Generate an elliptic curve key

See this article on upgrading SSH keys.

ssh-keygen -o -a 100 -t ed25519

For example, using a large number of rounds:

ssh-keygen -o -a 1000000000 -t ed25519 -f d:\test_ed

Proxy RDP over ssh

Start SSH:

ssh mark@sshbox -L 9000:machine-to-remote-to:3389

Where:

  • ‘sshbox’ is the SSH Proxy
  • 9000 is the local port

Connect:

mstsc /v:localhost:9000

Generate a key compatible with TeamCity

TeamCity requires keys to be in a specific format:

ssh-keygen -t rsa -m PEM -f id_project

Server Setup

Contents of /etc/ssh/sshd_config.d/999-security.conf:

# Only allow latest SSH protocol
Protocol 2

# Ensure root login is disabled
PermitRootLogin no

# Don't trust ~/.ssh/authorized_keys
HostBasedAuthentication no

# Ignore RHosts and Shosts
IgnoreRHosts yes

# no blank passwords
PermitEmptyPasswords no

# Limit auth retries
MaxAuthTries 3

# For example, a user can set a variable to have a process execute a malicious package
PermitUserEnvironment no

# use PAM not password files
UsePAM yes

# No X11 forwarding
X11Forwarding no

# Don't allow port forwarding
AllowTcpForwarding no

User setup

Enable the sshd-agent service:

systetmctl enable --user --now sshd-agent

Note: if using Firejail and ssh-agent, make sure it has been whitelisted:

whitelist $XDG_RUNTIME_DIR/ssh-agent.socket

Add the private key to the agent:

ssh-add 'private_key'