So I'm putting together a jump box that will be fairly hardened. Here's my plan:
- Small set of users (2-3)
- Cannot SSH in as Root (must have console access)
- Cannot SSH in as wheel members (must have console access)
- Non-wheel users cannot su to another name
- Keys are required along with long password and OTP to get into system
- Kerberos tickers are required to SSH to other systems from the jump box.
- Fail2ban (or similar) enabled
- Higher SSH port (just to mitigate spam bots for logging)
- Possibly port knocking
- Will meet SCAP requirements.
Key exchange will be curve25519-sha256 or diffie-hellman-group-exchange-sha256
Ciphers - chacha20-poly1305, aes256-gcm, aes128-gcm, aes256-ctr, aes192-ctr, aes128-ctr
MACs - hmac-sha2-512-etm, hmac-sha2-256-etm, hmac-ripemd160-etm, umac-128-etm, hmac-sha2-512, hmac-sha2-256, hmac-ripemd160, umac-128
Any other ideas?