On the latest Debian Stretch I installed an OpenSSH server which I set up under the following conditions.

  • no root login
  • no password authentication / force public key authentication
  • authentication by users of the group sshusers only
  • 3 concurrent connections per user
  • 1 authentication try per login attempt
  • authentication timeout of 20 seconds

I'm using the latest OpenSSH OpenSSH_7.4p1 Debian-10+deb9u6, OpenSSL 1.0.2r 26 Feb 2019

# $OpenBSD: sshd_config,v 1.100 2016/08/15 12:32:04 naddy Exp $

X11Forwarding yes
PrintMotd no
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server
Protocol 2
KerberosAuthentication no
GSSAPIAuthentication no
AddressFamily inet
Port 22
HostKey /etc/ssh/ssh_host_rsa_key
PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM no
PubkeyAuthentication yes
LoginGraceTime 20s
MaxAuthTries 1
MaxStartups 3
AuthorizedKeysFile .ssh/authorized_keys
PermitRootLogin no
AllowGroups sshusers

I created the config above based on this article from 2005 which I tried to understand as much as possible. So I discovered RSAAuthentication is deprecated and removed it, I moved from DSA to RSA ...

My question is: Is this configuration secure or did I miss something important or did I misconfigured something?

I digged into the man page but I really don't understand everything clearly.

closed as primarily opinion-based by Kusalananda, Jeff Schaller, jimmij, user34720, GAD3R Mar 23 at 18:09

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • It really depends on the security level you are targetting ... but you could also add some filters on old Ciphers, KeyAlgorithms and MACs. – Ouki Mar 21 at 13:38
  • 1
    side note, but you could also implement external firewall here, that would filter out bots and break-in-tries (example: fail2ban) – adamczi Mar 21 at 13:46

You could disable the the support for weak ciphers such as Arcfour, blowfish, triple DES....

Not the answer you're looking for? Browse other questions tagged or ask your own question.