tightening sshd, removing server identification banner

[Per Hedeland]

On 2020-02-17 18:02, Valeri Galtsev wrote:
 >
 >
 >> On Feb 17, 2020, at 10:58 AM, Özgür Kazancci <ozgur at kazancci.com> wrote:
 >>
 >> Hello David,
 >>
 >> If you're sure you uncommented these lines,
 >> #VersionAddendum none
 >> #Banner none
 >>
 >
 > As far as I know, uncommenting lines in sshd_config is unnecessary. These are put there as commented lines to indicate defaults which sshd was build with, so they are already in effect. That is why 
good practice is when changing something to keep commented line as it is, and add next to it yours not commented different setting.

Agreed, but changing the commented value without uncommenting does
(obviously) not have any effect. The default sshd_config in
12.1-RELEASE has

#VersionAddendum FreeBSD-20180909

#Banner none

I.e. an uncommented

VersionAddendum none

is needed to remove the above text.

 > Valeri
 >
 >> and restarted the sshd, then there is no much else left -imho-. A complete removal of SSHD banner (if that's what you're trying to do) requires a manual edit of OpenSSH(d) files&complete 
complication of it from scratch.

I think the "SSH-2.0" part should be considered mandatory, it's part
of the protocol.

--Per

 >> Best,
 >> Özgür.
 >>
 >>
 >>
 >>
 >> On 17/02/2020 19:53, David Mehler wrote:
 >>> Hello,
 >>> I'm running FreeBSD 12.0. I'm atempting to tighten up my sshd
 >>> configuration. I've got things where I want them, except for the
 >>> connecting banner. I'm using sshaudit.com to test things and this is
 >>> what it's saying for the banner setting:
 >>> Banner:SSH-2.0-OpenSSH_7.8 FreeBSD-20180909
 >>> I would rather this be set to nothing or at most very minimal. Google
 >>> and the sshd_config man page reveals the Banner and VersionAdendum
 >>> options. I've set both to none.
 >>> PrintMotd no
 >>> #PrintLastLog yes
 >>> #VersionAddendum none
 >>> #Banner none
 >>> Can anyone tell me how to get the results I am looking for?
 >>> Thanks.
 >>> Dave.
 >>> _______________________________________________
 >>> freebsd-questions at freebsd.org mailing list
 >>> https://lists.freebsd.org/mailman/listinfo/freebsd-questions
 >>> To unsubscribe, send any mail to "freebsd-questions-unsubscribe at freebsd.org"
 >> _______________________________________________
 >> freebsd-questions at freebsd.org mailing list
 >> https://lists.freebsd.org/mailman/listinfo/freebsd-questions
 >> To unsubscribe, send any mail to "freebsd-questions-unsubscribe at freebsd.org"
 >
 > ++++++++++++++++++++++++++++++++++++++++
 > Valeri Galtsev
 > Sr System Administrator
 > Department of Astronomy and Astrophysics
 > Kavli Institute for Cosmological Physics
 > University of Chicago
 > Phone: 773-702-4247
 > ++++++++++++++++++++++++++++++++++++++++
 >
 > _______________________________________________
 > freebsd-questions at freebsd.org mailing list
 > https://lists.freebsd.org/mailman/listinfo/freebsd-questions
 > To unsubscribe, send any mail to "freebsd-questions-unsubscribe at freebsd.org"
 >