Skip to content

Latest commit

 

History

History
52 lines (44 loc) · 3.37 KB

client.md

File metadata and controls

52 lines (44 loc) · 3.37 KB

FreeBSD OpenSSH Hardening — Client

Run the following in a terminal to harden the OpenSSH client for the local user

mkdir -p -m 0700 ~/.ssh; printf "\nHost *\n  Ciphers [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr\n  KexAlgorithms [email protected],curve25519-sha256,[email protected],diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256\n  MACs [email protected],[email protected],[email protected]\n  HostKeyAlgorithms ssh-ed25519,[email protected],[email protected],[email protected],rsa-sha2-256,[email protected],rsa-sha2-512,[email protected]\n" >> ~/.ssh/config
Results report 
# general
(gen) client IP: 127.0.0.1
(gen) banner: SSH-2.0-OpenSSH_9.5
(gen) software: OpenSSH 9.5
(gen) compression: enabled ([email protected], zlib)

# key exchange algorithms
(kex) [email protected]    -- [info] available since OpenSSH 8.5
(kex) curve25519-sha256                     -- [info] available since OpenSSH 7.4, Dropbear SSH 2018.76
                                            `- [info] default key exchange since OpenSSH 6.4
(kex) [email protected]          -- [info] available since OpenSSH 6.4, Dropbear SSH 2013.62
                                            `- [info] default key exchange since OpenSSH 6.4
(kex) diffie-hellman-group16-sha512         -- [info] available since OpenSSH 7.3, Dropbear SSH 2016.73
(kex) diffie-hellman-group18-sha512         -- [info] available since OpenSSH 7.3
(kex) diffie-hellman-group-exchange-sha256  -- [info] available since OpenSSH 4.4
(kex) ext-info-c

# host-key algorithms
(key) ssh-ed25519                           -- [info] available since OpenSSH 6.5
(key) [email protected]      -- [info] available since OpenSSH 6.5
(key) [email protected]            -- [info] available since OpenSSH 8.2
(key) [email protected]   -- [info] available since OpenSSH 8.2
(key) rsa-sha2-256                          -- [info] available since OpenSSH 7.2
(key) [email protected]     -- [info] available since OpenSSH 7.8
(key) rsa-sha2-512                          -- [info] available since OpenSSH 7.2
(key) [email protected]     -- [info] available since OpenSSH 7.8

# encryption algorithms (ciphers)
(enc) [email protected]         -- [info] available since OpenSSH 6.5
                                            `- [info] default cipher since OpenSSH 6.9
(enc) [email protected]                -- [info] available since OpenSSH 6.2
(enc) [email protected]                -- [info] available since OpenSSH 6.2
(enc) aes256-ctr                            -- [info] available since OpenSSH 3.7, Dropbear SSH 0.52
(enc) aes192-ctr                            -- [info] available since OpenSSH 3.7
(enc) aes128-ctr                            -- [info] available since OpenSSH 3.7, Dropbear SSH 0.52

# message authentication code algorithms
(mac) [email protected]         -- [info] available since OpenSSH 6.2
(mac) [email protected]         -- [info] available since OpenSSH 6.2
(mac) [email protected]              -- [info] available since OpenSSH 6.2