diff options
| author | Egor Tensin <Egor.Tensin@gmail.com> | 2023-08-04 14:31:08 +0200 |
|---|---|---|
| committer | Egor Tensin <Egor.Tensin@gmail.com> | 2023-08-04 14:31:08 +0200 |
| commit | 0e87875de0f5bbbade1ad3515c72abaadbe46204 (patch) | |
| tree | 26d141bd7968f7f34091cf245ae1f11d6d3b2ee8 /yandex/server/etc/sshd_config | |
| parent | import some common modules (diff) | |
| download | infra-terraform-0.0.2.tar.gz infra-terraform-0.0.2.zip | |
import a couple of Yandex Cloud moduelsv0.0.2
Diffstat (limited to 'yandex/server/etc/sshd_config')
| -rw-r--r-- | yandex/server/etc/sshd_config | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/yandex/server/etc/sshd_config b/yandex/server/etc/sshd_config new file mode 100644 index 0000000..ae08408 --- /dev/null +++ b/yandex/server/etc/sshd_config @@ -0,0 +1,39 @@ +Protocol 2 +Port ${port} + +# Drop idle sessions: +ClientAliveCountMax 3 +ClientAliveInterval 15 + +# Allow reverse tunnels: +GatewayPorts yes + +# Miscellaneous: +PrintMotd no + +# Hardening. +# Source: https://infosec.mozilla.org/guidelines/openssh.html + +# Only Ed25519: +HostKey /etc/ssh/ssh_host_ed25519_key + +# Only the first choices for ciphers: +KexAlgorithms curve25519-sha256@libssh.org +Ciphers chacha20-poly1305@openssh.com +MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com + +# No password login: +PasswordAuthentication no +AuthenticationMethods publickey +# Whitelist users: +PermitRootLogin no +AllowGroups ${join(" ", users)} + +# Log things: +Subsystem sftp /usr/lib/openssh/sftp-server -f AUTHPRIV -l INFO + +# Whitelist accepted environment variables: +AcceptEnv LANG LC_* + +# Why the fuck would I need X11 forwarding? +X11Forwarding no |