1 |
misc |
11 |
# $OpenBSD: sshd_config,v 1.81 2009/10/08 14:03:41 markus Exp $ |
2 |
|
|
|
3 |
|
|
# This is the sshd server system-wide configuration file. See |
4 |
|
|
# sshd_config(5) for more information. |
5 |
|
|
|
6 |
|
|
# This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin |
7 |
|
|
|
8 |
|
|
# The strategy used for options in the default sshd_config shipped with |
9 |
|
|
# OpenSSH is to specify options with their default value where |
10 |
|
|
# possible, but leave them commented. Uncommented options change a |
11 |
|
|
# default value. |
12 |
|
|
|
13 |
|
|
#Port 22 |
14 |
|
|
#AddressFamily any |
15 |
|
|
#ListenAddress 0.0.0.0 |
16 |
|
|
#ListenAddress :: |
17 |
|
|
|
18 |
|
|
# The default requires explicit activation of protocol 1 |
19 |
|
|
#Protocol 2 |
20 |
|
|
|
21 |
|
|
# HostKey for protocol version 1 |
22 |
|
|
HostKey /etc/ssh/ssh_host_key |
23 |
|
|
# HostKeys for protocol version 2 |
24 |
|
|
HostKey /etc/ssh/ssh_host_rsa_key |
25 |
|
|
HostKey /etc/ssh/ssh_host_dsa_key |
26 |
|
|
|
27 |
|
|
# Lifetime and size of ephemeral version 1 server key |
28 |
|
|
#KeyRegenerationInterval 1h |
29 |
|
|
#ServerKeyBits 1024 |
30 |
|
|
|
31 |
|
|
# Logging |
32 |
|
|
# obsoletes QuietMode and FascistLogging |
33 |
|
|
#SyslogFacility AUTH |
34 |
|
|
#LogLevel INFO |
35 |
|
|
|
36 |
|
|
# Authentication: |
37 |
|
|
|
38 |
|
|
#LoginGraceTime 2m |
39 |
|
|
PermitRootLogin without-password |
40 |
|
|
#StrictModes yes |
41 |
|
|
#MaxAuthTries 6 |
42 |
|
|
#MaxSessions 10 |
43 |
|
|
|
44 |
|
|
#RSAAuthentication yes |
45 |
|
|
#PubkeyAuthentication yes |
46 |
|
|
#AuthorizedKeysFile .ssh/authorized_keys |
47 |
|
|
|
48 |
misc |
436 |
|
49 |
misc |
11 |
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts |
50 |
|
|
#RhostsRSAAuthentication no |
51 |
|
|
# similar for protocol version 2 |
52 |
|
|
#HostbasedAuthentication no |
53 |
|
|
# Change to yes if you don't trust ~/.ssh/known_hosts for |
54 |
|
|
# RhostsRSAAuthentication and HostbasedAuthentication |
55 |
|
|
#IgnoreUserKnownHosts no |
56 |
|
|
# Don't read the user's ~/.rhosts and ~/.shosts files |
57 |
|
|
#IgnoreRhosts yes |
58 |
|
|
|
59 |
|
|
# To disable tunneled clear text passwords, change to no here! |
60 |
|
|
#PasswordAuthentication yes |
61 |
|
|
#PermitEmptyPasswords no |
62 |
|
|
|
63 |
|
|
# Change to no to disable s/key passwords |
64 |
|
|
#ChallengeResponseAuthentication yes |
65 |
|
|
|
66 |
|
|
# Kerberos options |
67 |
|
|
#KerberosAuthentication no |
68 |
|
|
#KerberosOrLocalPasswd yes |
69 |
|
|
#KerberosTicketCleanup yes |
70 |
|
|
#KerberosGetAFSToken no |
71 |
|
|
|
72 |
|
|
# GSSAPI options |
73 |
|
|
#GSSAPIAuthentication no |
74 |
|
|
#GSSAPICleanupCredentials yes |
75 |
|
|
|
76 |
|
|
# Set this to 'yes' to enable PAM authentication, account processing, |
77 |
|
|
# and session processing. If this is enabled, PAM authentication will |
78 |
|
|
# be allowed through the ChallengeResponseAuthentication and |
79 |
|
|
# PasswordAuthentication. Depending on your PAM configuration, |
80 |
|
|
# PAM authentication via ChallengeResponseAuthentication may bypass |
81 |
|
|
# the setting of "PermitRootLogin without-password". |
82 |
|
|
# If you just want the PAM account and session checks to run without |
83 |
|
|
# PAM authentication, then enable this but set PasswordAuthentication |
84 |
|
|
# and ChallengeResponseAuthentication to 'no'. |
85 |
misc |
407 |
UsePAM yes |
86 |
misc |
11 |
|
87 |
|
|
# Accept locale-related environment variables |
88 |
|
|
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES |
89 |
|
|
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT |
90 |
|
|
AcceptEnv LC_IDENTIFICATION LC_ALL |
91 |
|
|
|
92 |
|
|
#AllowAgentForwarding yes |
93 |
misc |
694 |
AllowTcpForwarding no |
94 |
misc |
11 |
#GatewayPorts no |
95 |
|
|
X11Forwarding yes |
96 |
|
|
#X11DisplayOffset 10 |
97 |
|
|
#X11UseLocalhost yes |
98 |
|
|
#PrintMotd yes |
99 |
|
|
#PrintLastLog yes |
100 |
|
|
#TCPKeepAlive yes |
101 |
|
|
#UseLogin no |
102 |
|
|
UsePrivilegeSeparation yes |
103 |
|
|
#PermitUserEnvironment no |
104 |
|
|
#Compression delayed |
105 |
|
|
#ClientAliveInterval 0 |
106 |
|
|
#ClientAliveCountMax 3 |
107 |
|
|
#UseDNS yes |
108 |
|
|
#PidFile /var/run/sshd.pid |
109 |
|
|
#MaxStartups 10 |
110 |
|
|
#PermitTunnel no |
111 |
|
|
#ChrootDirectory none |
112 |
|
|
|
113 |
|
|
# no default banner path |
114 |
|
|
#Banner none |
115 |
|
|
|
116 |
|
|
# override default of no subsystems |
117 |
|
|
Subsystem sftp <%= path_to_sftp %>/sftp-server |
118 |
|
|
|
119 |
|
|
# Example of overriding settings on a per-user basis |
120 |
|
|
#Match User anoncvs |
121 |
|
|
# X11Forwarding no |
122 |
|
|
# AllowTcpForwarding no |
123 |
|
|
# ForceCommand cvs server |