Différences
Ci-dessous, les différences entre deux révisions de la page.
| Les deux révisions précédentes Révision précédente Prochaine révision | Révision précédente | ||
| serveur:ssh [2024/10/09 15:13] – [Correction du fichier de configuration du serveur : mise à jour des paramètres pour un chiffrement fort] d2air | serveur:ssh [2024/11/01 20:06] (Version actuelle) – [Fichier de configuration du client] d2air | ||
|---|---|---|---|
| Ligne 7: | Ligne 7: | ||
| </ | </ | ||
| Pour configuer '' | Pour configuer '' | ||
| + | |||
| + | Si vous avez un module TPM vous pouvez aussi ajouter '' | ||
| + | < | ||
| + | sudo vi / | ||
| + | sudo update-initramfs -u | ||
| + | sudo systemctl reboot | ||
| + | </ | ||
| ===== Installer Open-SSH Server ===== | ===== Installer Open-SSH Server ===== | ||
| < | < | ||
| Ligne 21: | Ligne 28: | ||
| mv moduli moduli-`date +" | mv moduli moduli-`date +" | ||
| mv moduli-4096 moduli | mv moduli-4096 moduli | ||
| - | mv sshd_config sshd_config-original-`date +" | + | # copier les configurations personnalisées |
| - | vi sshd_config | + | |
| - | # modifier la config du serveur | + | |
| - | vi ssh_config | + | |
| - | # modifier la config du client comme ci-dessous | + | |
| systemctl restart ssh.service | systemctl restart ssh.service | ||
| </ | </ | ||
| ==== Fichier de configuration du serveur ==== | ==== Fichier de configuration du serveur ==== | ||
| Cette configuration désactive la connexion par l' | Cette configuration désactive la connexion par l' | ||
| - | <file sh sshd_config> | + | Copiez la configuration |
| - | # $OpenBSD: sshd_config, | + | <file sh sshd_config_local.conf> |
| - | + | ||
| - | # This is the sshd server system-wide | + | |
| - | # sshd_config(5) for more information. | + | |
| - | + | ||
| - | # This sshd was compiled with PATH=/ | + | |
| - | + | ||
| - | # The strategy used for options in the default | + | |
| - | # OpenSSH is to specify options with their default value where | + | |
| - | # possible, but leave them commented. | + | |
| - | # default value. | + | |
| Port 1234 | Port 1234 | ||
| # | # | ||
| Ligne 54: | Ligne 46: | ||
| # Ciphers and keying | # Ciphers and keying | ||
| #RekeyLimit default none | #RekeyLimit default none | ||
| - | # | + | Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr, |
| - | Ciphers aes128-ctr,aes192-ctr,aes256-ctr, | + | HostKeyAlgorithms sk-ssh-ed25519-cert-v01@openssh.com, |
| - | HostKeyAlgorithms | + | KexAlgorithms |
| - | KexAlgorithms curve25519-sha256, | + | MACs hmac-sha2-256-etm@openssh.com, |
| - | MACs hmac-sha2-512-etm@openssh.com, | + | PubkeyAcceptedAlgorithms sk-ssh-ed25519-cert-v01@openssh.com, |
| + | HostbasedAcceptedAlgorithms sk-ssh-ed25519-cert-v01@openssh.com, | ||
| + | CASignatureAlgorithms sk-ssh-ed25519@openssh.com, | ||
| + | GSSAPIKexAlgorithms gss-curve25519-sha256-, | ||
| # Logging | # Logging | ||
| Ligne 165: | Ligne 161: | ||
| </ | </ | ||
| ==== Fichier de configuration du client ==== | ==== Fichier de configuration du client ==== | ||
| - | < | + | Copiez la configuration suivante dans un fichier se terminant par .conf dans le répertoire : /etc/ssh/ssh_config.d/ |
| - | mv ssh_config | + | <file sh ssh_config_local.conf> |
| - | vi ssh_config | + | |
| - | </code> | + | |
| - | <file sh ssh_config> | + | |
| - | # This is the ssh client system-wide configuration file. See | + | |
| - | # ssh_config(5) for more information. | + | |
| - | # users, and the values can be changed in per-user configuration files | + | |
| - | # or on the command line. | + | |
| - | + | ||
| - | # Configuration data is parsed as follows: | + | |
| - | # 1. command line options | + | |
| - | # 2. user-specific file | + | |
| - | # 3. system-wide file | + | |
| - | # Any configuration value is only changed the first time it is set. | + | |
| - | # Thus, host-specific definitions should be at the beginning of the | + | |
| - | # configuration file, and defaults at the end. | + | |
| - | + | ||
| - | # Site-wide defaults for some commonly used options. | + | |
| - | # list of available options, their meanings and defaults, please see the | + | |
| - | # ssh_config(5) man page. | + | |
| Host * | Host * | ||
| - | # | + | PasswordAuthentication yes |
| - | # | + | |
| - | # | + | ChallengeResponseAuthentication |
| - | # | + | |
| - | # HostbasedAuthentication no | + | |
| - | # GSSAPIAuthentication no | + | ## faster connexion |
| - | # | + | GSSAPIAuthentication no |
| - | # GSSAPIKeyExchange no | + | GSSAPIKeyExchange no |
| - | # | + | |
| - | # | + | |
| - | # CheckHostIP yes | + | ## |
| - | # AddressFamily any | + | |
| - | # | + | KexAlgorithms sntrup761x25519-sha512@openssh.com,gss-curve25519-sha256-, |
| - | # | + | MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com |
| - | # | + | |
| - | # | + | |
| - | # | + | CASignatureAlgorithms sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-512,rsa-sha2-256 |
| - | # | + | GSSAPIKexAlgorithms gss-curve25519-sha256-, |
| - | # Port 22 | + | HostbasedAcceptedAlgorithms sk-ssh-ed25519-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com, |
| - | # | + | PubkeyAcceptedAlgorithms sk-ssh-ed25519-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com, |
| - | # MACs hmac-md5,hmac-sha1,umac-64@openssh.com | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | PasswordAuthentication yes | + | |
| - | PubkeyAuthentication yes | + | |
| - | ChallengeResponseAuthentication no | + | |
| - | SendEnv LANG LC_* | + | |
| - | HashKnownHosts yes | + | |
| - | # faster connexion | + | |
| - | GSSAPIAuthentication no | + | |
| - | GSSAPIKeyExchange no | + | |
| - | GSSAPIRenewalForcesRekey no | + | |
| - | GSSAPIDelegateCredentials no | + | |
| - | # | + | |
| - | Ciphers aes256-ctr,aes192-ctr,aes128-ctr,aes256-gcm@openssh.com, | + | |
| - | KexAlgorithms diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256, | + | |
| - | MACs umac-128-etm@openssh.com, | + | |
| - | HostKeyAlgorithms | + | |
| </ | </ | ||
| + | Les sites [[https:// | ||
| ==== Redémarrer SSH ==== | ==== Redémarrer SSH ==== | ||
| < | < | ||
| systemctl restart ssh.service | systemctl restart ssh.service | ||
| </ | </ | ||
d2air