The following is the GNU All-permissive License as recommended in

Copyright (C) 2024 Free Software Foundation

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved. This file is offered as-is, without any warranty.

Contributions are welcome. See

key fingerprints

To print the md5 fingerprint of a public key:

ssh-keygen -E md5 -l -f /tmp/
2048 MD5:a2:09:53:76:73:9d:bf:ef:fd:e9:91:05:f1:46:27:25 foo@bar (RSA)

ssh jump

This is similar to and simpler than manually setting up SSH tunneling.

To ssh into tarantula via valis (the office router):

ssh -J

To ssh into tarantula via valis then via

ssh -J,

ssh tunneling

To ssh into a machine via an ssh tunnel:

ssh -L

ssh localhost -p 2201


# place this in ~/.ssh/config
  ProxyCommand ssh -W %h:%p

ssh tunneling is more secure than agent forwarding, because keys are not copied to the intermediary host.


The ssh config is located at /etc/ssh/sshd_config


AllowUsers would be helpful during a fencepost upgrade.

Edit /etc/ssh/sshd_config.

vim /etc/ssh/sshd_config

Add a line:

AllowUsers root andrew iank johns michael ruben

Test the config:

sshd -t

Reload the config:

systemctl reload sshd

After that only those users would be allowed to login. I am not sure if anyone would be kicked off, but I am less concerned about that.

Once the upgrade completes, we would comment out the AllowUsers line, test, and reload again.

Hardening SSH

Audit with

git clone
cd ssh-audit

You can add a list of servers to a file and run ssh-audit on the list.

python3 -T servers.txt

Tor onion service

From Ludovic

"Protip: when installing a server, install #Tor on it and have its SSH port accessible as an onion service. That way, if you mess up with network config, you might still be able to access the onion service.

(Really! It’s saved me a few times already.)"

Connecting to older SSH servers

To connect to nessus, you can use the following:

ssh -oKexAlgorithms=+diffie-hellman-group1-sha1

Or add the following to your ~/.ssh/config file

    KexAlgorithms +diffie-hellman-group1-sha1