diff options
| author | Ahmed Abdelhalim <[email protected]> | 2021-06-25 19:26:32 +0200 |
|---|---|---|
| committer | Ahmed Abdelhalim <[email protected]> | 2021-06-25 19:26:32 +0200 |
| commit | 4003d3b865def3f0699c2391f351fc195897097f (patch) | |
| tree | ab565ef4e293697add6518b90a81c8bb7ae09cc7 /etc/ssh | |
| parent | e5b6af1fd92e78d7ad0c034117699824f73af14a (diff) | |
SSH hardening on local machine
Diffstat (limited to 'etc/ssh')
| -rw-r--r-- | etc/ssh/sshd_config | 22 |
1 files changed, 9 insertions, 13 deletions
diff --git a/etc/ssh/sshd_config b/etc/ssh/sshd_config index d45f550..dc944c3 100644 --- a/etc/ssh/sshd_config +++ b/etc/ssh/sshd_config @@ -12,7 +12,8 @@ Include /etc/ssh/sshd_config.d/*.conf -#Port 22 +Protocol 2 +Port 22 #AddressFamily any #ListenAddress 0.0.0.0 #ListenAddress :: @@ -31,7 +32,7 @@ Include /etc/ssh/sshd_config.d/*.conf # Authentication: #LoginGraceTime 2m -#PermitRootLogin prohibit-password +PermitRootLogin no #StrictModes yes #MaxAuthTries 6 #MaxSessions 10 @@ -52,11 +53,11 @@ PubkeyAuthentication yes # HostbasedAuthentication #IgnoreUserKnownHosts no # Don't read the user's ~/.rhosts and ~/.shosts files -#IgnoreRhosts yes +IgnoreRhosts yes # To disable tunneled clear text passwords, change to no here! -#PasswordAuthentication yes -#PermitEmptyPasswords no +PasswordAuthentication no +PermitEmptyPasswords no # Change to yes to enable challenge-response passwords (beware issues with # some PAM modules and threads) @@ -83,21 +84,16 @@ ChallengeResponseAuthentication no # If you just want the PAM account and session checks to run without # PAM authentication, then enable this but set PasswordAuthentication # and ChallengeResponseAuthentication to 'no'. -PasswordAuthentication no UsePAM no -# Disable login as root -PermitRootLogin no -PermitRootLogin prohibit-password - # Allow GPG agent forwarding StreamLocalBindUnlink yes #AllowAgentForwarding yes #AllowTcpForwarding yes #GatewayPorts no -X11Forwarding yes -X11DisplayOffset 10 -X11UseLocalhost no +X11Forwarding no +#X11DisplayOffset 10 +#X11UseLocalhost no #PermitTTY yes PrintMotd no #PrintLastLog yes |