From 4003d3b865def3f0699c2391f351fc195897097f Mon Sep 17 00:00:00 2001
From: Ahmed Abdelhalim <pm@a14m.dev>
Date: Fri, 25 Jun 2021 19:26:32 +0200
Subject: SSH hardening on local machine

---
 .ssh/config         |  1 -
 etc/ssh/sshd_config | 22 +++++++++-------------
 2 files changed, 9 insertions(+), 14 deletions(-)

diff --git a/.ssh/config b/.ssh/config
index 28006aa..975ba3b 100644
--- a/.ssh/config
+++ b/.ssh/config
@@ -10,7 +10,6 @@ Match exec "hostname | grep -F A14M-MBP.local" Host parrotOS
 
 Host parrotOS
   ForwardAgent yes
-  ForwardX11 yes
   StreamLocalBindUnlink yes
 
 Host *.sapera.cloud
diff --git a/etc/ssh/sshd_config b/etc/ssh/sshd_config
index d45f550..dc944c3 100644
--- a/etc/ssh/sshd_config
+++ b/etc/ssh/sshd_config
@@ -12,7 +12,8 @@
 
 Include /etc/ssh/sshd_config.d/*.conf
 
-#Port 22
+Protocol 2
+Port 22
 #AddressFamily any
 #ListenAddress 0.0.0.0
 #ListenAddress ::
@@ -31,7 +32,7 @@ Include /etc/ssh/sshd_config.d/*.conf
 # Authentication:
 
 #LoginGraceTime 2m
-#PermitRootLogin prohibit-password
+PermitRootLogin no
 #StrictModes yes
 #MaxAuthTries 6
 #MaxSessions 10
@@ -52,11 +53,11 @@ PubkeyAuthentication yes
 # HostbasedAuthentication
 #IgnoreUserKnownHosts no
 # Don't read the user's ~/.rhosts and ~/.shosts files
-#IgnoreRhosts yes
+IgnoreRhosts yes
 
 # To disable tunneled clear text passwords, change to no here!
-#PasswordAuthentication yes
-#PermitEmptyPasswords no
+PasswordAuthentication no
+PermitEmptyPasswords no
 
 # Change to yes to enable challenge-response passwords (beware issues with
 # some PAM modules and threads)
@@ -83,21 +84,16 @@ ChallengeResponseAuthentication no
 # If you just want the PAM account and session checks to run without
 # PAM authentication, then enable this but set PasswordAuthentication
 # and ChallengeResponseAuthentication to 'no'.
-PasswordAuthentication no
 UsePAM no
 
-# Disable login as root
-PermitRootLogin no
-PermitRootLogin prohibit-password
-
 # Allow GPG agent forwarding
 StreamLocalBindUnlink yes
 #AllowAgentForwarding yes
 #AllowTcpForwarding yes
 #GatewayPorts no
-X11Forwarding yes
-X11DisplayOffset 10
-X11UseLocalhost no
+X11Forwarding no
+#X11DisplayOffset 10
+#X11UseLocalhost no
 #PermitTTY yes
 PrintMotd no
 #PrintLastLog yes
-- 
cgit v1.2.3