Debian Buster (Debian 10) Last modified: September 17, 2021

Note: all commands below are to be executed as the root user.

1. Re-generate the RSA and ED25519 keys

   rm -f /etc/ssh/ssh_host_*
   ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ""
   ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ""
   

2. Enable the RSA and ED25519 keys

   Enable the RSA and ED25519 HostKey directives in the /etc/ssh/sshd_config file:
   
   sed -i 's/^\#HostKey \/etc\/ssh\/ssh_host_\(rsa\|ed25519\)_key$/HostKey \/etc\/ssh\/ssh_host_\1_key/g' /etc/ssh/sshd_config
   

3. Remove small Diffie-Hellman moduli

   awk '$5 >= 3071' /etc/ssh/moduli > /etc/ssh/moduli.safe
   mv -f /etc/ssh/moduli.safe /etc/ssh/moduli
   

4. Restrict supported key exchange, cipher, and MAC algorithms

   echo -e "\n# Restrict key exchange, cipher, and MAC algorithms, as per sshaudit.com\n# hardening guide.\nKexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256\nCiphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\nMACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com\nHostKeyAlgorithms ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-512,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com" >> /etc/ssh/sshd_config
   

5. Restart OpenSSH server

   service ssh restart

pfSense 2.4 Last modified: October 17, 2017

Note: all commands below are to be executed as the root user.

1. Re-generate the RSA and ED25519 keys

   rm /etc/ssh/ssh_host_*
   ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ""
   ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ""

2. Remove small Diffie-Hellman moduli

   awk '$5 >= 3071' /etc/ssh/moduli > /etc/ssh/moduli.safe
   mv -f /etc/ssh/moduli.safe /etc/ssh/moduli

3. Restrict supported key exchange, cipher, and MAC algorithms

   sed -i.bak 's/^MACs \(.*\)$/\#MACs \1/g' /etc/ssh/sshd_config && rm /etc/ssh/sshd_config.bak
   echo "" | echo "MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com" >> /etc/ssh/sshd_config

4. Restart OpenSSH server

   service sshd onerestart

OpenBSD 6.2 Server Last modified: October 20, 2020

Note: all commands below are to be executed as the root user.

1. Re-generate the RSA and ED25519 keys

   rm /etc/ssh/ssh_host_*
   ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ""
   ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ""

2. Create custom Diffie-Hellman groups

   ssh-keygen -G /etc/ssh/moduli -b 3072
   
   Note: This will likely take some time to complete.

3. Disable the DSA and ECDSA host keys

   echo -e "\n# Restrict host keys to ED25519 and RSA only.\nHostKeyAlgorithms ssh-ed25519\n" >> /etc/ssh/sshd_config

4. Restrict supported key exchange, cipher, and MAC algorithms

   echo -e "# Restrict key exchange, cipher, and MAC algorithms, as per sshaudit.com\n# hardening guide.\nKexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256\nCiphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\nMACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com" >> /etc/ssh/sshd_config

5. Restart OpenSSH server

   kill -HUP `cat /var/run/sshd.pid`

RedHat Enterprise Linux 8 Server / CentOS 8 Server Last modified: October 20, 2020

Note: all commands below are to be executed as the root user.

1. Re-generate the RSA and ED25519 keys

   rm -f /etc/ssh/ssh_host_*
   ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ""
   ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ""
   chgrp ssh_keys /etc/ssh/ssh_host_ed25519_key /etc/ssh/ssh_host_rsa_key
   chmod g+r /etc/ssh/ssh_host_ed25519_key /etc/ssh/ssh_host_rsa_key

2. Remove small Diffie-Hellman moduli

   awk '$5 >= 3071' /etc/ssh/moduli > /etc/ssh/moduli.safe
   mv -f /etc/ssh/moduli.safe /etc/ssh/moduli

3. Disable ECDSA host key

   Comment out the ECDSA HostKey directive in the /etc/ssh/sshd_config file:
   
   sed -i 's/^HostKey \/etc\/ssh\/ssh_host_ecdsa_key$/\#HostKey \/etc\/ssh\/ssh_host_ecdsa_key/g' /etc/ssh/sshd_config

4. Restrict supported key exchange, cipher, and MAC algorithms

   cp /etc/crypto-policies/back-ends/opensshserver.config /etc/crypto-policies/back-ends/opensshserver.config.orig
   echo -e "CRYPTO_POLICY='-oCiphers=chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr -oMACs=hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com -oGSSAPIKexAlgorithms=gss-curve25519-sha256- -oKexAlgorithms=curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256 -oHostKeyAlgorithms=ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-512 -oPubkeyAcceptedKeyTypes=ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-512'" > /etc/crypto-policies/back-ends/opensshserver.config
   

5. Restart OpenSSH server

   systemctl restart sshd.service

RedHat Enterprise Linux 7 Server / CentOS 7 Server Last modified: February 18, 2024

Note: all commands below are to be executed as the root user.

