Attachment 2037 Details for Bug 1895 – Improve sshd_config layout

[patch] Improve sshd_config layout

0001-sshd_config-Reformat-configuration-in-sections.patch (text/plain), 6.91 KB, created by Jari Aalto on 2011-05-01 01:14:06 AEST

(hide)

Description:

Filename:

MIME Type:

Creator: Jari Aalto

Created: 2011-05-01 01:14:06 AEST

Size: 6.91 KB

patch

obsolete

>From 3f8fdb953739ae5cbab4f3ffdd73c3be14829042 Mon Sep 17 00:00:00 2001
>From: Jari Aalto <jari.aalto@cante.net>
>Date: Tue, 21 Dec 2010 14:52:55 +0200
>Subject: [PATCH] sshd_config: Reformat configuration in sections.
>Organization: Private
>Content-Type: text/plain; charset="utf-8"
>Content-Transfer-Encoding: 8bit
>
>Add section breaks to help finding visual cues. Indent standard text
>to column 8 (position of tab) and leave configuration examples to the left.
>Add new example: how to restrict root login only inside local LAN.
>
>Signed-off-by: Jari Aalto <jari.aalto@cante.net>
>---
> sshd_config |  120 ++++++++++++++++++++++++++++++++++++-----------------------
> 1 files changed, 73 insertions(+), 47 deletions(-)
>
>diff --git a/sshd_config b/sshd_config
>index 4534841..b8a4c07 100644
>--- a/sshd_config
>+++ b/sshd_config
>@@ -1,87 +1,103 @@
>-#	$OpenBSD: sshd_config,v 1.82 2010/09/06 17:10:19 naddy Exp $
>-
>-# This is the sshd server system-wide configuration file.  See
>-# sshd_config(5) for more information.
>-
>-# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
>-
>-# The strategy used for options in the default sshd_config shipped with
>-# OpenSSH is to specify options with their default value where
>-# possible, but leave them commented.  Uncommented options change a
>-# default value.
>-
>-#Port 22
>+#       $OpenBSD: sshd_config,v 1.82 2010/09/06 17:10:19 naddy Exp $
>+#
>+#       This is the sshd server system-wide configuration file. See
>+#       sshd_config(5) for more information.
>+#
>+#       This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
>+#       The strategy used for options in the default sshd_config
>+#       shipped with OpenSSH is to specify options with their default
>+#       value where possible, but leave them commented. Uncommented
>+#       options change a default value.
>+
>+############################################################################
>+#       General
>+############################################################################
>+
>+#       Port 22
> #AddressFamily any
> #ListenAddress 0.0.0.0
> #ListenAddress ::
> 
>-# The default requires explicit activation of protocol 1
>+#       The default requires explicit activation of protocol 1
> #Protocol 2
> 
>-# HostKey for protocol version 1
>+#       HostKey for protocol version 1
> #HostKey /etc/ssh/ssh_host_key
>-# HostKeys for protocol version 2
>+
>+#       HostKeys for protocol version 2
> #HostKey /etc/ssh/ssh_host_rsa_key
> #HostKey /etc/ssh/ssh_host_dsa_key
> #HostKey /etc/ssh/ssh_host_ecdsa_key
> 
>-# Lifetime and size of ephemeral version 1 server key
>+#       Lifetime and size of ephemeral version 1 server key
> #KeyRegenerationInterval 1h
> #ServerKeyBits 1024
> 
>-# Logging
>-# obsoletes QuietMode and FascistLogging
>+############################################################################
>+#       Logging
>+############################################################################
>+
>+#       obsoletes QuietMode and FascistLogging
> #SyslogFacility AUTH
> #LogLevel INFO
> 
>-# Authentication:
>+############################################################################
>+#       Authentication
>+############################################################################
> 
> #LoginGraceTime 2m
> #PermitRootLogin yes
> #StrictModes yes
> #MaxAuthTries 6
> #MaxSessions 10
>-
> #RSAAuthentication yes
> #PubkeyAuthentication yes
>-#AuthorizedKeysFile	.ssh/authorized_keys
