ssh

The following is the GNU All-permissive License as recommended in https://www.gnu.org/licenses/license-recommendations.en.html

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved. This file is offered as-is, without any warranty.

Contributions are welcome. See https://savannah.gnu.org/maintenance/fsf/.

key fingerprints

To print the md5 fingerprint of a public key:

ssh-keygen -E md5 -l -f /tmp/t.pub
2048 MD5:a2:09:53:76:73:9d:bf:ef:fd:e9:91:05:f1:46:27:25 foo@bar (RSA)

ssh jump

This is similar to and simpler than manually setting up SSH tunneling.

To ssh into tarantula via valis (the office router):

ssh -J valis.fsf.org 192.168.0.25

To ssh into tarantula via valis then via reresolver.office.fsf.org:

ssh -J valis.fsf.org,192.168.0.10 192.168.0.25

ssh tunneling

To ssh into a machine via an ssh tunnel:

ssh -L 2201:endpoint.fsf.org:22 root@via.fsf.org

ssh localhost -p 2201

or:

# place this in ~/.ssh/config
Host endpoint.fsf.org
  ProxyCommand ssh via.fsf.org -W %h:%p

ssh tunneling is more secure than agent forwarding, because keys are not copied to the intermediary host.

sshd_config

The ssh config is located at /etc/ssh/sshd_config

AllowUsers

AllowUsers would be helpful during a fencepost upgrade.

Edit /etc/ssh/sshd_config.

vim /etc/ssh/sshd_config

Add a line:

AllowUsers root andrew iank johns michael ruben

Test the config:

sshd -t

Reload the config:

systemctl reload sshd

After that only those users would be allowed to login. I am not sure if anyone would be kicked off, but I am less concerned about that.

Once the upgrade completes, we would comment out the AllowUsers line, test, and reload again.

Hardening SSH

Audit with ssh-audit.py

git clone https://github.com/jtesta/ssh-audit
cd ssh-audit
python3 ssh-audit.py fencepost.gnu.org

You can add a list of servers to a file and run ssh-audit on the list.

python3 ssh-audit.py -T servers.txt

Tor onion service

From Ludovic

"Protip: when installing a server, install #Tor on it and have its SSH port accessible as an onion service. That way, if you mess up with network config, you might still be able to access the onion service.

(Really! It’s saved me a few times already.)"

Connecting to older SSH servers

To connect to nessus, you can use the following:

ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 nessus.office.fsf.org

Or add the following to your ~/.ssh/config file

Host nessus.office.fsf.org amt.fsf.org
    KexAlgorithms +diffie-hellman-group1-sha1