Zero-Trust Infrastructure Security
OpenSSH-Server (sshd_config) Härtungs-Konfigurationsgenerator
Erstellen Sie produktionsgehärtete Linux sshd_config-Vorlagen mit erzwungener Public-Key-Authentifizierung, modernen AEAD-Ciphers, strikten Timeouts und deaktiviertem Root-Login.
CVE-2024-6387 RegreSSHion Protection Active
Changing to a non-standard port stops 99% of automated port 22 credential bots.
DebianBanner (OS Fingerprinting)
Disabling stops OpenSSH from exposing specific Debian/Ubuntu package versions.
# ==============================================================================
# OpenSSH Server Hardened Configuration (sshd_config)
# Target File: /etc/ssh/sshd_config
# Standards: CIS Linux Benchmark / Mozilla Infosec / NIST SP 800-53
# Generated by ToolsAA: https://toolsaa.com/tools/sshd-config-generator
# ==============================================================================
# ------------------------------------------------------------------------------
# 1. Network & Address Binding
# ------------------------------------------------------------------------------
Port 2222
AddressFamily any
ListenAddress 0.0.0.0
ListenAddress ::
# ------------------------------------------------------------------------------
# 2. Host Key Infrastructure (Ed25519 & RSA)
# ------------------------------------------------------------------------------
HostKey /etc/ssh/ssh_host_ed25519_key
HostKey /etc/ssh/ssh_host_rsa_key
# ------------------------------------------------------------------------------
# 3. Logging & Auditing (VERBOSE records key fingerprints for auth tracing)
# ------------------------------------------------------------------------------
LogLevel VERBOSE
SyslogFacility AUTH
# ------------------------------------------------------------------------------
# 4. Authentication & Access Control
# ------------------------------------------------------------------------------
PermitRootLogin no
PubkeyAuthentication yes
PasswordAuthentication no
PermitEmptyPasswords no
KbdInteractiveAuthentication no
ChallengeResponseAuthentication no
GSSAPIAuthentication no
KerberosAuthentication no
StrictModes yes
MaxAuthTries 3
MaxSessions 3
LoginGraceTime 30
AllowGroups ssh-users wheel
# ------------------------------------------------------------------------------
# 5. Cryptography Hardening (Ciphers, KEX, MACs & HostKeyAlgorithms)
# ------------------------------------------------------------------------------
KexAlgorithms [email protected],curve25519-sha256,[email protected],diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
Ciphers [email protected],[email protected],[email protected]
MACs [email protected],[email protected],[email protected]
HostKeyAlgorithms ssh-ed25519,[email protected],rsa-sha2-512,rsa-sha2-256
# ------------------------------------------------------------------------------
# 6. Session Lifecycle & Security Defenses
# ------------------------------------------------------------------------------
ClientAliveInterval 300
ClientAliveCountMax 2
TCPKeepAlive no
X11Forwarding no
AllowTcpForwarding no
AllowAgentForwarding no
GatewayPorts no
PermitUserEnvironment no
Compression no
MaxStartups 10:30:60
UsePAM yes
# ------------------------------------------------------------------------------
# 7. Banners & Information Disclosure
# ------------------------------------------------------------------------------
PrintMotd no
PrintLastLog yes
Banner none
DebianBanner no
# ------------------------------------------------------------------------------
# 8. SFTP Subsystem
# ------------------------------------------------------------------------------
Subsystem sftp internal-sftpSicherheits-Bewertung
Score: 100/100(A+)
Krypto-Richtlinie
Post-Quantum & Curve25519
Schwachstellen-Schutz
CVE-2024-6387 Mitigated
Moderne kryptographische Standards
Beschränkt OpenSSH auf Post-Quantum- und Curve25519-Schlüsselaustausch sowie ChaCha20-Poly1305 und AES-GCM AEAD-Chiffren und eliminiert veraltete CBC- und 3DES-Verfahren.
Zero-Trust-Angriffsflächenminimierung
Erzwingt strikte Public-Key-Authentifizierung, sperrt Root-Passwörter, schützt vor RegreSSHion (CVE-2024-6387) und beendet inaktive Geistersitzungen automatisch.
Modulare Drop-In-Dateien & Ausfallsicheres Setup
Erzeugt vollständige Konfigurationsdateien oder moderne conf.d-Dateien sowie ein verifiziertes Bereitstellungsskript mit sshd -t Syntaxprüfung vor dem Daemon-Neustart.