On the latest Debian Stretch I installed an OpenSSH server which I set up under the following conditions.
- no root login
- no password authentication / force public key authentication
- authentication by users of the group
- 3 concurrent connections per user
- 1 authentication try per login attempt
- authentication timeout of 20 seconds
I'm using the latest OpenSSH
OpenSSH_7.4p1 Debian-10+deb9u6, OpenSSL 1.0.2r 26 Feb 2019
# $OpenBSD: sshd_config,v 1.100 2016/08/15 12:32:04 naddy Exp $ X11Forwarding yes PrintMotd no AcceptEnv LANG LC_* Subsystem sftp /usr/lib/openssh/sftp-server Protocol 2 KerberosAuthentication no GSSAPIAuthentication no AddressFamily inet Port 22 HostKey /etc/ssh/ssh_host_rsa_key PasswordAuthentication no ChallengeResponseAuthentication no UsePAM no PubkeyAuthentication yes LoginGraceTime 20s MaxAuthTries 1 MaxStartups 3 AuthorizedKeysFile .ssh/authorized_keys PermitRootLogin no AllowGroups sshusers
I created the config above based on this article from 2005 which I tried to understand as much as possible. So I discovered
RSAAuthentication is deprecated and removed it, I moved from DSA to RSA ...
My question is: Is this configuration secure or did I miss something important or did I misconfigured something?
I digged into the man page but I really don't understand everything clearly.