Securing SSH

Question

I'm posting this to help others who might not be familiar with securing ssh, something that I can't recommend strongly enough, for any platform (OS X, BSD & other unix variants & offshoots such as linux).
Keep in mind that with OS X Server , ssh is enabled by default and you should secure it sooner rather than later.
I strongly recommend that you use vi (or emacs) as your editor (via the Terminal).
Observe what the existing permissions are and be sure you preserve them.
If you must work in the GUI, then I suggest TextWrangler (or buy their excellent BBEdit software - TextEdit is free)
http://www.barebones.com/products/textwrangler/index.shtml
There are a number of existing tutorials on this subject, but few are specific to OS X.
http://www.google.com/search?client=safari&rls=en-us&q=securing+ssh
To start, I recommend you read the following articles for how to setup ssh passwordless public-private key login:
http://www.afp548.com/article.php?story=20040816224717742
see also (in this context), _ONLY, "Create authentication keys_" in:
http://www.bombich.com/mactips/rsync.html
Do use DSA keys, not RSA
You can explore Mike Bombich' excellent discussion of limiting ssh commands but please, *ignore that* for now if you're not already comfortable with the material. I'm trying to save you unnecessary pain.
If your server is public-facing, then it will help stem the brunt of any bots knocking at your server.
For changing the port correctly in OS X, see:
http://www.macosxhints.com/article.php?story=20050707140439980
I also recommend limiting what IP addresses or address ranges can connect to your (custom) ssh port at the firewall. If you don't have a static IP at your remote location, you can use "whois" in the terminal on your IP address and gather info on the IP ranges your ISP owns. Keep in mind that they may have several other groups of IP addresses, you don't want to lock yourself out inadvertently.
Finally, edit /etc/sshd_config , make sure to back it up first !
So then, edit /etc/sshd_config
IF you use a DSA key-type (and unless you know you need RSA keys for some unlikely reason),
change:
Protocol 1,2
to:
Protocol 2
Look for the line ( _no actual quotation-marks ! _, have to do that to keep this forum from converting the "#" to a number):
"# To disable tunneled clear text passwords, change to no here!"
and set the next two lines to:
PasswordAuthentication no
PermitEmptyPasswords no
You can also add after that:
AllowUsers usershortname
for example (and what I do), where usershortname is the short name of a non-admin account. is Then once you've connected (at that point, securely via ssh) then:
su admin-name
whatever the name of your admin account is.

Answer 1

the tcp-wrappers hosts.allow and .deny is , if I recall correctly, not enabled by default in 10.4
Also *PLEASE NOTE*, to finally, fully disable password logins,
please also change in /etc/ssdh_config
from - again no actual quotation marks:
"#UsePAM yes"
to:
UsePAM no