...

Standard Blue Light sshd configuration

/etc/ssh/sshd_config

The AllowUsers and Match Address changes made in this example may need adjusting for local requirements.

root@localhost:/etc/ssh# diff sshd_config{.org,}
27c27
< PermitRootLogin yes
---
> PermitRootLogin no
51a52
> PasswordAuthentication no
87c88,100
< UsePAM yes
---
> UsePAM no
>
> # Blue Light changes to improve performance
> UseDNS no
> GSSAPIAuthentication no
> Compression yes
>
> # Blue Light extras
> AllowUsers root
> Match Address 192.168.10.0/24
>       PermitRootLogin without-password
> Match Address 10.42.0.1
>       PermitRootLogin without-password


Warning: if doing this remotely, when implementing configuration changes, keep the existing ssh session open and test by starting a new one.

A pro-forma file is available in the Blue Light git at conf/ssh/sshd_config.

Explanation of some of the above recommended changes

"PasswordAuthentication no" disables login via password.

"UsePAM no" avoids messages like "PAM service(sshd) ignoring max retries; 6 > 3".

"UseDNS no" disables reverse DNS lookups to see if your hostname matches the IP-address you are connecting from. Does not make sense with dynamic IPs

"GSSAPIAuthentication no" turns off several authentication methods which are not needed as we will be when using private/public keys or passwords, not RADIUS, Kerberos, or any other .  Refrrence: http://en.wikipedia.org/wiki/Generic_Security_Services_Application_Program_Interface

"Compression yes" On fast machines this will enhance throughput.

"AllowUsers root"  TBC

"Match Address 192.168.10.0/24" matches the Blue Light LAN in the Town Hall.  Only required on ssh servers in the Town Hall.

"Match Address 10.42.0.1" matches the Blue Light OpenVPN network node "blav" and so requires that OpenVPN clients (appear to) come from blav  enhances throughput, as long as the CPU is not slow or overloaded.

/etc/default/ssh

root@localhost:/etc/default# diff ssh{.org,}
5c5
< SSHD_OPTS=
---
> SSHD_OPTS=-u0

...