Skip to content

Restricting SSH access

Default configuration file

sudoedit /etc/ssh/sshd_config

Creating custom config file

sudoedit /etc/ssh/sshd_config.d/hardened.conf

AllowUsers user1 admin1
AllowGroups group1 group1 admin
PermitRootLogin no
PasswordAuthentication no

Allowing hosts

sudo vim /etc/hosts.allow

Allow hosts on network using firewall

sudo ufw allow from 10.22.12.0/24 proto tcp to any port 22

Enabling certificate based SSH authentication

ssh-keygen

:::info ssh-keygen not to be run as root as this will add key to root user :::

ssh-copy-id user@host

Creating certifiacte

sudo ssh-keygen -q -N "" -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key

sudo ssh-keygen -q -N "" -t ed25519 -f /etc/ssh/ssh_host_ed25519_key

Adding to /etc/ssh/sshd_conf.d/hardened.conf

HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
HostKeyAlgorithm ssh-ed25519,ssh-ed25519-cert,...

:::info The last line can be found in `cat ~/key-algorithms.txt :::