>+#AuthorizedKeysFile     .ssh/authorized_keys
> 
>-# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
>+#       For this to work you will also need host keys in
>+#       /etc/ssh/ssh_known_hosts
> #RhostsRSAAuthentication no
>-# similar for protocol version 2
>+
>+#       similar for protocol version 2
> #HostbasedAuthentication no
>-# Change to yes if you don't trust ~/.ssh/known_hosts for
>-# RhostsRSAAuthentication and HostbasedAuthentication
>+
>+#       Change to yes if you don't trust ~/.ssh/known_hosts for
>+#       RhostsRSAAuthentication and HostbasedAuthentication
> #IgnoreUserKnownHosts no
>-# Don't read the user's ~/.rhosts and ~/.shosts files
>+
>+#       Don't read the user's ~/.rhosts and ~/.shosts files
> #IgnoreRhosts yes
> 
>-# To disable tunneled clear text passwords, change to no here!
>+#       To disable tunneled clear text passwords, change to no here!
> #PasswordAuthentication yes
> #PermitEmptyPasswords no
> 
>-# Change to no to disable s/key passwords
>+#       Change to no to disable s/key passwords
> #ChallengeResponseAuthentication yes
> 
>-# Kerberos options
>+#       Kerberos options
> #KerberosAuthentication no
> #KerberosOrLocalPasswd yes
> #KerberosTicketCleanup yes
> #KerberosGetAFSToken no
> 
>-# GSSAPI options
>+#       GSSAPI options
> #GSSAPIAuthentication no
> #GSSAPICleanupCredentials yes
> 
>-# Set this to 'yes' to enable PAM authentication, account processing, 
>-# and session processing. If this is enabled, PAM authentication will 
>-# be allowed through the ChallengeResponseAuthentication and
>-# PasswordAuthentication.  Depending on your PAM configuration,
>-# PAM authentication via ChallengeResponseAuthentication may bypass
>-# the setting of "PermitRootLogin without-password".
>-# If you just want the PAM account and session checks to run without
>-# PAM authentication, then enable this but set PasswordAuthentication
>-# and ChallengeResponseAuthentication to 'no'.
>+############################################################################
>+#       Miscellaneous
>+############################################################################
>+
>+#     Set this to 'yes' to enable PAM authentication, account processing,
>+#     and session processing. If this is enabled, PAM authentication will
>+#     be allowed through the ChallengeResponseAuthentication and
>+#     PasswordAuthentication.  Depending on your PAM configuration,
>+#     PAM authentication via ChallengeResponseAuthentication may bypass
>+#     the setting of "PermitRootLogin without-password".
>+#     If you just want the PAM account and session checks to run without
>+#     PAM authentication, then enable this but set PasswordAuthentication
>+#     and ChallengeResponseAuthentication to 'no'.
> #UsePAM no
> 
> #AllowAgentForwarding yes
>@@ -105,14 +121,24 @@
> #PermitTunnel no
> #ChrootDirectory none
> 
>-# no default banner path
>+#       No default banner path
> #Banner none
> 
>-# override default of no subsystems
>-Subsystem	sftp	/usr/libexec/sftp-server
>+#       Override default of no subsystems
>+Subsystem sftp /usr/libexec/sftp-server
> 
>-# Example of overriding settings on a per-user basis
>+############################################################################
>+#       Examples
>+############################################################################
>+
>+#       Example of overriding settings on a per-user basis
> #Match User anoncvs
>-#	X11Forwarding no
>-#	AllowTcpForwarding no
>-#	ForceCommand cvs server
>+#       X11Forwarding no
>+#       AllowTcpForwarding no
>+#       ForceCommand cvs server
>+
>+#       Example of permitting root login only from local LAN
>+#Match Address 192.168.1.0/26
>+#      PermitRootLogin yes
>+
>+# End of file
>-- 
>1.7.2.3
>

Actions: View | Diff

Attachments on bug 1895: 2037