What are the toughest SSH daemon settings in terms of encryption, handshake, or other cryptographic settings? [duplicate]

Question

I work heavily with SSH and SFTP, to be specific between two machines, both of which have their SSH port open on a public IP address.

What are the toughest SSH daemon settings in terms of encryption, handshake, or other cryptographic settings in 2018?

I am specifically interested in the cryptographic protocols. Securing SSH with good password selection, good key management, firewalling, etc. are out of scope for what I am asking here.

So far, I have found and set on both machines in /etc/ssh/sshd_config:

AuthenticationMethods publickey
Ciphers aes256-cbc
MACs [email protected]
FingerprintHash sha512
#KexAlgorithms

This can be considered a follow-up question of Hardening SSH security on a Debian 9 server which I have posted before some time ago. But in a specific way, I want to know the highest settings.

Answer 1

You have a good discussion here: https://wiki.mozilla.org/Security/Guidelines/OpenSSH

On modern OpenSSH they recommend:

KexAlgorithms [email protected],ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256

Ciphers [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr

MACs [email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,[email protected]

This page gives explanations for each choice: https://stribika.github.io/2015/01/04/secure-secure-shell.html

(do not be fooled by the hardcoded date in the URL, the document is updated from time to time as can be seen from its "changelog" at https://github.com/stribika/stribika.github.io/commits/master/_posts/2015-01-04-secure-secure-shell.md)

Against Logjam, see the end of https://weakdh.org/sysadmin.html :

KexAlgorithms [email protected]

Answer 2

To be honest, I don't understand these things too much, I just want strong encryption and everything

I don't know what you mean by "everything" but if you just want strong encryption then don't mess with the default settings - its possible they could be more secure but you are more likely to break the security than improve it if you don't know what you are doing.

The authentication and negotiation ciphers are far more important than the symmetric algorithm for the overall security - and you've told us nothing about these.

Wanting to know more is a good thing - but the consensus of opinion on the strongest ciphers in February 2018 (at least when you're referring to a an up to date version of well maintained software) is of very little value compared with an understanding of the protocol works and how the implementation integrates with your operating system.

Answer 3

Following config can provide higher security level while keeping some degree of compatibility and reduce configuration complexity.

WARNING: The following configuration is not compatible with all clients

# Change the port number avoid automated attack
Port 2222

# Limit to SSH2 only (the default value)
Protocol 2

# Use RSA and Ed25519 host key only
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ed25519_key

# No root login, obvious
PermitRootLogin no

# Log the finger print of public key used to login, provide audit trails. Might take up more storage.
LogLevel VERBOSE

# 2 Factor Authentication. User must present a valid public key first, then enter the correct password to login
AuthenticationMethods publickey,password

# How fast you can type your password?
LoginGraceTime 20

# Key Exchange
KexAlgorithms [email protected],diffie-hellman-group-exchange-sha256

# Ciphers
Ciphers [email protected],[email protected],[email protected],aes256-ctr,aes128-ctr

# MACs
MACs [email protected],[email protected],[email protected],

# Only allow specific group member login via SSH
AllowGroups ssh-user

# Renew encryption key every 30 minutes or 1 GB of transferred data (overkill & generate overhead, use with caution, especially on slow network)
#RekeyLimit 1G 1800

Remove moduli under 3072 bits for security (Thanks Mozilla)

awk '$5 >= 3071' /etc/ssh/moduli > /etc/ssh/moduli.tmp && mv /etc/ssh/moduli.tmp /etc/ssh/moduli

The security can further improve with more tweaks such as firewall (iptables), fail2ban, Tor hidden service, switch to custom moduli and tcpwrapper, but those topics are out of scope in this answer. Note that the configuration is not completed, you might need other essential parts for the daemon to work. Remember to backup the original config file so you can roll back if any things goes wrong.

Answer 4

I gave a detailed answer to this in my answer to How to (further) ensure SSH security?, and per ssh.com and the OpenSSH changelog it appears that updates include

• if you prefer ecdsa to ed25519, that's an option on some SSH software
• StrictHostKeyChecking has more options.
• DisableForwarding is new
• use all SHA2 signatures, no SHA1 signatures