{"id":14976937,"url":"https://github.com/juliusbairaktaris/harden-windows-ssh","last_synced_at":"2025-10-27T21:31:56.681Z","repository":{"id":225782686,"uuid":"766271318","full_name":"JuliusBairaktaris/Harden-Windows-SSH","owner":"JuliusBairaktaris","description":"Harden the OpenSSH implementation in Windows 10/11 with the help of methods from Positron Security","archived":false,"fork":false,"pushed_at":"2024-04-18T16:13:07.000Z","size":471,"stargazers_count":14,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-02-01T08:51:15.462Z","etag":null,"topics":["1st-party-security","encryption","enterprise-security","harden","operation-system-security","ssh","ssh-client","ssh-server","windows","windows11"],"latest_commit_sha":null,"homepage":"","language":"PowerShell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/JuliusBairaktaris.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-03-02T19:56:10.000Z","updated_at":"2024-12-15T01:49:05.000Z","dependencies_parsed_at":"2024-09-18T20:41:32.607Z","dependency_job_id":null,"html_url":"https://github.com/JuliusBairaktaris/Harden-Windows-SSH","commit_stats":null,"previous_names":["juliusbairaktaris/harden-windows-ssh"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/JuliusBairaktaris%2FHarden-Windows-SSH","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/JuliusBairaktaris%2FHarden-Windows-SSH/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/JuliusBairaktaris%2FHarden-Windows-SSH/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/JuliusBairaktaris%2FHarden-Windows-SSH/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/JuliusBairaktaris","download_url":"https://codeload.github.com/JuliusBairaktaris/Harden-Windows-SSH/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":238561611,"owners_count":19492754,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["1st-party-security","encryption","enterprise-security","harden","operation-system-security","ssh","ssh-client","ssh-server","windows","windows11"],"created_at":"2024-09-24T13:54:42.621Z","updated_at":"2025-10-27T21:31:56.676Z","avatar_url":"https://github.com/JuliusBairaktaris.png","language":"PowerShell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Harden-Windows-SSH\n\nThis repository provides a PowerShell script to harden the OpenSSH client and server configuration on Windows. It makes your SSH connections more secure by disabling outdated algorithms and enabling modern, more secure options, including post-quantum cryptography for recent OpenSSH versions.\n\nThe script is designed to be:\n\n- **Modular:** The SSH configurations are stored in external `ssh_config` and `sshd_config` files, making them easy to view and customize.\n- **Intelligent:** It automatically detects your OpenSSH version and applies the most secure settings your client can support. This means you get the benefits of post-quantum cryptography on newer versions without breaking older clients.\n- **Secure:** The hardening measures are based on recommendations from [SSH-Audit](https://www.sshaudit.com/) and the latest best practices in SSH security.\n\n## How it Works\n\nThe `ConfigureOpenSSH.ps1` script performs the following actions:\n\n1. **Reads Base Configuration:** It reads the baseline hardened configurations from the `ssh_config` and `sshd_config` files in this repository.\n2. **Detects SSH Version:** It checks your system's OpenSSH version.\n3. **Applies Modern Features (Conditionally):** Based on your SSH version, it dynamically adds advanced security features:\n    - **Post-Quantum Key Exchange:** For OpenSSH 9.0+, it adds `sntrup761x25519-sha512@openssh.com`. For 9.9+, it adds `mlkem768x25519-sha256`.\n    - **Weak Crypto Warning:** For OpenSSH 10.1+, it adds `WarnWeakCrypto no` to the client configuration.\n4. **Applies Configuration:** It applies the generated configuration to your system's OpenSSH client and/or server.\n\n## How to Use\n\nExecute the following command in PowerShell to run the script:\n\n```powershell\nirm 'https://raw.githubusercontent.com/JuliusBairaktaris/Harden-Windows-SSH/main/ConfigureOpenSSH.ps1' | iex\n```\n\nThe script will guide you through the process of hardening your OpenSSH client and/or server.\n\n## Customization\n\nYou can easily customize the SSH configurations by editing the `ssh_config` and `sshd_config` files in this repository before running the script. If you have forked this repository, you can modify the files in your fork and the script will use your customized versions.\n\nThe base configuration applied by the script is as follows:\n\n```\n# ssh_config and sshd_config base\nKexAlgorithms curve25519-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256\nCiphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\nMACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com\nHostKeyAlgorithms sk-ssh-ed25519-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256\n```\n\n## Install the Latest OpenSSH Version\n\nTo take full advantage of the latest security features, it is strongly recommended to upgrade to the latest version of OpenSSH for Windows using winget.\n\n```\nwinget install Microsoft.OpenSSH.Preview\n```\n\nTo check your current OpenSSH version, run:\n\n```\nssh -V\n```\n\n## Security Scores using [SSH-Audit](https://www.sshaudit.com/)\n\nDefault OpenSSH v8.X Configuration:\n\u003cimg src=\"https://github.com/JuliusBairaktaris/Harden-Windows-SSH/blob/main/Images/Default_OpenSSHv8.png\" alt=\"Default Windows OpenSSH v8 Client Score\"\u003e\n\nHardened OpenSSH v8.X Client Configuration:\n\u003cimg src=\"https://github.com/JuliusBairaktaris/Harden-Windows-SSH/blob/main/Images/Hardened_OpenSSHv8.png\" alt=\"Hardend Windows OpenSSH v8 Client Score\"\u003e\n\nDefault OpenSSH v8.X Server Configuration:\n\u003cimg src=\"https://github.com/JuliusBairaktaris/Harden-Windows-SSH/blob/main/Images/Default_OpenSSHv8_Server.png\" alt=\"Default Windows OpenSSH v8 Server Score\"\u003e\n\nHardened OpenSSH v8.X Server Configuration:\n\u003cimg src=\"https://github.com/JuliusBairaktaris/Harden-Windows-SSH/blob/main/Images/Hardened_OpenSSHv8_Server.png\" alt=\"Hardend Windows OpenSSH v8 Server Score\"\u003e\n\n## Further Hardening\n\nFor comprehensive security hardening of your Windows system, check out the excellent [Harden-Windows-Security](https://github.com/HotCakeX/Harden-Windows-Security) module.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjuliusbairaktaris%2Fharden-windows-ssh","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjuliusbairaktaris%2Fharden-windows-ssh","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjuliusbairaktaris%2Fharden-windows-ssh/lists"}