Secure SSH Config

ssh_config

# Recommendations from https://stribika.github.io/2015/01/04/secure-secure-shell.html

# Github needs diffie-hellman-group-exchange-sha1 some of the time but not always.
#Host github.com
#    KexAlgorithms [email protected],diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1

Host *
    KexAlgorithms [email protected],diffie-hellman-group-exchange-sha256

Host *
    PasswordAuthentication no
    ChallengeResponseAuthentication no

Host *
    PubkeyAuthentication yes
    HostKeyAlgorithms [email protected],[email protected],ssh-ed25519,ssh-rsa

Host *
    Ciphers [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr

Host *
    MACs [email protected],[email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,[email protected]

Host *
   UseRoaming no

sshd_config

# Recommendations from https://stribika.github.io/2015/01/04/secure-secure-shell.html

KexAlgorithms [email protected],diffie-hellman-group-exchange-sha256

Protocol 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ed25519_key

PasswordAuthentication no
ChallengeResponseAuthentication no

PubkeyAuthentication yes

# Unpractical for the forge user in case of reprovision?
# AllowGroups ssh-user

Ciphers [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr

MACs [email protected],[email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,[email protected]