r00t2/SSHSecure
1
0
Fork 0
Code Issues Pull Requests Projects Releases Activity

need to finish dh stuff still.

Browse Source
This commit is contained in:
bts
2021-07-03 03:58:06 -04:00
parent 4eb554aa38
commit d7ffbea913
5 changed files with 64 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+18 -9
View File
@@ -33,17 +33,19 @@ the default configuration and keys used may not be the strongest they can be (an
This software will harden your OpenSSH security as much as possible to currently known weaknesses.
## How?
This program will generate/replace:
This program will generate/modify and replace:
* your hostkeys (typically `/etc/ssh/ssh_host_*_key*`)
* the client keys (`~/.ssh/id_*`) for the running user
* your `sshd` (server) configuration (typically `/etc/ssh/sshd_config`)
* your system-wide `ssh` (client) configuration (typically `/etc/ssh/ssh_config`)
* the `ssh` (client) configuration for the running user (`~/.ssh/config`)
* the SSH DH parameters (typically `/etc/ssh/moduli`)
* Your hostkeys (typically `/etc/ssh/ssh_host_*_key*`)
* The client keys (`~/.ssh/id_*`) for the running user
* Your `sshd` (server) configuration (typically `/etc/ssh/sshd_config`)
* Your system-wide `ssh` (client) configuration (typically `/etc/ssh/ssh_config`)
* The `ssh` (client) configuration for the running user (`~/.ssh/config`)
* The SSH DH parameters (typically `/etc/ssh/moduli`)
with much stronger implementations from typical/upstream defaults.
Any and all pre-existing files are backed up before being replaced.
It takes the recommendations from _[Secure Secure Shell](https://stribika.github.io/2015/01/04/secure-secure-shell.html)_ (and perhaps other sources) and automatically applies
them.
@@ -67,11 +69,18 @@ running already).
## FAQ
### Why a binary?
I originally wrote this as a python script. However, some machines don't have the python
I originally wrote this as a Python script. However, some machines don't have the Python
interpreter installed and due to the lack of low-level access, I ended up making a lot
of calls to the shell anyways.
I wrote it in Golang so the source would be easily read for auditing purposes.
I wrote it in Golang because:
* The source would be easily read for auditing purposes
* Golang is, admittedly, incredibly faster at some tasks than Python
* Multiprocessing/multithreading is *incredibly* more simple in Golang than Python
* Building widely-deployable binaries is easier in Golang than C or C++
As much as I like Python, Golang should offer significant improvements.
### How can I contact you?
You can either [file a bug](https://bugs.square-r00t.net/index.php?do=newtask&project=15)