Skip to content

Instantly share code, notes, and snippets.

@miticojo

miticojo/ssh_config

Forked from bonsi/ssh_config
Created August 16, 2017 23:16
Show Gist options
  • Save miticojo/4f75a608a5e3f63d51bb6d46178fa4b6 to your computer and use it in GitHub Desktop.
Save miticojo/4f75a608a5e3f63d51bb6d46178fa4b6 to your computer and use it in GitHub Desktop.
Download ZIP
Secure SSH Config
Raw
ssh_config
# Recommendations from https://stribika.github.io/2015/01/04/secure-secure-shell.html
# Github needs diffie-hellman-group-exchange-sha1 some of the time but not always.
#Host github.com
# KexAlgorithms [email protected],diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1
Host *
KexAlgorithms [email protected],diffie-hellman-group-exchange-sha256
Host *
PasswordAuthentication no
ChallengeResponseAuthentication no
Host *
PubkeyAuthentication yes
HostKeyAlgorithms [email protected],[email protected],ssh-ed25519,ssh-rsa
Host *
Ciphers [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr
Host *
MACs [email protected],[email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,[email protected]
Host *
UseRoaming no
Raw
sshd_config
# Recommendations from https://stribika.github.io/2015/01/04/secure-secure-shell.html
KexAlgorithms [email protected],diffie-hellman-group-exchange-sha256
Protocol 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
PasswordAuthentication no
ChallengeResponseAuthentication no
PubkeyAuthentication yes
# Unpractical for the forge user in case of reprovision?
# AllowGroups ssh-user
Ciphers [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr
MACs [email protected],[email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,[email protected]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment