Sshbastion

ref

• https://aws.amazon.com/blogs/security/how-to-record-ssh-sessions-established-through-a-bastion-host/

sshd basic

• make sure ssh root is cert only or disabled
• PermitRootLogin prohibit-password
• AllowTcpForwarding no
• X11Forwarding no
• Only allow certain group to ssh
• AllowGroups sshusers

proc

Make sure users can't see other users processes:

• proc /proc proc defaults,hidepid=2 0 0