Stribika

I like reading tutorials on this subject. One of my favorites, albeit six years old, is https://stribika.github.io/2015/01/04/secure-secure-shell.html

If you like Wireguard's security, you can emulate it in your sshd_config: Ciphers [email protected] KexAlgorithms [email protected] MACs [email protected] The MAC is irrelevant, as that function is built into the AEAD cipher, which are to be preferred (the alternate is AES-GCM). This will shut off a lot of legacy SSH clients. Android Connectbot specifically needs the AES cipher; adding it causes problems for putty. Otherwise, this is the classic "best practice" site for SSH: https://stribika.github.io/2015/01/04/secure-secure-shell.html

Secure Secure Shell guide is a good security baseline, including generating long enough moduli and using EC. https://stribika.github.io/2015/01/04/secure-secure-shell.html In the future, recommendations will need to be increased and less secure methods deprecated.

A great article on securing SSH is "Secure Secure Shell”: https://stribika.github.io/2015/01/04/secure-secure-shell.html

The EFF addressed this today. For SSH, they suggested this guide. https://stribika.github.io/2015/01/04/secure-secure-shell.html Indeed, the guide recommends generating new contents for the /etc/ssh/moduli file (IFF you keep `diffie-hellman-group-exchange-sha256` enabled).

If you configure your SSH server for a limited, secure set of ciphers and HMACs, these automated attacks won't even get to the point of attempting authentication. https://stribika.github.io/2015/01/04/secure-secure-shell.html Since following the above guide, my auth log has been filled with nothing but this: Sep 30 09:46:00 myserver sshd[74033]: fatal: no matching mac found: client hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,[email protected] server [email protected],[email protected] [preauth] Of course, I can't use old SSH clients to connect, but it's a good tradeoff, IMO.

You might want to follow these instructions to secure your ssh server and client https://stribika.github.io/2015/01/04/secure-secure-shell.html Be careful: not all clients support the newest algorithms. Example: Ubuntu 12.04 ssh client doesn't support [email protected] (I'm still googling how to upgrade to the latest openssh, anybody has the answer?) In general, check that you are still able to connect to your server before closing your last ssh connection to it.

Thank you! So to help everyone (read whole post first), you should probably have the line KexAlgorithms [email protected],[email protected],diffie-hellman-group-exchange-sha256 in /etc/ssh/sshd_config of server and /etc/ssh/ssh_config of client (under "Host "). (The rest of the kex recommendations are from https://stribika.github.io/2015/01/04/secure-secure-shell.html) --- However, for some reason after running "/usr/sbin/sshd -T" it said "/etc/ssh/sshd_config line 2: Bad SSH2 KexAlgorithms '[email protected]'." so I played around. It's hard for me to go back on everything I tried but a working solution seemed to be to add the KexAlgorithms [email protected],[email protected],diffie-hellman-group-exchange-sha256 line to server's "/usr/local/etc/sshd_config" and to client's "/usr/local/etc/ssh_config" under "Host ". You then need to start the server by running "sudo /usr/local/sbin/sshd" and you need to use the ssh client with the binary "/usr/local/bin/ssh".

I found disabling aes ciphers alone killed 90% of the bots with an occasional ECC only bot sneaking through. I only have 2-3 options for MAC, KEX and cipher. Certain mobile clients won't work (older embedded ssh library) but others support more modern configs. But I started my journey with [1] and have slowly tweaked and slimmed it down over the years. https://stribika.github.io/2015/01/04/secure-secure-shell.html

Sorry but why exactly should NIST be trusted? https://projectbullrun.org/dual-ec/vulnerability.html It seems from many sources that NIST were pushing a backdoored RNG source for a while. The main source for the ssh-keys arch wiki even says not to trust NIST. https://wiki.archlinux.org/index.php/SSH_keys https://stribika.github.io/2015/01/04/secure-secure-shell.html

> Fortunately, RSA using SHA1 is not a problem here because the value being signed is actually a SHA2 hash. The hash function SHA1(SHA2(x)) is just as secure as SHA2 (it has less bits of course but no better attacks). From: https://stribika.github.io/2015/01/04/secure-secure-shell.html

The site also seems to flag RSA host keys. Using SHA1 in this case shouldn't be a security issue since the hash is calculated as SHA1(SHA2(x)) and you would need to break SHA2 as well. [1] [1] - https://stribika.github.io/2015/01/04/secure-secure-shell.html

This article is very detailed and includes examples of setting sshd to only use more secure options: https://stribika.github.io/2015/01/04/secure-secure-shell.html There was also a lot of HN discussion about it: https://news.ycombinator.com/item?id=8843994

Maybe a more technical/comprehensive read is this[1] writeup, which I see some others have linked to. Prior HN[2]. [1] https://stribika.github.io/2015/01/04/secure-secure-shell.html [2] https://news.ycombinator.com/item?id=8843994

This is good advice on achieving the most secure SSH configuration: https://stribika.github.io/2015/01/04/secure-secure-shell.html "My goal with this post here is to make NSA analysts sad."

