AI 优化 ssh 服务端配置文件 sshd_config

前些天大东在家时，ssh 连接服务端或者编程语言包管理器从 github 下载文件有时速度较慢

是不是 ssh 的配置有什么需要改进的地方？

海云青飞没有时间研究详细 ssh 的配置文件，那怎么办？问 AI 就行

下面先给出 ssh 配置优化结果和操作步骤

人工智能优化后的 ssh 服务端配置文件 `sshd_config`

# Use a non-standard port to obfuscate SSH service (already configured)
Port 332

# Restrict which users can log in via SSH
AllowUsers tuenhai.com

# Modern key exchange algorithms for better security
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key

# Logging
SyslogFacility AUTH
LogLevel VERBOSE  # Increased to VERBOSE to provide more detailed security logs

# Authentication settings
LoginGraceTime 30s  # Reduce the login grace time for faster response to failed attempts
PermitRootLogin no  # Disable root login for security
StrictModes yes  # Keep strict modes for file/directory permissions

# Keep public key authentication as it's secure and fast
PubkeyAuthentication yes

# Disable host-based authentication and other unsafe methods
IgnoreRhosts yes
HostbasedAuthentication no

# Password settings
PermitEmptyPasswords no  # Do not allow empty passwords
PasswordAuthentication no  # Use only SSH keys for authentication
ChallengeResponseAuthentication no  # Disable challenge-response authentication (e.g., via PAM)

# Disable X11 forwarding unless needed for specific use cases
X11Forwarding no  # Disabling X11 forwarding improves security by limiting attack surface
X11DisplayOffset 10

# Banner settings
PrintMotd no  # Avoid showing MOTD to reduce information exposure
PrintLastLog yes  # Keep showing the last login for user awareness

# KeepAlive settings
TCPKeepAlive no  # Keep disabled to reduce the risk of man-in-the-middle attacks on idle connections
ClientAliveInterval 300  # Adjusted to 5 minutes to ensure active sessions are appropriately checked
ClientAliveCountMax 2  # If there are no responses to keepalives, the session will be terminated after ~10 minutes

# Environment settings (allow only language-related environment variables)
AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

# Use PAM for additional authentication mechanisms if needed
UsePAM yes

# Additional security improvements: Restrict cipher suites, MACs, and key exchange algorithms
Ciphers aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr  # Modern and secure ciphers
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org  # Secure key exchange algorithms
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com  # Secure message authentication codes

ssh 登录 Ubuntu 服务器并执行相关命令

ssh server
# backup sshd_config
sudo cp /etc/ssh/sshd_config sshd_config-20240908
sudo vi /etc/ssh/sshd_config
# 删除原配置
ggdG
# 进入插入模式
i
# 右键粘贴新配置
# 按 ESC 键退出插入模式
# 按 ZZ 保存并退出
ZZ

# 测试新配置是否有问题
sudo sshd -t
# ssh 重载配置文件
sudo systemctl reload ssh
# 注意！先不要退出此 ssh 连接

然后在本机再次 ssh 连接服务端，能连上就好，不然就要通过还未断开的 ssh 连接检查配置文件，找出原因。这步非常重要，否则，如果服务端设置错误导致客户端连接不上服务端的话，就可能很麻烦

海云青飞向 AI 请教 ssh 服务端配置文件 `sshd_config` 的优化

2024-09-08 下午，海云青飞问 poe.com 的 AI ChatGPT-4o-Latest:

Optimize ssh server side configuration for speed and security, remove unnecessary or outdated settings

ssh version: OpenSSH_8.9p1 Ubuntu-3ubuntu0.10, OpenSSL 3.0.2 15 Mar 2022

current sshd_config:

Port _
Protocol 2
……

`ChatGPT-4o-Latest` 对 ssh 服务端配置文件 sshd_config 的优化建议

To optimize your SSH server configuration for both speed and security, we can make several adjustments. Some settings are deprecated or redundant, while others can be improved to modern standards. Below are the suggested changes and explanations for why they're included

Optimized `sshd_config`:

# Use a non-standard port to obfuscate SSH service (already configured)
Port _

# Use only Protocol 2 (Protocol 1 is insecure and outdated, but also not needed here)
# Protocol 2 (removed, as it's the default since OpenSSH 7.2)

# Modern key exchange algorithms for better security
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key

# Removed UsePrivilegeSeparation (deprecated since OpenSSH 7.5, now always enabled)

# KeyRegenerationInterval and ServerKeyBits are obsolete in recent OpenSSH versions
# KeyRegenerationInterval 3600 (removed)
# ServerKeyBits 2048 (removed)

# Logging
SyslogFacility AUTH
LogLevel VERBOSE  # Increased to VERBOSE to provide more detailed security logs

# Authentication settings
LoginGraceTime 30s  # Reduce the login grace time for faster response to failed attempts
PermitRootLogin no  # Disable root login for security
StrictModes yes  # Keep strict modes for file/directory permissions

