LINUXOR.SK ... open source notes ...

OpenSSH - Hardened SSHD configuration

category: configz · date: 2023-11-29 · updated: 2026-09-11 · author: LALA

The profile is intentionally written for current OpenSSH 10.x behavior. It keeps security-sensitive policy explicit while leaving cryptographic negotiation to current OpenSSH defaults. That is preferable to freezing a long list of algorithms that can become obsolete and can accidentally disable newer protections.

Important deployment assumptions:

Why the cryptographic section changed

OpenSSH 10.0 made mlkem768x25519-sha256 the default key exchange. It is a hybrid post-quantum/classical construction. OpenSSH 10.0 also removed finite-field Diffie-Hellman methods from the server's default KEX list. The OpenSSH project recommends post-quantum key agreement for SSH connections.

Because current OpenSSH defaults evolve with the software, this configuration does not replace KexAlgorithms, Ciphers, MACs, or HostKeyAlgorithms with a static allow-list. A static list should be added only where a specific compliance profile requires one and should then be maintained as its own security policy.

Deployment checks

Before reloading SSH, validate both syntax and the effective configuration:

bash
$ sshd -t
$ sshd -T

Inspect the algorithms supported by the installed build when needed:

bash
$ ssh -Q kex
$ ssh -Q cipher
$ ssh -Q mac
$ ssh -Q key

Test from a second session before closing the existing administrative connection.

ini
# /etc/ssh/sshd_config
#
# Hardened general-purpose OpenSSH server profile.
# Target: OpenSSH 10.x (2026).
#
# Validate before reload:
#   sshd -t
#   sshd -T
#
# Keep an existing administrative session open while testing changes.

# -----------------------------------------------------------------------------
# Network
# -----------------------------------------------------------------------------

Port 22
AddressFamily any

# Prefer binding through the host firewall / network policy. If a dedicated
# management address is required, uncomment and replace with the real address.
# ListenAddress 192.0.2.10

# -----------------------------------------------------------------------------
# Host identity
# -----------------------------------------------------------------------------

# Ed25519 is the preferred compact modern host key for non-FIPS deployments.
HostKey /etc/ssh/ssh_host_ed25519_key

# Do not explicitly pin HostKeyAlgorithms, KexAlgorithms, Ciphers or MACs here.
# OpenSSH 10.x has strong evolving defaults, including hybrid post-quantum KEX.
# Avoid re-enabling legacy algorithms such as ssh-dss or ssh-rsa/SHA-1.

# -----------------------------------------------------------------------------
# Authentication
# -----------------------------------------------------------------------------

PermitRootLogin no

PubkeyAuthentication yes
AuthenticationMethods publickey

PasswordAuthentication no
KbdInteractiveAuthentication no
PermitEmptyPasswords no
HostbasedAuthentication no
IgnoreRhosts yes

# PAM remains useful for account/session policy on Linux even when PAM-based
# password and keyboard-interactive authentication are disabled above.
UsePAM yes

StrictModes yes
AuthorizedKeysFile .ssh/authorized_keys

LoginGraceTime 30
MaxAuthTries 3
MaxSessions 4

# Replace this placeholder group with the administrative group used locally.
AllowGroups ssh-users

# -----------------------------------------------------------------------------
# Brute-force / unauthenticated connection resistance
# -----------------------------------------------------------------------------

# Random early drop for excessive unauthenticated connections.
MaxStartups 10:30:60

# Limit simultaneous unauthenticated connections from one source.
PerSourceMaxStartups 3

# OpenSSH's PerSourcePenalties protection is enabled by default on current
# releases. Keep it enabled unless there is a documented operational reason
# to change it.

# -----------------------------------------------------------------------------
# Session and environment
# -----------------------------------------------------------------------------

PermitUserEnvironment no
PermitUserRC no

# Accept only basic locale information. Add more only when applications need it.
AcceptEnv LANG LC_*

ClientAliveInterval 300
ClientAliveCountMax 2

TCPKeepAlive no
Compression no

PrintMotd no
Banner /etc/issue.net

Subsystem sftp internal-sftp

# -----------------------------------------------------------------------------
# Forwarding and interactive features
# -----------------------------------------------------------------------------

# General servers do not need to act as SSH forwarding gateways.
DisableForwarding yes

AllowAgentForwarding no
AllowTcpForwarding no
AllowStreamLocalForwarding no
GatewayPorts no
PermitTunnel no
X11Forwarding no

# -----------------------------------------------------------------------------
# Logging
# -----------------------------------------------------------------------------

SyslogFacility AUTHPRIV

# VERBOSE logs additional authentication detail such as public-key fingerprints,
# which is useful for security auditing. Review local privacy/log-retention rules.
LogLevel VERBOSE

Notes

DisableForwarding yes provides defense in depth on a normal server where SSH is intended only for administration. The individual forwarding directives are also set to no to make the intended policy immediately visible to a reviewer.

LogLevel VERBOSE is useful for administrative auditing because OpenSSH can record additional authentication details, including key fingerprints. Where those logs are centrally collected, retention and access should follow the organization's logging and privacy policy.

PerSourceMaxStartups 3 adds a per-source ceiling in addition to the global MaxStartups limit. Current OpenSSH also has PerSourcePenalties, enabled by default, to temporarily refuse sources that exhibit suspicious authentication behavior.

References

← configz