My hardened ~/.ssh/config on OS X 10.11: Host * Ciphers [email protected],[email protected],[email protected],aes256-ctr MACs [email protected],[email protected],hmac-sha2-512,hmac-sha2-256 KexAlgorithms [email protected],diffie-hellman-group-exchange-sha256 HostKeyAlgorithms ssh-ed25519,ssh-rsa ChallengeResponseAuthentication no UseRoaming no If you only connect to newer servers you can further restrict ciphers to only use AEADs (only list the chacha20-poly1305 and aes-gcm ciphers). I assume using AEADs-only makes the MACs keyword obsolete, is this correct? Config is based on tips from https://stribika.github.io/2015/01/04/secure-secure-shell.html

Here is a pretty good guide for configuring SSH in a secure way that also goes into detail regarding the crypto side: https://stribika.github.io/2015/01/04/secure-secure-shell.html You probably also want to set kex, ciphers and MAC preferences in your client config for when you connect to servers with suboptimal settings. Personally, I have also moved away from RSA keys and prefer using Ed25519 ones instead.

This was some recent advice for SSH: https://stribika.github.io/2015/01/04/secure-secure-shell.html It was on discussed on HN, at the time noone pointed out anything glaring about the advice given.

This is my standard on new server setup (which is admittedly overkill but I'd rather have it slightly slower and safer): http://www.catb.org/esr/sshexport/ https://stribika.github.io/2015/01/04/secure-secure-shell.html SERVER SIDE: sources.list (if you're on an older version of debian) deb http://http.debian.net/debian wheezy-backports main apt-get -t wheezy-backports install --reinstall ssh ==== cd /etc/ssh rm ssh_host_key ssh-keygen -t ed25519 -f ssh_host_ed25519_key -a 256 < /dev/null ssh-keygen -t rsa -b 4096 -f ssh_host_rsa_key < /dev/null (do not password protect server side keys) ==== /etc/ssh/sshd_config Protocol 2 HostKey /etc/ssh/ssh_host_ed25519_key HostKey /etc/ssh/ssh_host_rsa_key KexAlgorithms [email protected],diffie-hellman-group-exchange-sha256 Ciphers [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr MACs [email protected],[email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,[email protected] ==== CLIENT SIDE: /etc/ssh/ssh_config Host * KexAlgorithms [email protected],diffie-hellman-group-exchange-sha256 Ciphers [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr MACs…

Technically you don't need the root password, you can always password recovery if you have access to the box. And how exactly did you lock yourself out of every account with sudo? Of course there's always "messed up my ldap or general network settings, can't log in to fix them". There's nothing wrong with setting your root password to a random string and throwing it away, after verifying your sudo works, I guess. I will admit to being lazy, and with full automation its faster to spawn a new virtual image and let ansible run its course than to do root password recovery where you boot and tell the bootloader to make the init system /bin/sh and hand edit /etc/shadow and /etc/passwd and then reboot again, etc etc. I mean I can set up a new image almost as fast as I can reboot an old image, and I set up images a lot more often than I do password recovery, so... Scrap the ssh commentary and set up ssh company wide as per stribika plus or minus local modifications: https://stribika.github.io/2015/01/04/secure-secure-shell.html "On large scale, you'll be better off with a full automated setup using something like Ansible" At ANY scale you're better off, unless you're experimenting or time isn't money. It'll take longer to add the time to document and test what you're doing by hand than to convince ansible to do it for you. If you don't document or test you're just doomed, so its not like you can avoid that effort. With automation this is like "first two minutes on a…

For OpenSSH, take a close, hard look at /etc/ssh/moduli (or wherever it's at) too, in addition to EC curves. I would consider deleting the default moduli and regenerating it. https://stribika.github.io/2015/01/04/secure-secure-shell.html In my mind, more generally: EC attempts to make crypto algos stretch using fewer bits but implementations are harder to prove both theoretically (by being more esoteric, therefore fewer eyeballs are able to catch errors) and functionally correct (by having more moving parts). Why haven't more conservative stretching / extension of proven algos happened? Also, even more broadly, this and at lot of other crypto decisions in TLS come off as seat-of-the-pants, guesswork, cooking by committee rather than simple, feature-minimal and bullet-resistant standards (how many way over-engineered and over-featured encodings do certs need?). The result smells like a pile of poo that will get recall after recall, patch after patch until something about the inputs and decision-making process changes. We can't keep having OpenSSL and the TLS committee saying "yes" instead of "no" to (feature creep) throwing every little edge use-case live into production 1.x branch, the codebase is huge enough, and it's nearly impossible to compile out all the little used crap, even in forks. Doing the same thing and expecting a different result is either stupid or insane, or both. OpenSSL and TLS leadership, process changes perhaps?