Zero-Trust Infrastructure Security
OpenSSH サーバー (sshd_config) セキュリティ強化構成ジェネレーター
rootログイン禁止、公開鍵認証の強制、最新のAEAD暗号スイート、厳格なアイドルタイムアウトを備えた本番Linuxサーバー向けsshd_configを生成します。
CVE-2024-6387 RegreSSHion Protection Active
Changing to a non-standard port stops 99% of automated port 22 credential bots.
DebianBanner (OS Fingerprinting)
Disabling stops OpenSSH from exposing specific Debian/Ubuntu package versions.
# ==============================================================================
# OpenSSH Server Hardened Configuration (sshd_config)
# Target File: /etc/ssh/sshd_config
# Standards: CIS Linux Benchmark / Mozilla Infosec / NIST SP 800-53
# Generated by ToolsAA: https://toolsaa.com/tools/sshd-config-generator
# ==============================================================================
# ------------------------------------------------------------------------------
# 1. Network & Address Binding
# ------------------------------------------------------------------------------
Port 2222
AddressFamily any
ListenAddress 0.0.0.0
ListenAddress ::
# ------------------------------------------------------------------------------
# 2. Host Key Infrastructure (Ed25519 & RSA)
# ------------------------------------------------------------------------------
HostKey /etc/ssh/ssh_host_ed25519_key
HostKey /etc/ssh/ssh_host_rsa_key
# ------------------------------------------------------------------------------
# 3. Logging & Auditing (VERBOSE records key fingerprints for auth tracing)
# ------------------------------------------------------------------------------
LogLevel VERBOSE
SyslogFacility AUTH
# ------------------------------------------------------------------------------
# 4. Authentication & Access Control
# ------------------------------------------------------------------------------
PermitRootLogin no
PubkeyAuthentication yes
PasswordAuthentication no
PermitEmptyPasswords no
KbdInteractiveAuthentication no
ChallengeResponseAuthentication no
GSSAPIAuthentication no
KerberosAuthentication no
StrictModes yes
MaxAuthTries 3
MaxSessions 3
LoginGraceTime 30
AllowGroups ssh-users wheel
# ------------------------------------------------------------------------------
# 5. Cryptography Hardening (Ciphers, KEX, MACs & HostKeyAlgorithms)
# ------------------------------------------------------------------------------
KexAlgorithms [email protected],curve25519-sha256,[email protected],diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
Ciphers [email protected],[email protected],[email protected]
MACs [email protected],[email protected],[email protected]
HostKeyAlgorithms ssh-ed25519,[email protected],rsa-sha2-512,rsa-sha2-256
# ------------------------------------------------------------------------------
# 6. Session Lifecycle & Security Defenses
# ------------------------------------------------------------------------------
ClientAliveInterval 300
ClientAliveCountMax 2
TCPKeepAlive no
X11Forwarding no
AllowTcpForwarding no
AllowAgentForwarding no
GatewayPorts no
PermitUserEnvironment no
Compression no
MaxStartups 10:30:60
UsePAM yes
# ------------------------------------------------------------------------------
# 7. Banners & Information Disclosure
# ------------------------------------------------------------------------------
PrintMotd no
PrintLastLog yes
Banner none
DebianBanner no
# ------------------------------------------------------------------------------
# 8. SFTP Subsystem
# ------------------------------------------------------------------------------
Subsystem sftp internal-sftpセキュリティ等級
Score: 100/100(A+)
暗号化プロファイル
Post-Quantum & Curve25519
脆弱性対策状況
CVE-2024-6387 Mitigated
最新の強固な暗号化標準
耐量子暗号ハイブリッドおよび Curve25519 鍵交換、ChaCha20-Poly1305 および AES-GCM などの最新暗号のみを許可し、CBC や 3DES 等の脆弱な暗号を完全排除します。
ゼロトラストに基づく攻撃面削減
公開鍵認証を強制し、ルート直接ログインを完全封鎖。RegreSSHion (CVE-2024-6387) を防ぐ猶予時間制限とアイドル切断でブルートフォース攻撃を遮断します。
モジュール式 drop-in と安全な検証スクリプト
完全な設定ファイルだけでなく /etc/ssh/sshd_config.d/ 向けの分割設定と、sshd -t 構文事前テストを含むロールバック対応シェルスクリプトを同時出力します。