Securing an OpenSSH Server

Audit Tools

• https://www.ssh-audit.com

Update /etc/ssh/sshd.config

• HostKey /etc/ssh/ssh_host_ed25519_key
  KexAlgorithms  curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
  MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com
  AllowUsers eke

Update /etc/conf.d/sshd

• sshd_disable_keygen=yes

Enable the changes

• $ sudo rm /etc/ssh/ssh_host_(rsa|dsa_ecdsa)_key*     
  $ sudo rc-service sshd restart