Git/ssh-audit
1
0
Fork 0
mirror of https://github.com/jtesta/ssh-audit.git synced 2024-12-23 09:29:50 +01:00
Code Issues Packages Projects Releases Wiki Activity

Make sure to use builtin sed in case GNU sed has been installed, -i option works differently. Also perform both changes in one line so the first .orig isn't replaced by the second.

pr3c0g 2024-08-12 14:19:20 +01:00
parent b0b6a70163
commit 88d7b0ece7
1 changed files with 6 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
macOS-13-(Ventura)-&-14-(Sonoma).md

@ -3,23 +3,22 @@ The community has indicated that the following instructions work for macOS 13 (V
Note: all commands below are to be executed as the root user. Note: all commands below are to be executed as the root user.
1. Re-generate the RSA and ED25519 keys 1. Re-generate the RSA and ED25519 keys
``` ```bash
rm /etc/ssh/ssh_host_* rm /etc/ssh/ssh_host_*
ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N "" ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ""
ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N "" ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ""
``` ```
2. Remove small Diffie-Hellman moduli 2. Remove small Diffie-Hellman moduli
``` ```bash
awk '$5 >= 3071' /etc/ssh/moduli > /etc/ssh/moduli.safe awk '$5 >= 3071' /etc/ssh/moduli > /etc/ssh/moduli.safe
mv /etc/ssh/moduli.safe /etc/ssh/moduli mv /etc/ssh/moduli.safe /etc/ssh/moduli
``` ```
3. Enable the RSA and ED25519 HostKey directives in the /etc/ssh/sshd_config file 3. Enable the RSA and ED25519 HostKey directives in the /etc/ssh/sshd_config file
``` ```bash
sed -i .orig 's/^\#HostKey \/etc\/ssh\/ssh_host_rsa_key/HostKey \/etc\/ssh\/ssh_host_rsa_key/' /etc/ssh/sshd_config /usr/bin/sed -i .orig -E 's/^\#(HostKey \/etc\/ssh\/ssh_host_(rsa_key|ed25519_key))/\1/' sshd_config
sed -i .orig 's/^\#HostKey \/etc\/ssh\/ssh_host_ed25519_key/HostKey \/etc\/ssh\/ssh_host_ed25519_key/' /etc/ssh/sshd_config
``` ```
4. Restrict supported key exchange, cipher, and MAC algorithms 4. Restrict supported key exchange, cipher, and MAC algorithms
``` ```bash
echo ' echo '
# Restrict key exchange, cipher, and MAC algorithms, as per sshaudit.com # Restrict key exchange, cipher, and MAC algorithms, as per sshaudit.com
# hardening guide. # hardening guide.
@ -29,7 +28,7 @@ MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@op
HostKeyAlgorithms ssh-ed25519,rsa-sha2-512,rsa-sha2-256' > /etc/ssh/sshd_config.d/99_hardening.conf HostKeyAlgorithms ssh-ed25519,rsa-sha2-512,rsa-sha2-256' > /etc/ssh/sshd_config.d/99_hardening.conf
``` ```
5. Restart OpenSSH server 5. Restart OpenSSH server
``` ```bash
sudo launchctl stop com.openssh.sshd sudo launchctl stop com.openssh.sshd
sudo launchctl start com.openssh.sshd sudo launchctl start com.openssh.sshd
``` ```