· 2 min read · hardening · ssh
The 12 SSH checks in atalince's hardening
What each sshd directive checks, why it matters and how to see the value that is actually in effect.
atalince’s hardening has 36 checks. Twelve of them are about the SSH server, the most attacked entry point of any exposed Linux server. This post goes through each one.
First: look at the effective value
sshd_config doesn’t tell the whole story. Files in sshd_config.d/, Match blocks and defaults change the final result. To see what’s actually in effect:
sudo sshd -T | grep -Ei 'permitrootlogin|passwordauthentication|permitemptypasswords|x11forwarding|strictmodes|pubkeyauthentication|hostbasedauthentication|ignorerhosts|permituserenvironment|maxauthtries|logingracetime|maxsessions'The atalince agent does exactly that: it reads the output of sshd -T, and each item in the dashboard shows the value it read. Below, what each check expects and its severity in the dashboard.
Access and authentication
PermitRootLogin. Logging in directly as root hands the attacker the most valuable target with an already-known username. atalince expects no. High severity.
PasswordAuthentication. Passwords can be guessed; keys, in practice, can’t. With keys set up, no removes password brute force entirely. Expects no, high severity.
PermitEmptyPasswords. An account without a password should never open a remote session. Expects no, the only SSH check with critical severity.
PubkeyAuthentication. This is what lets you turn passwords off without losing access. Expects yes, medium severity.
HostbasedAuthentication. Trusting the source host instead of the user is an old model. Expects no, high severity.
IgnoreRhosts. Ignores .rhosts and .shosts files, a leftover from rsh. Expects yes, high severity.
Environment and session
X11Forwarding. Forwarding a graphical interface rarely makes sense on a server and widens the attack surface. Expects no, low severity.
StrictModes. Makes sshd check the permissions of the user’s files before accepting the key. Expects yes, medium severity.
PermitUserEnvironment. Letting users set environment variables over SSH opens a way around restrictions. Expects no, high severity.
Limits
MaxAuthTries. How many attempts per connection before disconnecting. Low values make brute force slower and more visible. Expects 1 to 4, medium severity.
LoginGraceTime. How long a connection can stay unauthenticated. Short windows reduce dangling connections. Expects 1 to 60 seconds, medium severity.
MaxSessions. How many sessions can share one connection. Expects 1 to 10, low severity.
The grade only shows with full coverage
The 36 checks add up to an A–F grade, but only when every one of them could be checked. If the agent couldn’t read one, the grade doesn’t appear. A grade computed with gaps would be a made-up number.
And the other 24?
Eight are permissions on sensitive files, like /etc/shadow and root’s authorized_keys. Eight are kernel and filesystem parameters, like ASLR and protected links. And eight are about the IPv4 stack, like SYN cookies and redirects. See them all in Security assessments.
atalince points out what’s off from the recommendation and shows the evidence. The change is up to you: hardening is read-only.