jumpbox/sshd/sshd_config at main · WillFantom/jumpbox · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
# Listen on all addresses
AddressFamily any
ListenAddress 0.0.0.0
ListenAddress ::

# Use volume mapped hostkeys directory
HostKeyAlgorithms ssh-ed25519,rsa-sha2-512,rsa-sha2-256
HostKey /etc/ssh/hostkeys.d/ssh_host_ed25519_key
HostKey /etc/ssh/hostkeys.d/ssh_host_rsa-sha2-256_key
HostKey /etc/ssh/hostkeys.d/ssh_host_rsa-sha2-512_key

# Use safer types
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512,hmac-sha2-256

# Use authorized key manger (akm) to manage key-based auth
AuthorizedKeysCommand /etc/ssh/auth.sh
AuthorizedKeysCommandUser nobody
AuthorizedKeysFile none

# Lockdown the jumpbox a little
ForceCommand /sbin/nologin
GatewayPorts no
PermitTTY no
PermitTunnel no
X11Forwarding no
PasswordAuthentication no
PermitEmptyPasswords no
LoginGraceTime 30

# Other qualty-of-life options
ClientAliveCountMax 20
ClientAliveInterval 30
PrintMotd no
Banner /etc/ssh/banner

# Use Syslog
SyslogFacility  AUTH