1. Disable automatic re-generation of RSA & ECDSA keys

   mkdir -p /etc/systemd/system/sshd-keygen.service.d
   cat << EOF> /etc/systemd/system/sshd-keygen.service.d/ssh-audit.conf
   [Unit]
   ConditionFileNotEmpty=
   ConditionFileNotEmpty=!/etc/ssh/ssh_host_ed25519_key
   EOF
   systemctl daemon-reload

2. Re-generate the ED25519 key

   rm -f /etc/ssh/ssh_host_*
   ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ""
   chgrp ssh_keys /etc/ssh/ssh_host_ed25519_key
   chmod g+r /etc/ssh/ssh_host_ed25519_key

3. Remove small Diffie-Hellman moduli

   awk '$5 >= 3071' /etc/ssh/moduli > /etc/ssh/moduli.safe
   mv -f /etc/ssh/moduli.safe /etc/ssh/moduli

4. Disable the RSA, DSA, and ECDSA host keys

   Comment out the RSA, DSA, and ECDSA HostKey directives in the /etc/ssh/sshd_config file:
   
   sed -i 's/^HostKey \/etc\/ssh\/ssh_host_\(rsa\|dsa\|ecdsa\)_key$/\#HostKey \/etc\/ssh\/ssh_host_\1_key/g' /etc/ssh/sshd_config

5. Restrict supported key exchange, cipher, and MAC algorithms

   echo -e "\n# Restrict key exchange, cipher, and MAC algorithms, as per sshaudit.com\n# hardening guide.\nKexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256\nCiphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\nMACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com" >> /etc/ssh/sshd_config

6. Restart OpenSSH server

   systemctl restart sshd.service

Ubuntu 18.04 LTS Server Last modified: February 8, 2020

Note: all commands below are to be executed as the root user.

1. Re-generate the RSA and ED25519 keys

   rm /etc/ssh/ssh_host_*
   ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ""
   ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ""

2. Remove small Diffie-Hellman moduli

   awk '$5 >= 3071' /etc/ssh/moduli > /etc/ssh/moduli.safe
   mv /etc/ssh/moduli.safe /etc/ssh/moduli

3. Disable the DSA and ECDSA host keys

   Comment out the DSA and ECDSA HostKey directives in the /etc/ssh/sshd_config file:
   
   sed -i 's/^HostKey \/etc\/ssh\/ssh_host_\(dsa\|ecdsa\)_key$/\#HostKey \/etc\/ssh\/ssh_host_\1_key/g' /etc/ssh/sshd_config

4. Restrict supported key exchange, cipher, and MAC algorithms

   echo -e "\n# Restrict key exchange, cipher, and MAC algorithms, as per sshaudit.com\n# hardening guide.\nKexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256\nCiphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\nMACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com\nHostKeyAlgorithms ssh-ed25519,ssh-ed25519-cert-v01@openssh.com" >> /etc/ssh/sshd_config

5. Restart OpenSSH server

   service ssh restart

Ubuntu 16.04 LTS Server Last modified: July 6, 2020

Note: all commands below are to be executed as the root user.

1. Re-generate ED25519 key

   rm /etc/ssh/ssh_host_*
   ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ""

2. Remove small Diffie-Hellman moduli

   awk '$5 >= 3071' /etc/ssh/moduli > /etc/ssh/moduli.safe
   mv /etc/ssh/moduli.safe /etc/ssh/moduli

3. Disable the RSA, DSA, and ECDSA host keys

   Comment out the RSA, DSA and ECDSA HostKey directives in the /etc/ssh/sshd_config file:
   
   sed -i 's/^HostKey \/etc\/ssh\/ssh_host_\(rsa\|dsa\|ecdsa\)_key$/\#HostKey \/etc\/ssh\/ssh_host_\1_key/g' /etc/ssh/sshd_config

4. Restrict supported key exchange, cipher, and MAC algorithms

   echo -e "\n# Restrict key exchange, cipher, and MAC algorithms, as per sshaudit.com\n# hardening guide.\nKexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256\nCiphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\nMACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com" >> /etc/ssh/sshd_config

5. Restart OpenSSH server

   service ssh restart

Ubuntu 14.04 LTS Server Last modified: October 17, 2017

Note: all commands below are to be executed as the root user.

