SSH

Connect to a Remote Machine#

# On port 22
ssh root@1.2.3.4

# On port 5678
ssh -p 5678 root@1.2.3.4bash

Login Without Password#

Generate a Key#

# -o : Save the key in the new openssh format
# -a : Number of key derivation function rounds
# -t : Specify the type of key being created
# -f : Output directory for the key
# -C : Add a comment to the key

ssh-keygen -o -a 100 -t ed25519 -f ~/.ssh/id_ed25519 -C "email@example.com"bash

Send the Key to the Remote Machine#

ssh-copy-id -i .ssh/id_ed25519.pub root@1.2.3.4bash

Send a File from the Client to the Server#

scp file.sh root@1.2.3.4:/home/eve

# On port 5678
scp -P 5678 file.sh root@1.2.3.4:/home/eve

# Send a folder
scp -r folder root@1.2.3.4:/home/evebash

Send a File from the Server to the Client#

scp root@1.2.3.4:file.sh /home/eve

# On port 5678
scp -P 5678 root@1.2.3.4:file.sh /home/eve

# Send a folder
scp -r root@1.2.3.4:folder /home/evebash

Execute a Command#

ssh root@1.2.3.4 'df -h'

# On port 5678
ssh -P 5678 root@1.2.3.4 'df -h'bash

Run a Script#

ssh root@1.2.3.4 './scripts.sh'

# On port 5678
ssh -P 5678 root@1.2.3.4 './scripts.sh'bash

Execute a Function Inside a Script#

ssh root@1.2.3.4 "$(declare -f fonction_creation); fonction_creation" > /dev/null 2>&1

# On port 5678
ssh -P 5678 root@1.2.3.4 "$(declare -f fonction_creation); fonction_creation" > /dev/null 2>&1bash

SSH Tunnel#

ssh root@1.2.3.4 -L 2500:127.0.0.1:3000 -N -v

# On port 5678
ssh -P 5678 root@1.2.3.4 -L 2500:127.0.0.1:3000 -N -vbash

Other Useful Commands#

# Test your configuration and debug
sshd -T

# List available ciphers on your server
ssh -Q cipher

# List authentication ciphers
ssh -Q cipher-auth

# List MACs
ssh -Q mac

# List algorithms
ssh -Q kex

# List keys
ssh -Q keybash

Securing the Configuration#

Modify Permissions to Avoid Errors#

chmod 0700 ~/.ssh
chmod 0600 ~/.ssh/id_ed25519
chmod 0644 ~/.ssh/authorized_keysbash

Backup Configuration File#

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bakbash

Edit Configuration File#

Edit /etc/ssh/sshd_config:

# Interface & Port
Port 5678
AddressFamily any
ListenAddress 0.0.0.0
ListenAddress ::

HostKey /etc/ssh/ssh_host_ed25519_key

Protocol 2

SyslogFacility AUTHPRIV
LogLevel VERBOSE

# Authentication restriction
LoginGraceTime 30s
PermitRootLogin no
StrictModes yes
MaxAuthTries 3
MaxSessions 5

PubkeyAuthentication yes
AllowUsers bob
AuthorizedKeysFile  .ssh/authorized_keys

HostbasedAuthentication no
IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
PermitEmptyPasswords no
PasswordAuthentication no

# Change to no to disable s/key passwords
ChallengeResponseAuthentication no

UsePAM yes

AllowAgentForwarding no
AllowTcpForwarding no
GatewayPorts no
X11Forwarding no
PermitTTY yes
PermitUserEnvironment no
PrintMotd no
PrintLastLog no

#TCPKeepAlive yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#ShowPatchLevel no
UseDNS yes
PidFile /var/run/sshd.pid
MaxStartups 10:30:100
PermitTunnel no
#ChrootDirectory none
VersionAddendum none

# no default banner path
Banner none
DebianBanner no

# Accept locale-related environment variables
AcceptEnv LANG LC_*

# override default of no subsystems
Subsystem   sftp   /usr/libexec/openssh/sftp-serverbash

Regenerate Server ED25519 Key#

sudo rm -f /etc/ssh/ssh_host_*
sudo ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ""bash

Remove Weak Diffie-Hellman Moduli#

sudo awk '$5 >= 3071' /etc/ssh/moduli > /etc/ssh/moduli.safe
sudo mv -f /etc/ssh/moduli.safe /etc/ssh/modulibash

Disable DSA/ECDSA & RSA Keys#

sudo sed -i 's/^HostKey \/etc\/ssh\/ssh_host_\(dsa\|ecdsa\|rsa\)_key$/\#HostKey \/etc\/ssh\/ssh_host_\1_key/g' /etc/ssh/sshd_configbash

Restrict Ciphers, Key Exchange, and Authentication Methods#

echo -e "\nKexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512\nCiphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\nMACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com" >> /etc/ssh/sshd_configbash

Deny SSH Connections to Everyone Except Specific IP Addresses#

echo "sshd: ALL" >> /etc/hosts.deny
echo "sshd: 1.2.3.4, 5.6.7.8" >> /etc/hosts.allowbash

Restart SSH Service#

sudo systemctl restart sshd.servicebash

Test the Server#

• ssh-audit website
• ssh-audit python tool

Host Configuration#

Create and Modify the .ssh/config File#

Host john
    HostName example.com
    User root
    Port 5678

Host eve
    HostName 1.2.3.4
    User pi
    IdentityFile ~/.ssh/id_ed25519bash

Connect to SSH Using the .ssh/config File#

ssh john
ssh evebash

Add the commands to be executed on a new SSH connection in the /etc/ssh/sshrc file.