security sshd with better file configuration

huanvnn · 06-02-2006, 10:10 AM

i haven't read in forum alot questions about connection with ssh and sshd security,so i post my sshd_config with the purpose to give everybody more effective control with sshd server.
with this file config of sshd ,my firewall work verywell :
1.it allows ssh connection from identified ip number that i want
2.after 3 attempts unsuccessful of ssh, the sshd server automatically closed the connection

in this thread i want to emphasis about 3 important keys in /etc/sshd/sshd_config

protocol 2 (default protocol 1,2)
allowusers
denyusers (doesn't appear in default configuration file)
LoginGraceTime (the time for you to type password and user or the time to enter your connection)

I appreciate if everybody discusses with me in this topic

/etc/sshd/sshd_config

# $OpenBSD: sshd_config,v 1.59 2002/09/25 11:17:16 markus Exp $

# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options change a
# default value.

#Port 22
Protocol 2
#ListenAddress 192.168.0.1
#ListenAddress 0.0.0.0
#ListenAddress ::

# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key

# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 3600
#ServerKeyBits 768

# Logging
#obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
SyslogFacility AUTHPRIV
#LogLevel INFO

# Authentication:

LoginGraceTime 15
#PermitRootLogin yes
#StrictModes yes

#RSAAuthentication yes
#PubkeyAuthentication yes
#AuthorizedKeysFile .ssh/authorized_keys

# rhosts authentication should not be used
#RhostsAuthentication no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no

# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes
# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#AllowUsers root@193.178.34.37 , root@192.168.0.*
#DenyUsers !root@*
#AFSTokenPassing no

# Kerberos TGT Passing only works with the AFS kaserver
#KerberosTgtPassing no

# Set this to 'yes' to enable PAM keyboard-interactive authentication
# Warning: enabling this may bypass the setting of 'PasswordAuthentication'
#PAMAuthenticationViaKbdInt no

#X11Forwarding no
#X11DisplayOffset 10
#X11UseLocalhost yes
#PrintMotd yes
#PrintLastLog yes
#KeepAlive yes
#UseLogin no
#UsePrivilegeSeparation yes
#PermitUserEnvironment no
#Compression yes

MaxStartups 4
# no default banner path
#Banner /some/path
#VerifyReverseMapping no

# override default of no subsystems
Subsystem sftp /usr/libexec/openssh/sftp-server

unSpawn · 06-02-2006, 11:33 AM

i haven't read in forum alot questions about connection with ssh and sshd security
...with emphasis on "haven't read". There have been quite a few threads on ssh(d) usage actually.

with the purpose to give everybody more effective control with sshd server. with this file config of sshd ,my firewall work verywell : 1.it allows ssh connection from identified ip number that i want
What happens if, by magic, the devices functionality is altered in such a way it passes through traffic unfiltered?

2.after 3 attempts unsuccessful of ssh, the sshd server automatically closed the connection
I'm sorry, I must be blind as a bat, but I see no "evidence" of that in your sshd_config?

in this thread i want to emphasis about 3 important keys in /etc/sshd/sshd_config
Could you elaborate on the security value of your change to the protocol directive and maybe allow.* vs denyusers? Besides that you haven't explicitly set "PermitRootLogin" to "no". As far as I'm concerned you should only allow a rootlogin after careful consideration of the consequences and only if you have really exhausted all other possibilities.

Capt_Caveman · 06-02-2006, 04:42 PM

Also, am I imagining things or are these lines in red commented and therefore doing nothing:

#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#AllowUsers root@193.178.34.37 , root@192.168.0.*
#DenyUsers !root@*
#AFSTokenPassing no

huanvnn · 06-03-2006, 12:10 PM

sorry :d everbody here i've posted unexactly my configuration file.there will need some repairs.it is need to remove the comment before the key AllowUsers and DenyUsers

with my configuration file ,sshd accept only with user root and user root from ip 193.178.34.37 (ip of my another host in other house) and from its LAN 192.168.0.0/24.

i've tested it with many times and successful
thanks for any mark

/etc/sshd/sshd_config

# $OpenBSD: sshd_config,v 1.59 2002/09/25 11:17:16 markus Exp $

# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options change a
# default value.

