Re: Stronger ssh settings

--cgt4okyi2njf62im
Content-Type: text/plain; protected-headers=v1; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Subject: Re: Stronger ssh settings
MIME-Version: 1.0

HardenedBSD applies the following diff to sshd_config:

=3D=3D=3D=3D BEGIN PATCH =3D=3D=3D=3D
diff --git a/crypto/openssh/sshd_config b/crypto/openssh/sshd_config
index 708be7fe2870..8f73a25e281b 100644
--- a/crypto/openssh/sshd_config
+++ b/crypto/openssh/sshd_config
@@ -27,15 +27,15 @@
=20
 # Logging
 #SyslogFacility AUTH
-#LogLevel INFO
+LogLevel VERBOSE
=20
 # Authentication:
=20
 #LoginGraceTime 2m
 #PermitRootLogin no
 #StrictModes yes
-#MaxAuthTries 6
-#MaxSessions 10
+MaxAuthTries 3
+MaxSessions 5
=20
 #PubkeyAuthentication yes
=20
@@ -88,21 +88,21 @@ AuthorizedKeysFile	.ssh/authorized_keys
 # and KbdInteractiveAuthentication to 'no'.
 #UsePAM yes
=20
-#AllowAgentForwarding yes
-#AllowTcpForwarding yes
+AllowAgentForwarding no
+AllowTcpForwarding no
 #GatewayPorts no
-#X11Forwarding no
+X11Forwarding no
 #X11DisplayOffset 10
 #X11UseLocalhost yes
 #PermitTTY yes
 #PrintMotd yes
 #PrintLastLog yes
-#TCPKeepAlive yes
+TCPKeepAlive no
 #PermitUserEnvironment no
-#Compression delayed
+Compression no
 #ClientAliveInterval 0
-#ClientAliveCountMax 3
-#UseDNS yes
+ClientAliveCountMax 2
+UseDNS no
 #PidFile /var/run/sshd.pid
 #MaxStartups 10:30:100
 #PermitTunnel no
=3D=3D=3D=3D END PATCH =3D=3D=3D=3D

On Sat, Apr 04, 2026 at 08:08:34PM +0200, Alexander Leidinger wrote:
> Hi,
>=20
> I propose to extend our ssh config (and maybe other configs) regarding
>  - settings for government standards
>  - improved FreeBSD defaults
>=20
> Both of them are sort of about the same thing, and at the same time
> independent from each other, as such I haven'T split it up here. In the
> example below, I have a patch for improved FreeBSD defaults, and an examp=
le
> of the German BSI recommendation for ssh.
>=20
> I would like to get an idea if one or both is considered a welcome change
> (there was at least a discussion about improved settings in the lists long
> ago, which was in favour, but no patch), and if yes additional settings f=
or
> e.g. FIPS or whatever, and a discussion of what the improved FreeBSD
> defaults should be (I simply included what I use on my systems, and they
> should work for connections from and to all supported FreeBSD releases as=
 I
> have them like that since a long time; an alternative would be to use the
> exclude syntax instead).
>=20
> My example regarding the topic but not necessary those settings in
> particular:
> ---snip---
> diff --git crypto/openssh/ssh_config crypto/openssh/ssh_config
> index cc5663562e95..6ee056876e05 100644
> --- crypto/openssh/ssh_config
> +++ crypto/openssh/ssh_config
> @@ -17,6 +17,29 @@
>  # list of available options, their meanings and defaults, please see the
>  # ssh_config(5) man page.
>=20
> +### FreeBSD ###
> +HostKeyAlgorithms rsa-sha2-512,rsa-sha2-256,ssh-ed25519
> +Ciphers [email protected],[email protected],aes128-gcm@=
openssh.com,aes256-ctr,aes128-ctr
> +MACs [email protected],[email protected],hmac-sha2-51=
[email protected]
> +KexAlgorithms [email protected],curve25519-sha256,curve=
[email protected],diffie-hellman-group-exchange-sha256,diffie-hellman=
-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
> +RekeyLimit 1G 1h
> +### end FreeBSD ###
> +
> +### BSI TR-02102-4 as of 2026-01-26 ###
> +# KexAlgorithms: non-mlkem use up to 2031
> +#KexAlgorithms diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,e=
cdh-sha2-nistp384,ecdh-sha2-nistp521,mlkem768x25519-sha256
> +#RekeyLimit 1G 1h
> +
> +# Ciphers: use up to 2032+
> +#Ciphers [email protected],[email protected],aes256-ctr,aes192=
-ctr,aes128-ctr
> +
> +# MACs: use up to 2032+
> +#MACs [email protected],[email protected]
> +
> +# PubkeyAcceptedAlgorithms: use upto 2032+
> +#PubkeyAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v=
[email protected],ecdsa-sha2-nistp384,[email protected]=
,ecdsa-sha2-nistp521,[email protected],ecdsa-sha2-ni=
stp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
> +### end BSI TR-02102-4 ###
> +
>  # Host *
>  #   ForwardAgent no
>  #   ForwardX11 no
> diff --git crypto/openssh/sshd_config crypto/openssh/sshd_config
> index 708be7fe2870..7e391e7271be 100644
> --- crypto/openssh/sshd_config
> +++ crypto/openssh/sshd_config
> @@ -110,6 +110,29 @@ AuthorizedKeysFile .ssh/authorized_keys
>  #UseBlocklist no
>  #VersionAddendum FreeBSD-20250801
>=20
> +### FreeBSD ###
> +HostKeyAlgorithms rsa-sha2-512,rsa-sha2-256,ssh-ed25519
> +Ciphers [email protected],[email protected],aes128-gcm@=
openssh.com,aes256-ctr,aes128-ctr
> +MACs [email protected],[email protected],hmac-sha2-51=
[email protected]
> +KexAlgorithms [email protected],curve25519-sha256,curve=
[email protected],diffie-hellman-group-exchange-sha256,diffie-hellman=
-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
> +RekeyLimit 1G 1h
> +### end FreeBSD ###
> +
> +### BSI TR-02102-4 as of 2026-01-26 ###
> +# KexAlgorithms: non-mlkem use up to 2031
> +#KexAlgorithms diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,e=
cdh-sha2-nistp384,ecdh-sha2-nistp521,mlkem768x25519-sha256
> +#RekeyLimit 1G 1h
> +
> +# Ciphers: use up to 2032+
> +#Ciphers [email protected],[email protected],aes256-ctr,aes192=
-ctr,aes128-ctr
> +
> +# MACs: use up to 2032+
> +#MACs [email protected],[email protected]
> +
> +# PubkeyAcceptedAlgorithms: use up to 2032+
> +#PubkeyAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v=
[email protected],ecdsa-sha2-nistp384,[email protected]=
,ecdsa-sha2-nistp521,[email protected],ecdsa-sha2-ni=
stp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
> +### end BSI TR-02102-4 ###
> +
>  # no default banner path
>  #Banner none
>=20
> ---snip---
>=20
> Bye,
> Alexander.
>=20
> --=20
> http://www.Leidinger.net [email protected]: PGP 0x8F31830F9F2772BF
> http://www.FreeBSD.org    [email protected]  : PGP 0x8F31830F9F2772BF



--=20
Shawn Webb
Cofounder / Security Engineer
HardenedBSD

Signal Username:  shawn_webb.74
Tor-ified Signal: +1 303-901-1600 / shawn_webb_opsec.50
https://git.hardenedbsd.org/hardenedbsd/pubkeys/-/raw/master/Shawn_Webb/03A=
4CBEBB82EA5A67D9F3853FF2E67A277F8E1FA.pub.asc

--cgt4okyi2njf62im
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEA6TL67gupaZ9nzhT/y5nonf44foFAmnSiGIACgkQ/y5nonf4
4fo48g/9E3scXtH20bbC4DEX3ZBMA3TMpZg7o65/vet0vCHDI0yJI4NkFhAVFUWp
EnXtJnWhttAOBx9fKTtWGkDS+OyU1Q5XAPmn0uLYHP/f7HfXp4bNh6KMcI51NiTK
dZ1WBPZwrEyejidlcqCCWP6tUNmcI0yPKnyLscEDBV29nS+BF8BEkMIrOXhWsg9S
3UwWb+PeMpvbJ9hs9eWzkkUDFk+UADhhR1ab7bcfpMA/4DUw34BEqjnvbEV+V4DN
njzPNGLuO2CEeZ6C1odRwHxlAwJ60sHUXeQfwXZ0G1oxpdpgqAUgabl7xxNozCZP
GCr058l00M5kSapCM/Zu9tbOwEtydHUyMr8m8JBtQWquBYAflgX5CKIPGlu5sX5V
jDJo9z1tfErhGpN2o2h4JYtT4DkqrY8pOY9tSSoO9tnmwG8kCQwHYkE/l6pTzc5t
emq07tCtj2aOwcNZCTcJYaazQwYaeU+SQpN7b4SBHgHop9RmWISRCBUKgtjzBgFW
RLonja57Spqryk5W6gwrW54eECEuwnX7gTWntV5CrngQ3ceAPqCulUfty5UZyl2K
3ebCtq/PkM8uET2YzgSt+3D8UifZZ/rHPz8vgzeOAX7r92atQ+sCZyjEV190CixL
eRDjoB4PoYnYxxoDAiHKDFif0yUSEt3a6WJj2GkuoxISSKy0i3w=
=Omrd
-----END PGP SIGNATURE-----

--cgt4okyi2njf62im--