-
-
Save miticojo/4f75a608a5e3f63d51bb6d46178fa4b6 to your computer and use it in GitHub Desktop.
Secure SSH Config
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# Recommendations from https://stribika.github.io/2015/01/04/secure-secure-shell.html | |
# Github needs diffie-hellman-group-exchange-sha1 some of the time but not always. | |
#Host github.com | |
# KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1 | |
Host * | |
KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256 | |
Host * | |
PasswordAuthentication no | |
ChallengeResponseAuthentication no | |
Host * | |
PubkeyAuthentication yes | |
HostKeyAlgorithms ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-ed25519,ssh-rsa | |
Host * | |
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr | |
Host * | |
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com | |
Host * | |
UseRoaming no |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# Recommendations from https://stribika.github.io/2015/01/04/secure-secure-shell.html | |
KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256 | |
Protocol 2 | |
HostKey /etc/ssh/ssh_host_rsa_key | |
HostKey /etc/ssh/ssh_host_ed25519_key | |
PasswordAuthentication no | |
ChallengeResponseAuthentication no | |
PubkeyAuthentication yes | |
# Unpractical for the forge user in case of reprovision? | |
# AllowGroups ssh-user | |
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr | |
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com | |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment