# /etc/ssh/sshd_config
# Hardened baseline — OpenSSH 8.x+ (check `sshd -V`)
# --- Network ---
Port 22
AddressFamily inet
ListenAddress 0.0.0.0
#ListenAddress ::
# --- Host keys (drop weak types entirely) ---
HostKey /etc/ssh/ssh_host_ed25519_key
HostKey /etc/ssh/ssh_host_rsa_key
# Do NOT keep ssh_host_dsa_key or ecdsa around — remove the files.
# --- Protocol / crypto hardening ---
Protocol 2
KexAlgorithms [email protected],curve25519-sha256,[email protected],diffie-hellman-group16-sha512
Ciphers [email protected],[email protected],[email protected]
MACs [email protected],[email protected]
HostKeyAlgorithms ssh-ed25519,rsa-sha2-512,rsa-sha2-256
PubkeyAcceptedAlgorithms ssh-ed25519,rsa-sha2-512,rsa-sha2-256
# --- Authentication ---
LoginGraceTime 20
PermitRootLogin no
StrictModes yes
MaxAuthTries 3
MaxSessions 5
MaxStartups 10:30:60
PubkeyAuthentication yes
AuthenticationMethods publickey
PasswordAuthentication no
PermitEmptyPasswords no
KbdInteractiveAuthentication no
ChallengeResponseAuthentication no
GSSAPIAuthentication no
HostbasedAuthentication no
IgnoreRhosts yes
UsePAM yes
# --- Access control ---
AllowGroups ssh-users
# AllowUsers [email protected]/24 # alternative/additional scoping
# --- Session / forwarding hardening ---
X11Forwarding no
AllowAgentForwarding no
AllowTcpForwarding local
PermitTunnel no
GatewayPorts no
PermitUserEnvironment no
Compression no
TCPKeepAlive yes
ClientAliveInterval 300
ClientAliveCountMax 2
# --- Banner / logging ---
LogLevel VERBOSE
SyslogFacility AUTH
PrintMotd no
PrintLastLog yes
Banner /etc/ssh/banner.txt
# --- SFTP (only if needed) ---
Subsystem sftp internal-sftp -l INFO
# --- Misc ---
UseDNS no
DebianBanner no