Revision 849d4069
Added by David Sorber almost 8 years ago
| software/misc/make_ssh_secure.sh | ||
|---|---|---|
|
DAEMON_CONFIG=/etc/ssh/sshd_config
|
||
|
echo -e "\nKexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256\n" >> $DAEMON_CONFIG
|
||
|
echo -e "Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\n" >> $DAEMON_CONFIG
|
||
|
echo -e "MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com" >> $DAEMON_CONFIG
|
||
|
echo -e "MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com" >> $DAEMON_CONFIG
|
||
|
|
||
|
sed -i "s|HostKey /etc/ssh/ssh_host_dsa_key|#HostKey /etc/ssh/ssh_host_dsa_key|g" $DAEMON_CONFIG
|
||
|
sed -i "s|HostKey /etc/ssh/ssh_host_ecdsa_key|#HostKey /etc/ssh/ssh_host_ecdsa_key|g" $DAEMON_CONFIG
|
||
| ... | ... | |
|
CLIENT_CONFIG=/etc/ssh/ssh_config
|
||
|
echo -e " KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256" >> $CLIENT_CONFIG
|
||
|
sed -i "s|# Ciphers.*| Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr|g" $CLIENT_CONFIG
|
||
|
sed -i "s|# MACs.*| MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com|g" $CLIENT_CONFIG
|
||
|
sed -i "s|# MACs.*| MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com|g" $CLIENT_CONFIG
|
||
|
sed -i "s|# Protocol 2,1| Protocol 2|g" $CLIENT_CONFIG
|
||
|
|
||
|
# Remove insecure moduli
|
||
Remove no-longer-supported MACs: hmac-ripemd160