#Port 22
Protocol 2
#ListenAddress 192.168.0.1
#ListenAddress 0.0.0.0
#ListenAddress ::

# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key

# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 3600
#ServerKeyBits 768

# Logging
#obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
SyslogFacility AUTHPRIV
#LogLevel INFO

# Authentication:

LoginGraceTime 15
#PermitRootLogin yes
#StrictModes yes

#RSAAuthentication yes
#PubkeyAuthentication yes
#AuthorizedKeysFile .ssh/authorized_keys

# rhosts authentication should not be used
#RhostsAuthentication no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no

# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes
# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
AllowUsers root@193.178.34.37 , root@192.168.0.*
DenyUsers !root@*
#AFSTokenPassing no

# Kerberos TGT Passing only works with the AFS kaserver
#KerberosTgtPassing no

# Set this to 'yes' to enable PAM keyboard-interactive authentication
# Warning: enabling this may bypass the setting of 'PasswordAuthentication'
#PAMAuthenticationViaKbdInt no

#X11Forwarding no
#X11DisplayOffset 10
#X11UseLocalhost yes
#PrintMotd yes
#PrintLastLog yes
#KeepAlive yes
#UseLogin no
#UsePrivilegeSeparation yes
#PermitUserEnvironment no
#Compression yes

MaxStartups 4
# no default banner path
#Banner /some/path
#VerifyReverseMapping no

# override default of no subsystems
Subsystem sftp /usr/libexec/openssh/sftp-server

huanvnn · 06-03-2006, 12:11 PM

sorry :d everbody here i've posted unexactly my configuration file.there will need some repairs.it is need to remove the comment before the key AllowUsers and DenyUsers

with my configuration file ,sshd accept only with user root and user root from ip 193.178.34.37 (ip of my another host in other house) and from its LAN 192.168.0.0/24.

i've tested it with many times and successful
thanks for any mark

/etc/sshd/sshd_config

# $OpenBSD: sshd_config,v 1.59 2002/09/25 11:17:16 markus Exp $

# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options change a
# default value.

#Port 22
Protocol 2
#ListenAddress 192.168.0.1
#ListenAddress 0.0.0.0
#ListenAddress ::

# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key

# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 3600
#ServerKeyBits 768

# Logging
#obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
SyslogFacility AUTHPRIV
#LogLevel INFO

# Authentication:

LoginGraceTime 15
#PermitRootLogin yes
#StrictModes yes

#RSAAuthentication yes
#PubkeyAuthentication yes
#AuthorizedKeysFile .ssh/authorized_keys

# rhosts authentication should not be used
#RhostsAuthentication no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no

# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes
# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
AllowUsers root@193.178.34.37 , root@192.168.0.*
DenyUsers !root@*
#AFSTokenPassing no

# Kerberos TGT Passing only works with the AFS kaserver
#KerberosTgtPassing no

# Set this to 'yes' to enable PAM keyboard-interactive authentication
# Warning: enabling this may bypass the setting of 'PasswordAuthentication'
#PAMAuthenticationViaKbdInt no

#X11Forwarding no
#X11DisplayOffset 10
#X11UseLocalhost yes
#PrintMotd yes
#PrintLastLog yes
#KeepAlive yes
#UseLogin no
#UsePrivilegeSeparation yes
#PermitUserEnvironment no
#Compression yes

MaxStartups 4
# no default banner path
#Banner /some/path
#VerifyReverseMapping no

# override default of no subsystems
Subsystem sftp /usr/libexec/openssh/sftp-server

unSpawn · 06-04-2006, 05:36 AM

...since you did not react to my questions and remarks this apparently is not a discussion. Well then. As moderator I would like to ask everyone to please disregard the sshd_config as offered because:
- not all necessary changes are made,
- some changes made are defaults, or unnecessary or may not prove to be beneficial.

@huanvnn: this may should a bit harsh but I would like you to cease posting security-related "advice" or information that is either incomplete, detrimental or false. We cannot afford more distracting white noise. Please lurk a while before you jump in and read before you post. Thanks in advance.