From 44bc02fafb6c9f44da411f5f1896ad5fe58a8809 Mon Sep 17 00:00:00 2001 From: Webb Phillips Date: Fri, 4 Mar 2022 19:38:19 +0100 Subject: [PATCH] Created macOS (markdown) --- macOS.md | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 macOS.md diff --git a/macOS.md b/macOS.md new file mode 100644 index 0000000..a2b171b --- /dev/null +++ b/macOS.md @@ -0,0 +1,32 @@ +Note: all commands below are to be executed as the root user. + +1. Re-generate the RSA and ED25519 keys +``` +rm /etc/ssh/ssh_host_* +ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N "" +ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N "" +``` +2. Remove small Diffie-Hellman moduli +``` +awk '$5 >= 3071' /etc/ssh/moduli > /etc/ssh/moduli.safe +mv /etc/ssh/moduli.safe /etc/ssh/moduli +``` +3. Enable the RSA and ED25519 keys +Enable the RSA and ED25519 HostKey directives in the /etc/ssh/sshd_config file: +``` +sed -i 's/^\#HostKey \/etc\/ssh\/ssh_host_\(rsa\|ed25519\)_key$/HostKey \/etc\/ssh\/ssh_host_\1_key/g' /etc/ssh/sshd_config +``` +4. Restrict supported key exchange, cipher, and MAC algorithms +``` +echo ' +# Restrict key exchange, cipher, and MAC algorithms, as per sshaudit.com +# hardening guide. +KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256 +Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr +MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com +HostKeyAlgorithms ssh-ed25519,rsa-sha2-512,rsa-sha2-256' >> /etc/sshd/sshd_config +``` +5. Restart OpenSSH server +``` +sudo launchctl stop com.openssh.sshd +``` \ No newline at end of file