Attachment #2172 for bug #1846

View | Details | Raw Unified | Return to bug 1846 | Differences between
Collapse All | Expand All




#	$OpenBSD: sshd_config,v 1.86 2012/04/12 02:43:55 djm Exp $
#
#       This is the sshd server system-wide configuration file. See
#       sshd_config(5) for more information.
#
#       This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
#       The strategy used for options in the default sshd_config
#       shipped with OpenSSH is to specify options with their default
#       value where possible, but leave them commented. Uncommented
#       options change a default value.

############################################################################
#       General
############################################################################

#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

#	The default requires explicit activation of protocol 1
#Protocol 2

#	HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key

#	HostKeys for protocol version 2
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key

#	Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 1h
#ServerKeyBits 1024

############################################################################
#       Logging
############################################################################

#	obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
#LogLevel INFO

############################################################################
#       Authentication
############################################################################

#LoginGraceTime 2m
#PermitRootLogin yes

#RSAAuthentication yes
#PubkeyAuthentication yes

#	The default is to check both .ssh/authorized_keys and
#	.ssh/authorized_keys2 but this is overridden so installations
#	will only check .ssh/authorized_keys
AuthorizedKeysFile	.ssh/authorized_keys

#AuthorizedPrincipalsFile none

#	For this to work you will also need host keys in
#	/etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no

#	similar for protocol version 2
#HostbasedAuthentication no

#	Change to yes if you don't trust ~/.ssh/known_hosts for
#	RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no

#	Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

#	To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no

#	Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes

#	Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

#	GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

############################################################################
#       Miscellaneous
############################################################################

#     Set this to 'yes' to enable PAM authentication, account processing,
#     and session processing. If this is enabled, PAM authentication will
#     be allowed through the ChallengeResponseAuthentication and
#     PasswordAuthentication.  Depending on your PAM configuration,
#     PAM authentication via ChallengeResponseAuthentication may bypass
#     the setting of "PermitRootLogin without-password".
#     If you just want the PAM account and session checks to run without
#     PAM authentication, then enable this but set PasswordAuthentication
#     and ChallengeResponseAuthentication to 'no'.
#UsePAM no

#AllowAgentForwarding yes

#ChrootDirectory none
#VersionAddendum none

#       No default banner path
#Banner none

#       Override default of no subsystems
Subsystem sftp /usr/libexec/sftp-server

############################################################################
#       Examples
############################################################################

#       Example of overriding settings on a per-user basis

# Example of overriding settings on a per-user basis
#Match User anoncvs
#       X11Forwarding no
#       AllowTcpForwarding no
#       ForceCommand cvs server

