server
|
|
ssh-copy-id <user>@<host>
|
|
|
|
# Add a key with confirm-on-use (agent prompts before every use)
|
|
ssh-add -c ~/.ssh/id_ed25519
|
|
|
|
$ host: grep -hoP '^Host \K[^*]+' ~/.ssh/config 2>/dev/null
|
|
|
|
# --- sshd_config HARDENING (/etc/ssh/sshd_config) ---
|
|
|
|
# Keys only, no root, no passwords:
|
|
# PermitRootLogin no
|
|
# PasswordAuthentication no
|
|
# KbdInteractiveAuthentication no
|
|
# PubkeyAuthentication yes
|
|
# Limit who can log in:
|
|
# AllowUsers <user>
|
|
# Shrink brute-force surface:
|
|
# MaxAuthTries 3
|
|
# LoginGraceTime 20
|
|
# Modern crypto only:
|
|
# KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org
|
|
# Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
|
|
# MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
|
|
|
|
# TEST the config BEFORE restarting (catches typos that would lock you out)
|
|
sudo sshd -t
|
|
|
|
# Restart (keep your other session open!)
|
|
sudo systemctl restart ssh
|
|
|
|
# --- fail2ban (ban brute-forcers) ---
|
|
|
|
sudo fail2ban-client -t
|
|
sudo fail2ban-client status sshd
|
|
sudo fail2ban-client set sshd unbanip <ip>
|
|
|
|
# --- CLIENT: ~/.ssh/config aliases (stop typing IPs) ---
|
|
|
|
# Host myserver
|
|
# HostName <ip-or-domain>
|
|
# User <user>
|
|
# Port <port>
|
|
# IdentityFile ~/.ssh/id_ed25519
|
|
# IdentitiesOnly yes
|
|
|
|
# Audit the crypto a server actually offers
|
|
ssh -vv <host> 2>&1 | grep -iE 'cipher|kex|mac'
|