search

HotCakeX / Harden-Windows-Security

Harden Windows Safely, Securely using Official Supported Microsoft methods and proper explanation | Always up-to-date and works with the latest build of Windows | Provides tools and Guides for Personal, Enterprise, Government and Military security levels | Read The Rationale https://github.com/HotCakeX/Harden-Windows-Security/blob/main/Rationale.md
https://hotcakex.github.io
MIT License
1.87k stars 148 forks source link

[Suggestion]: Hardening SSH #354

Closed agpt8 closed 1 month ago

agpt8 commented 1 month ago

Are you sure the Security measure is not already implemented?

Please explain your new Security measure suggestion

The current windows versions include openssh v9.x and openssh server is available as an optional feature in the settings app. By default, SSH is secure but can be hardened much more. Atleast in terms of what ciphers, algorithms and CA's it uses. This is based on this repo: https://github.com/JuliusBairaktaris/Harden-Windows-SSH, the script there is simple and configures user's and system's ssh to use much stronger algorithms, cipher's and CA's. Beta installation of OpenSSH is not needed.

The above-mentioned repo is again an inspiration from SSH Audit's repo: https://github.com/jtesta/ssh-audit/wiki/Windows-11, which contains many more platforms which can be hardened in a similar way. The config given on this one varies slightly and is a little looser than the first repo mentioned above. We can decide which should be included (personally I use a combination of the two along with some of my own changes).

Another good read for this is this answer on stack exchange: https://security.stackexchange.com/questions/257670/ssh-server-configuration-best-practices/257678#257678

To check the default state of security for ssh:

  1. Go to https://sshaudit.com
  2. Click on the button Begin Client Audit. Three new buttons will appear.
  3. Click on the middle one that says Copy OpenSSH client command
  4. Open terminal, paste the command and hit Enter
  5. The connection will close, and the scores will be displayed on the site in a few seconds along with the reasoning for the given score.
HotCakeX commented 1 month ago

Hi, Thanks for the suggestion, i looked into it, this is the line i'm going to add to the SSH client config in user directory (with proper checks to make sure it's not added if it already exists), it will be part of the Miscellaneous category.

MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com

Excluding anything that falls under the FUD category mentioned in that website, that solves the issue with weak MACs (Message Authentication Codes).

By the way Post-quantum cipher suites are on the way from NIST for Windows, TLS, SSH etc. https://techcommunity.microsoft.com/t5/security-compliance-and-identity/microsoft-s-quantum-resistant-cryptography-is-here/ba-p/4238780