🖋
🖋
🖋
🖋
certificationportal
Search…
🖋
🖋
🖋
🖋
certificationportal
Cryptobounty Certification Program
Certifications
Cryptobounty Certified Pool Operator
Micro-Certifications
Node Security
Key Management
Node Configuration
Node Management
Node Monitoring
Guides
General OS Hardening (Ubuntu 20.04 LTS)
SSH Hardening
Starting the Node
Up and running the Systemd
Building the Node
Managing Hot Keys
Operating with Cold Keys
Key Security
Node Monitoring with Prometheus
Displaying Node Metrics with Grafana
Using RTView
Cardano-Cli Basics
3rd Party Monitoring Tools (gLiveview, etc.)
Chrony Configuration
Firewall Configurations
Configuration, Topology, Genesis
Powered By GitBook
SSH Hardening
If you use Linux you most likely use SSH. SSH allows you to make connections without a password.

PubkeyAuthentication yes

PasswordAuthentication no

Some user accounts are created without passwords, administrators of linux machines can create standard users without passwords. SSH does not prevent empty passwords from being allowed.
PermitEmptyPasswords no

PermitRootLogin no

Port 12345

AllowUsers user1 user2
AllowGroups group1 group2

X11 Forwarding allows anyone to tunnel GUI applications with SSH. You probably dont want that.
X11Forwarding no

GatewayPorts no

PermitUserEnvironment no

Ciphers [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr
KexAlgorithms [email protected],ecdh-sha2-nistp521
MACs [email protected],[email protected],hmac-sha2-512,hmac-sha2-256
Ciphers [email protected],[email protected],aes256-ctr
KexAlgorithms [email protected],ecdh-sha2-nistp521
MACs [email protected],hmac-sha2-512****
You can test support algorithims using nmap
nmap -sV --script ssh2-enum-algos -p PORT TARGET

rm /etc/ssh/ssh_host_*
ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ""
ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ""

#HostKey /etc/ssh/ssh_host_dsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key

awk '$5 >= 3071' /etc/ssh/moduli > /etc/ssh/moduli.safe
mv /etc/ssh/moduli.safe /etc/ssh/moduli

Protocol 2
Guides - Previous
General OS Hardening (Ubuntu 20.04 LTS)
Next - Guides
Starting the Node
Last modified 1yr ago
Copy link
On this page
Enable passwordless Authentication
Disable Password Authentication
Disable Empty Passwords
Disable Root Login
Defult SSH Port
Allow Users and Groups**
Disable X11 Forwarding
Disable Gateway Ports
Disable PermitUserEnvironment
Disable Weak Cryptographic Algorithims
Regenerate Host Keys
Disable Host Keys
Disable Small Diffie-Hellman Key Sizes
Disable SSHv1