SSH Hardening 체크리스트

풀 hardened sshd_config

이 트랙과 Track 2–3 의 모든 거 합쳐 — production 모양 /etc/ssh/sshd_config. 대부분 directive 가 OpenSSH 10.x 에 sensibly 디폴트; 이 목록이 디폴트 위 명시 hardening pass. 대부분 서버가 부분집합 필요; 안 맞는 거 표시하고 건너뛰기.

Code

/etc/ssh/sshd_config — hardened·bash

# Protocol & auth
PermitRootLogin no              # never direct root
PasswordAuthentication no       # keys only
KbdInteractiveAuthentication no # no fallback
PubkeyAuthentication yes
MaxAuthTries 3                  # cap attempts per connection
MaxSessions 5                   # cap sessions per connection
LoginGraceTime 30               # 30s to authenticate

# Restrict who can SSH in (whitelist)
AllowUsers you_username               # add other accounts as needed
# Or by group:
# AllowGroups ssh-users

# Disable unused features
X11Forwarding no                # X11 = unnecessary attack surface
AllowTcpForwarding yes          # keep — Track 3 LocalForward needs it
GatewayPorts no                 # don't allow remote-bound RemoteForward
PermitEmptyPasswords no         # belt and braces
PermitUserEnvironment no
UsePAM yes                      # leave PAM on (TOTP relies on it)

# Logging
LogLevel VERBOSE                # detailed auth log

# Client keepalive (server side mirrors ~/.ssh/config)
ClientAliveInterval 300
ClientAliveCountMax 2

# Cipher / KEX restriction (modern only)
# OpenSSH 10.x defaults are already strong; explicit is fine for paranoia
KexAlgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com

# Trust the CA (if using SSH certificates)
# TrustedUserCAKeys /etc/ssh/ca_key.pub

재시작 전 validate·bash

# CRITICAL — always before restarting sshd
sudo sshd -t

# Restart
sudo systemctl restart sshd

# macOS — toggle Remote Login off/on

# Verify what the running daemon actually parsed
sudo sshd -T | grep -E '(passauth|permitroot|allowusers|maxauth)'

Exercise

한 서버에서 기존 sshd_config 복사, 위 hardened 버전 적용, sudo sshd -t 로 validate. 기존 SSH 세션 lifeline 으로 열어둬. Fresh 터미널에서 — 키 로그인 여전히 동작 확인, 비허용 user SSH 못 함 확인 (틀린 username 시도), ssh -o PreferredAuthentications=password 거부 확인. 세 체크; 다 통과면 hardening 진짜.

SSH Hardening 체크리스트

풀 hardened sshd_config

Code

External links

Exercise

Progress

댓글 0