1. Re-generate the RSA and ED25519 keys

   rm /etc/ssh/ssh_host_*
   ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ""
   ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ""

2. Remove small Diffie-Hellman moduli

   awk '$5 >= 3071' /etc/ssh/moduli > /etc/ssh/moduli.safe
   mv /etc/ssh/moduli.safe /etc/ssh/moduli

3. Disable the DSA and ECDSA host keys

   Comment out the DSA and ECDSA HostKey directives in the /etc/ssh/sshd_config file:
   
   sed -i 's/^HostKey \/etc\/ssh\/ssh_host_\(dsa\|ecdsa\)_key$/\#HostKey \/etc\/ssh\/ssh_host_\1_key/g' /etc/ssh/sshd_config

4. Restrict supported key exchange, cipher, and MAC algorithms

   echo -e "\n# Restrict key exchange, cipher, and MAC algorithms, as per sshaudit.com\n# hardening guide.\nKexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256\nCiphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\nMACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com" >> /etc/ssh/sshd_config

5. Restart OpenSSH server

   service ssh restart

Ubuntu Core 18 Server Last modified: October 6, 2019

Note: all commands below are to be executed as the root user.

1. Re-generate the RSA and ED25519 keys

   Note: It is highly recommended that you run the ssh-keygen commands below on another host. Some IoT devices do not have good entropy sources to generate sufficient keys with!
   
   ssh-keygen -t rsa -b 4096 -f ssh_host_rsa_key -N ""
   ssh-keygen -t ed25519 -f ssh_host_ed25519_key -N ""
   
   Be sure to upload the following 4 files to the target device's /etc/ssh directory:
   • ssh_host_ed25519_key
   • ssh_host_ed25519_key.pub
   • ssh_host_rsa_key
   • ssh_host_rsa_key.pub

2. Remove small Diffie-Hellman moduli

   awk '$5 >= 3071' /etc/ssh/moduli > /etc/ssh/moduli.safe
   mv /etc/ssh/moduli.safe /etc/ssh/moduli

3. Restrict supported key exchange, cipher, and MAC algorithms

   echo -e "\n# Only enable RSA and ED25519 host keys.\nHostKey /etc/ssh/ssh_host_rsa_key\nHostKey /etc/ssh/ssh_host_ed25519_key\n\n# Restrict key exchange, cipher, and MAC algorithms, as per sshaudit.com\n# hardening guide.\nKexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256\nCiphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\nMACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com" >> /etc/ssh/sshd_config

4. Restart OpenSSH server

   service ssh reload

Ubuntu Core 16 Server Last modified: October 17, 2017

Note: all commands below are to be executed as the root user.

1. Re-generate the RSA and ED25519 keys

   Note: It is highly recommended that you run the ssh-keygen commands below on another host. Some IoT devices do not have good entropy sources to generate sufficient keys with!
   
   ssh-keygen -t rsa -b 4096 -f ssh_host_rsa_key -N ""
   ssh-keygen -t ed25519 -f ssh_host_ed25519_key -N ""
   
   Be sure to upload the following 4 files to the target device's /etc/ssh directory:
   • ssh_host_ed25519_key
   • ssh_host_ed25519_key.pub
   • ssh_host_rsa_key
   • ssh_host_rsa_key.pub

2. Remove small Diffie-Hellman moduli

   awk '$5 >= 3071' /etc/ssh/moduli > /etc/ssh/moduli.safe
   mv /etc/ssh/moduli.safe /etc/ssh/moduli

3. Restrict supported key exchange, cipher, and MAC algorithms

   sed -i 's/^MACs \(.*\)$/\#MACs \1/g' /etc/ssh/sshd_config
   echo -e "\n# Restrict MAC algorithms, as per sshaudit.com hardening guide.\nMACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com" >> /etc/ssh/sshd_config

4. Restart OpenSSH server

   service ssh reload

Ubuntu 16.04 LTS Client / Linux Mint 18 ClientLast modified: October 20, 2020

• Run the following in a terminal to harden the SSH client for the local user:

  mkdir -p -m 0700 ~/.ssh; echo -e "\nHost *\n Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\n KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256\n MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com\n HostKeyAlgorithms ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-512\n" >> ~/.ssh/config

Ubuntu 18.04 LTS Client / Linux Mint 19 ClientLast modified: October 20, 2020

• Run the following in a terminal to harden the SSH client for the local user:

  mkdir -p -m 0700 ~/.ssh; echo -e "\nHost *\n Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\n KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256\n MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com\n HostKeyAlgorithms ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-512\n" >> ~/.ssh/config