Hardening and support phone-home users

1 files changed, 30 insertions, 10 deletions

diff --git a/ssh-bastion/etc/sshd_config b/ssh-bastion/etc/sshd_config
index dd65731..3177765 100644
--- a/ssh-bastion/etc/sshd_config
+++ b/ssh-bastion/etc/sshd_config
@@ -1,7 +1,6 @@
 # vim:set ft=sshdconfig
 
 HostKey /srv/ssh/hostkeys/rsa_key
-HostKey /srv/ssh/hostkeys/ecdsa_key
 HostKey /srv/ssh/hostkeys/ed25519_key
 
 # By default SSH attempts to chdir to the logged-in user's home directory.  The
@@ -14,18 +13,11 @@ Protocol 2
 # Bind a port above 1024 so we can run ssh as an unpriviledged user
 Port 4321
 
-PermitTTY no
-#ForceCommand /bin/false
-
 SyslogFacility AUTH
 LogLevel INFO
 PrintLastLog yes
-
-PidFile /var/run/sshd.pid
-
 StrictModes yes
-
-AuthorizedKeysFile /srv/ssh/users/%u/ssh
+PidFile /var/run/sshd.pid
 
 PubkeyAuthentication yes
 HostbasedAuthentication no
@@ -33,6 +25,7 @@ IgnoreRhosts yes
 PasswordAuthentication no
 PermitEmptyPasswords no
 RhostsRSAAuthentication no
+AuthorizedKeysFile /srv/ssh/users/%u/ssh
 
 UsePAM yes
 UseLogin no
@@ -40,13 +33,24 @@ PermitRootLogin no
 ChallengeResponseAuthentication yes
 AuthenticationMethods publickey,keyboard-interactive:pam
 
+# Limit the number of authentication attemps per connection. SSH will log
+# failues once attempts reach half this number so this should also log all
+# authentication failures as well.
+PermitTTY no
+MaxAuthTries 2
+ForceCommand /usr/bin/nologin
+
+# Disable all interactive sessions. Users will still be allowed to jump through
+# the host but not be allowed to login or run any commands.
+MaxSessions 0
+
 # Use an unprivileged child process to accept connections and
 # authenticate the user before spinning up another process as
 # the user.
 UsePrivilegeSeparation yes
 
 # This turns off reverse lookups of the originating host which hang sshd
-# on DNS timeouts when DNS is down.  This also breaks "from=" lines in
+# on DNS timeouts when DNS is down. This also breaks "from=" lines in
 # authorizd_keys files which must be converted to dotted quad ip addrs.
 UseDNS no
 
@@ -76,3 +80,19 @@ MaxSessions 100
 
 X11Forwarding no
 PrintMotd no
+
+# Used hardened crypto algorithms
+# Based on: https://stribika.github.io/2015/01/04/secure-secure-shell.html
+KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
+Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
+MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com
+
+# Enable gateway ports for phone-home bastions so that administrators can
+# connect back to the forwarded ports without needing ssh access to the bastion
+# host itself. Also locks down what can be forwarded and to where.
+Match user phonehome
+    GatewayPorts yes
+    AuthenticationMethods publickey
+    AllowTcpForwarding remote
+    PermitOpen none
+Match all