FEATURE: sshd config added, task to push it added

2026-07-06 12:21:25 +00:00
parent 7d3640db50
commit b58b76bcc6
2 changed files with 38 additions and 0 deletions
@@ -0,0 +1,23 @@
+# Disable root login entirely
+PermitRootLogin no
+
+# Disable password authentication — keys only
+PasswordAuthentication no
+ChallengeResponseAuthentication no
+UsePAM no
+
+# Limit authentication attempts
+MaxAuthTries 3
+MaxSessions 2
+
+# Allow only your specific user
+AllowUsers deploy
+
+# Use modern key exchange and ciphers, prioritize post-quantum algorithms (mlkem and sntrup)
+KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org
+Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
+MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
+
+# Connection timeout
+ClientAliveInterval 300
+ClientAliveCountMax 2