# Disable deprecated and insecure authentication methods
RSAAuthentication no  # Deprecated, use PubkeyAuthentication instead
PubkeyAuthentication yes  # Keep public key authentication as it's secure and fast

# Disable host-based authentication and other unsafe methods
IgnoreRhosts yes
RhostsRSAAuthentication no
HostbasedAuthentication no

# Password settings
PermitEmptyPasswords no  # Do not allow empty passwords
PasswordAuthentication no  # Use only SSH keys for authentication
ChallengeResponseAuthentication no  # Disable challenge-response authentication (e.g., via PAM)

# Disable X11 forwarding unless needed for specific use cases
X11Forwarding no  # Disabling X11 forwarding improves security by limiting attack surface
X11DisplayOffset 10

# Banner settings
PrintMotd no  # Avoid showing MOTD to reduce information exposure
PrintLastLog yes  # Keep showing the last login for user awareness

# KeepAlive settings
TCPKeepAlive no  # Keep disabled to reduce the risk of man-in-the-middle attacks on idle connections
ClientAliveInterval 300  # Adjusted to 5 minutes to ensure active sessions are appropriately checked
ClientAliveCountMax 2  # If there are no responses to keepalives, the session will be terminated after ~10 minutes

# Environment settings (allow only language-related environment variables)
AcceptEnv LANG LC_*

# SFTP Subsystem
Subsystem sftp /usr/lib/openssh/sftp-server

# Use PAM for additional authentication mechanisms if needed
UsePAM yes

# Restrict which users can log in via SSH
AllowUsers tuenhai.com

# Additional security improvements: Restrict cipher suites, MACs, and key exchange algorithms
Ciphers aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr  # Modern and secure ciphers
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org  # Secure key exchange algorithms
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com  # Secure message authentication codes

Key Changes and Explanation:

Removed Deprecated Options:
- UsePrivilegeSeparation: Deprecated since OpenSSH 7.5 (always enabled by default now)
- KeyRegenerationInterval and ServerKeyBits: These settings are no longer relevant with modern OpenSSH versions
- RSAAuthentication: Deprecated, as PubkeyAuthentication now covers it, and only public key authentication is preferred
Authentication and Root Access:
- PermitRootLogin no: Keep root login disabled for security
- PasswordAuthentication no: Keep password authentication disabled to ensure only SSH key-based logins are allowed, which is more secure
Timeout Settings:
- LoginGraceTime reduced to 30s: This limits the time allowed for successful authentication attempts, reducing exposure to brute-force attacks
- ClientAliveInterval set to 300 seconds (5 minutes) with ClientAliveCountMax set to 2: This ensures the server will check if the client is still alive and terminates idle sessions after ~10 minutes
X11 Forwarding:
- X11Forwarding no: Disabled unless absolutely necessary, as it can introduce security risks
Ciphers, KexAlgorithms, and MACs:
- Modern, secure algorithms are enforced for encryption, key exchange, and message authentication. This ensures the server uses only strong cryptographic standards
Logging:
- LogLevel VERBOSE: Increased logging level to capture more detailed information, which is useful for security auditing
TCPKeepAlive:
- TCPKeepAlive no: Disabling this reduces the chance of man-in-the-middle attacks on idle connections
AllowUsers:
- Restrict SSH access only to the specified user (AllowUsers tuenhai.com), which limits the attack surface

Final Thoughts:

This configuration balances speed and security by enforcing strong cryptographic standards, disabling unnecessary features, and tuning settings to reduce potential attack vectors. Additionally, it helps maintain good logging practices to monitor SSH activity effectively

ssh 服务端应用新的配置文件

To apply the changes made to the sshd_config file, you need to restart or reload the SSH service. This can be done using the following commands:

1. Test the Configuration (Recommended)

Before restarting the SSH service, it's always a good practice to test the configuration for syntax errors:

sudo sshd -t

If there are no errors, you will get no output, which means the configuration is valid. If there are issues, the command will output the relevant error messages

2. Restart the SSH Service

Once you verify the configuration is correct, you can restart the SSH service to apply the changes:

sudo systemctl restart ssh

or, depending on your system, it might be:

sudo service ssh restart

3. Reload the SSH Service

If you don't want to disrupt existing SSH sessions, you can reload the configuration without fully restarting the service:

sudo systemctl reload ssh

or:

sudo service ssh reload

Notes:

Restarting the SSH service will terminate any existing SSH sessions. If you are connected over SSH while restarting, be aware that you may lose your connection and need to reconnect
Reloading is a safer option if you have active SSH sessions, as it will apply the new configuration without disconnecting existing users

Verifying the SSH Service

After restarting or reloading, you can check the status of the SSH service to ensure everything is running smoothly:

sudo systemctl status ssh

This will show you whether the SSH service is active and if there were any errors after applying the new configuration

2024-09-08

独立思考最难得，赞赏支持是美德！（微信扫描下图）

海云青飞 官方网站

海云青飞官方网站