Skip to content

Commit

Permalink
Improve SSHD config to use more secure settings (sonic-net#17798)
Browse files Browse the repository at this point in the history
Improve SSHD config to use more secure settings

Why I did it
According to Sonic OS review result, SSHD config file /etc/ssh/sshd_config using insecure settings.

Work item tracking
Microsoft ADO: 15022083
How I did it
Change build_debian.sh script to set following settings to /etc/ssh/sshd_config:
ClientAliveInterval is set to 300
MaxAuthTries is set to default of 3
Banner set to /etc/issue

How to verify it
Pass all E2E test case.
  • Loading branch information
liuh-80 authored Jan 23, 2024
1 parent a2e57d8 commit b1750b7
Showing 1 changed file with 6 additions and 2 deletions.
8 changes: 6 additions & 2 deletions build_debian.sh
Original file line number Diff line number Diff line change
Expand Up @@ -484,10 +484,14 @@ rm /files/etc/ssh/sshd_config/ClientAliveInterval
rm /files/etc/ssh/sshd_config/ClientAliveCountMax
touch /files/etc/ssh/sshd_config/EmptyLineHack
rename /files/etc/ssh/sshd_config/EmptyLineHack ""
set /files/etc/ssh/sshd_config/ClientAliveInterval 900
set /files/etc/ssh/sshd_config/ClientAliveInterval 300
set /files/etc/ssh/sshd_config/ClientAliveCountMax 0
ins #comment before /files/etc/ssh/sshd_config/ClientAliveInterval
set /files/etc/ssh/sshd_config/#comment[following-sibling::*[1][self::ClientAliveInterval]] "Close inactive client sessions after 15 minutes"
set /files/etc/ssh/sshd_config/#comment[following-sibling::*[1][self::ClientAliveInterval]] "Close inactive client sessions after 5 minutes"
rm /files/etc/ssh/sshd_config/MaxAuthTries
set /files/etc/ssh/sshd_config/MaxAuthTries 3
rm /files/etc/ssh/sshd_config/Banner
set /files/etc/ssh/sshd_config/Banner /etc/issue
rm /files/etc/ssh/sshd_config/LogLevel
set /files/etc/ssh/sshd_config/LogLevel VERBOSE
save
Expand Down

0 comments on commit b1750b7

Please sign in to comment.