Skip to content

Commit f8494d1

Browse files
authored
Improve SSHD config to use more secure settings (#12109)
Improve SSHD config to use more secure settings #### Why I did it According to Sonic OS review result, SSHD config file /etc/ssh/sshd_config using insecure settings. #### How I did it Change build_debian.sh script to set following settings to /etc/ssh/sshd_config: ClientAliveInterval is set to 300 MaxAuthTries is set to default of 3 Banner set to /etc/issue LogLevel is set to VERBOSE #### How to verify it Pass all E2E test case. #### Which release branch to backport (provide reason below if selected) <!-- - Note we only backport fixes to a release branch, *not* features! - Please also provide a reason for the backporting below. - e.g. - [x] 202006 --> - [ ] 201811 - [ ] 201911 - [ ] 202006 - [ ] 202012 - [ ] 202106 - [ ] 202111 - [ ] 202205 #### Description for the changelog Improve SSHD config to use more secure settings #### Link to config_db schema for YANG module changes <!-- Provide a link to config_db schema for the table for which YANG model is defined Link should point to correct section on https://github.com/Azure/sonic-buildimage/blob/master/src/sonic-yang-models/doc/Configuration.md --> #### A picture of a cute animal (not mandatory but encouraged)
1 parent fd6a1b0 commit f8494d1

File tree

1 file changed

+8
-2
lines changed

1 file changed

+8
-2
lines changed

build_debian.sh

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -467,10 +467,16 @@ rm /files/etc/ssh/sshd_config/ClientAliveInterval
467467
rm /files/etc/ssh/sshd_config/ClientAliveCountMax
468468
touch /files/etc/ssh/sshd_config/EmptyLineHack
469469
rename /files/etc/ssh/sshd_config/EmptyLineHack ""
470-
set /files/etc/ssh/sshd_config/ClientAliveInterval 900
470+
set /files/etc/ssh/sshd_config/ClientAliveInterval 300
471471
set /files/etc/ssh/sshd_config/ClientAliveCountMax 1
472472
ins #comment before /files/etc/ssh/sshd_config/ClientAliveInterval
473-
set /files/etc/ssh/sshd_config/#comment[following-sibling::*[1][self::ClientAliveInterval]] "Close inactive client sessions after 15 minutes"
473+
set /files/etc/ssh/sshd_config/#comment[following-sibling::*[1][self::ClientAliveInterval]] "Close inactive client sessions after 5 minutes"
474+
rm /files/etc/ssh/sshd_config/MaxAuthTries
475+
set /files/etc/ssh/sshd_config/MaxAuthTries 3
476+
rm /files/etc/ssh/sshd_config/LogLevel
477+
set /files/etc/ssh/sshd_config/LogLevel VERBOSE
478+
rm /files/etc/ssh/sshd_config/Banner
479+
set /files/etc/ssh/sshd_config/Banner /etc/issue
474480
save
475481
quit
476482
EOF

0 commit comments

Comments
 (0)