Hardened SSH settings

[git70]

Hi

I also ask @m3nu for an opinion, because he is a representative of Borgbase, which I am currently testing...

Context:
I recently organized all my outgoing SSH connections into individual configuration files in /etc/ssh/ssh_config.d/*.conf
This allows me to use ssh SERVER1 commands instead of the long ssh -option1 -option2 -option3 etc etc user@host

In the Borg options I found BORG_RSH or --rsh which allows me to use --rsh ssh SERVER1 (probably as I haven't tested it yet)

Now the real question:
Are these SSH settings correct and won't break anything in Borg and Borgbase? They're pretty strict, and I don't want to shoot myself in the foot...

Host SERVER1
 Hostname EXAMPLE_SERVER
 Port EXAMPLE_PORT
 User EXAMPLE_USER
 IdentityFile ~/.ssh/EXAMPLE_KEY
 IdentitiesOnly yes
 Protocol 2
 AddressFamily inet
 ForwardX11 no
 ForwardX11Trusted no
 ForwardAgent no
 PubkeyAuthentication yes
 PasswordAuthentication no
 StrictHostKeyChecking ask
 UpdateHostKeys ask
 CheckHostIP yes
 VisualHostKey no
 Ciphers chacha20-poly1305@openssh.com
 MACs hmac-sha2-512-etm@openssh.com
 KexAlgorithms curve25519-sha256
 CASignatureAlgorithms ssh-ed25519
 Tunnel no
 TCPKeepAlive no
 ServerAliveInterval 10
 ServerAliveCountMax 3
 GSSAPIAuthentication no
 Compression yes
 HostbasedAuthentication no
 BatchMode no
 ConnectTimeout 5
 UseRoaming no
 SendEnv LANG LC_*
 HashKnownHosts yes

[m3nu]

It's best to just test your settings. If the connection works, it works.

Also, many of those settings could be disabled globally, if you want to harden everything. Like ForwardX11, which isn't widely used. Avoid duplication across all config files. For port, user and hostname, that's all in the repo URL already.

[git70]

If the connection works, it works.

I'm afraid that the connection will appear to be working, but in reality SOMETHING will fail "inside" and I won't know about it :(

[m3nu]

What can fail inside? If borg list works, you should be fine for all other commands, since they likewise use SSH as transport only.

[git70]

Thank you Manu for your answer and sorry if my questions are stupid. I am a beginner, and my above knowledge comes from wise guides, not my wise head :(
I understand from your statement that none of my settings will conflict with Borg and Borgbase

[m3nu]

The defaults in OpenSSH will be fine generally. You'll be adding extra work by managing each one of them. Of course it's still a good learning opportunity, if you really know what each setting does.

[Alestrix]

You should really enforce many of these settings on server side. Something like PasswordAuthentication no doesn't give you any security if the server has the option set to yes.

[Alestrix]

I recommend you get a free account at cisecurity.org (CIS is one of the main industry standards for IT security) and check out the SSH hardening guides, e.g. here: https://workbench.cisecurity.org/benchmarks/13775/sections/1985942
(it's the "4.2 - Configure SSH Server" chapter of the CIS Ubuntu paper)

EDIT: I was shocked the CIS hardening guide doesn't include some of the best practices of SSH hardening! Maybe have a look at these controls instead: https://github.com/dev-sec/ssh-baseline/blob/master/controls/sshd_spec.rb - no need to run it programatically, you can understand what should be set in the sshd_config by just going through that sshd_spec.rb file.

[ThomasWaldmann]

Closing this as outdated: it has seen no activity for a long time and predates the current borg releases.

If this still affects you on a current version - borg 1.4.x (stable) or the borg 2.0.0 beta - please open a new discussion with up-to-date details.