]> git.ekhem.eu.org Git - server.git/log
server.git
2 years ago[sshd] Disable reverse DNS checks.
Jakub Czajka [Sun, 25 Sep 2022 19:35:16 +0000 (21:35 +0200)]
[sshd] Disable reverse DNS checks.

By default `sshd` compares the IP address of the client with the
result of a reverse DNS query for that address. However, many clients
do not have reverse DNS records. This commit disables the check.

2 years ago[sshd] Omit additional configuration files.
Jakub Czajka [Sun, 25 Sep 2022 19:15:15 +0000 (21:15 +0200)]
[sshd] Omit additional configuration files.

2 years ago[sshd] Limit the number of alive messages.
Jakub Czajka [Sun, 25 Sep 2022 17:44:41 +0000 (19:44 +0200)]
[sshd] Limit the number of alive messages.

`sshd` keeps idle connection alive for `ClientAliveInterval` seconds
and then sends `ClientAliveCountMax` alive messages. If client does
not respond, `sshd` terminates the connection. This commit limits the
number of alive messages to 1.

Note: `ClientAliveCountMax` applies only to SSH protocol 2.

2 years ago[sshd] Require SSH protocol 2.
Jakub Czajka [Sun, 25 Sep 2022 17:38:27 +0000 (19:38 +0200)]
[sshd] Require SSH protocol 2.

SSH protocol 1 is an older version with known vulnerabilities. This
commit requires `sshd` to use only the newer SSH protocol 2.

2 years ago[sshd] Disable root login.
Jakub Czajka [Sun, 25 Sep 2022 17:19:15 +0000 (19:19 +0200)]
[sshd] Disable root login.

`PermitRootLogin` is set by default to `yes`.

2 years ago[sshd] Listen on a non-standard port.
Jakub Czajka [Sun, 25 Sep 2022 15:27:55 +0000 (17:27 +0200)]
[sshd] Listen on a non-standard port.

By default `sshd` listens on port 22. Most attack scripts are written
for this configuration. This commit changes the port to 72, which is
not used by any other popular service.

2 years ago[sshd] Disable password authentication.
Jakub Czajka [Sun, 25 Sep 2022 15:11:45 +0000 (17:11 +0200)]
[sshd] Disable password authentication.

Client can authenticate with `sshd` through one of following
authentication methods (corresponding sshd_config option in brackets):
- host-based (`HostbasedAuthentication`),
- public key (`PubkeyAuthentication`),
- challenge-response (`ChallengeResponseAuthentication`),
- password (`PasswordAuthentication`).

By default, only `PubkeyAuthentication` and `PasswordAuthentication`
are enabled. This commit disables `PasswordAuthentication`. Users
can now login only using public key authentication.

2 years ago[sshd] Generate default configuration.
Jakub Czajka [Sun, 25 Sep 2022 14:03:34 +0000 (16:03 +0200)]
[sshd] Generate default configuration.

2 years agoDescribe the repository in a README.
Jakub Czajka [Sun, 25 Sep 2022 13:49:57 +0000 (15:49 +0200)]
Describe the repository in a README.