Re: Hardening OpenSSH

[francisco <frisco@blackant.net>]

On Fri, 28 Jun 2002, Mailing Lists wrote:

> JUST CURIOUS...BY DEFAULT is OpenSSH as hardened as possible or are there
> config options I can set to max out the security...

"as possible" depends on what you want to use the machine for.


> Situation: I have one laptop I take with me that needs to access a OpenBSD box
> at home, have ODS.org doing my IP redirection...just wanted to make the system
> as secure as possible for when I travel...

if *all* you need to do is ssh to your home server, then make sure your
install included *only* the necessary packages (e.g. no X, no games, etc),
block all incoming traffic, block all outgoing traffic except port 22,
and go through /etc/rc.conf and turn off everything except pf.

now anything you find you need in addition to that, add it in, but nothing
more.

and i probably missed some things you can stop.  why not do a 'ps ax' on
that laptop and decide if you really need some of those things running?
(check their man pages of course, you probably don't wanna kill off init)
then nmap the laptop and decide if there are services open you dont need
open and figure out how to stop those too.


>
> -Dubbs
>

good luck,

-f
http://www.blackant.net/