Harden the secure shell server
configurationLast Updated January 26, 2025
Where possible,
all
VMware
appliances have a default hardened configuration. Users can verify that their
configuration is appropriately hardened by examining the server and client
service settings in the global options section of the configuration file.
Open the
/etc/ssh/sshd_config
server configuration file on the VMware
appliance, and verify that the settings are correct. Setting | Setting Value in
sshd_config |
---|---|
Client Gateway Ports | GatewayPorts no
|
GSSAPI Authentication | GSSAPIAuthentication no
|
CBC Ciphers | Ciphers
aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
|
Message Authentication Codes | MACs
hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1
|
Sample
ssh_config
File