News for hackers. Stuff that matters.

A comment on Mozilla Guidelines to Secure SSH.

Re:Mozilla Guidelines to Secure SSH by infosechandbook on Tuesday November 09, 2021 @12:30AM (#29158069)
The guide is outdated if you rely on the latest version of OpenSSH. You must update such guides with every new version of OpenSSH.

Adding legacy configuration to your OpenSSH config files can even result in a false sense of security (e.g., if the server/client just skip the legacy part and you think it adds some protection).

Newer options to secure OpenSSH are also missing (e.g., using U2F for 2FA, introduced in OpenSSH 8.2 (Feb 2020).

[ Parent | on HN ]
Re:Mozilla Guidelines to Secure SSH by skoskie on Tuesday November 09, 2021 @12:56AM (#29158225)
Are there any updated guides you’re aware of that you could share?
[ Parent | on HN ]
Re:Mozilla Guidelines to Secure SSH by beermonster on Tuesday November 09, 2021 @04:36PM (#29167807)
The ssh-audit tool is quite handy for making config recommendations in line with current best practice.
[ Parent | on HN ]