#       Example of permitting root login only from local LAN

#Match Address 192.168.1.0/26
#      PermitRootLogin yes

# End of file
- 

Return to bug 1846

Lines 1-40 Link Here

(-)a/sshd_config (-45 / +74 lines)
1	# $OpenBSD: sshd_config,v 1.86 2012/04/12 02:43:55 djm Exp $	1	# $OpenBSD: sshd_config,v 1.86 2012/04/12 02:43:55 djm Exp $
2		2	#
3	# This is the sshd server system-wide configuration file. See	3	# This is the sshd server system-wide configuration file. See
4	# sshd_config(5) for more information.	4	# sshd_config(5) for more information.
5		5	#
6	# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin	6	# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
7		7	# The strategy used for options in the default sshd_config
8	# The strategy used for options in the default sshd_config shipped with	8	# shipped with OpenSSH is to specify options with their default
9	# OpenSSH is to specify options with their default value where	9	# value where possible, but leave them commented. Uncommented
10	# possible, but leave them commented. Uncommented options override the	10	# options change a default value.
11	# default value.	11
		12	############################################################################
		13	# General
		14	############################################################################
12		15
13	#Port 22	16	#Port 22
14	#AddressFamily any	17	#AddressFamily any
15	#ListenAddress 0.0.0.0	18	#ListenAddress 0.0.0.0
16	#ListenAddress ::	19	#ListenAddress ::
17		20
18	# The default requires explicit activation of protocol 1	21	# The default requires explicit activation of protocol 1
19	#Protocol 2	22	#Protocol 2
20		23
21	# HostKey for protocol version 1	24	# HostKey for protocol version 1
22	#HostKey /etc/ssh/ssh_host_key	25	#HostKey /etc/ssh/ssh_host_key
23	# HostKeys for protocol version 2	26
		27	# HostKeys for protocol version 2
24	#HostKey /etc/ssh/ssh_host_rsa_key	28	#HostKey /etc/ssh/ssh_host_rsa_key
25	#HostKey /etc/ssh/ssh_host_dsa_key	29	#HostKey /etc/ssh/ssh_host_dsa_key
26	#HostKey /etc/ssh/ssh_host_ecdsa_key	30	#HostKey /etc/ssh/ssh_host_ecdsa_key
27		31
28	# Lifetime and size of ephemeral version 1 server key	32	# Lifetime and size of ephemeral version 1 server key
29	#KeyRegenerationInterval 1h	33	#KeyRegenerationInterval 1h
30	#ServerKeyBits 1024	34	#ServerKeyBits 1024
31		35
32	# Logging	36	############################################################################
33	# obsoletes QuietMode and FascistLogging	37	# Logging
		38	############################################################################
		39
		40	# obsoletes QuietMode and FascistLogging
34	#SyslogFacility AUTH	41	#SyslogFacility AUTH
35	#LogLevel INFO	42	#LogLevel INFO
36		43
37	# Authentication:	44	############################################################################
		45	# Authentication
		46	############################################################################
38		47
39	#LoginGraceTime 2m	48	#LoginGraceTime 2m
40	#PermitRootLogin yes	49	#PermitRootLogin yes
Lines 45-92 Link Here
45	#RSAAuthentication yes	54	#RSAAuthentication yes
46	#PubkeyAuthentication yes	55	#PubkeyAuthentication yes
47		56
48	# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2	57	# The default is to check both .ssh/authorized_keys and
49	# but this is overridden so installations will only check .ssh/authorized_keys	58	# .ssh/authorized_keys2 but this is overridden so installations
		59	# will only check .ssh/authorized_keys
50	AuthorizedKeysFile .ssh/authorized_keys	60	AuthorizedKeysFile .ssh/authorized_keys
51		61
52	#AuthorizedPrincipalsFile none	62	#AuthorizedPrincipalsFile none
53		63
54	# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts	64	# For this to work you will also need host keys in
		65	# /etc/ssh/ssh_known_hosts
55	#RhostsRSAAuthentication no	66	#RhostsRSAAuthentication no
56	# similar for protocol version 2	67
		68	# similar for protocol version 2
57	#HostbasedAuthentication no	69	#HostbasedAuthentication no
58	# Change to yes if you don't trust ~/.ssh/known_hosts for	70
59	# RhostsRSAAuthentication and HostbasedAuthentication	71	# Change to yes if you don't trust ~/.ssh/known_hosts for
		72	# RhostsRSAAuthentication and HostbasedAuthentication
60	#IgnoreUserKnownHosts no	73	#IgnoreUserKnownHosts no
61	# Don't read the user's ~/.rhosts and ~/.shosts files	74
		75	# Don't read the user's ~/.rhosts and ~/.shosts files
62	#IgnoreRhosts yes	76	#IgnoreRhosts yes
63		77
64	# To disable tunneled clear text passwords, change to no here!	78	# To disable tunneled clear text passwords, change to no here!
65	#PasswordAuthentication yes	79	#PasswordAuthentication yes
66	#PermitEmptyPasswords no	80	#PermitEmptyPasswords no
67		81
68	# Change to no to disable s/key passwords	82	# Change to no to disable s/key passwords
69	#ChallengeResponseAuthentication yes	83	#ChallengeResponseAuthentication yes
70		84
71	# Kerberos options	85	# Kerberos options
72	#KerberosAuthentication no	86	#KerberosAuthentication no
73	#KerberosOrLocalPasswd yes	87	#KerberosOrLocalPasswd yes
74	#KerberosTicketCleanup yes	88	#KerberosTicketCleanup yes
75	#KerberosGetAFSToken no	89	#KerberosGetAFSToken no
76		90
77	# GSSAPI options	91	# GSSAPI options
78	#GSSAPIAuthentication no	92	#GSSAPIAuthentication no
79	#GSSAPICleanupCredentials yes	93	#GSSAPICleanupCredentials yes
80		94
81	# Set this to 'yes' to enable PAM authentication, account processing,	95	############################################################################
82	# and session processing. If this is enabled, PAM authentication will	96	# Miscellaneous
83	# be allowed through the ChallengeResponseAuthentication and	97	############################################################################
84	# PasswordAuthentication. Depending on your PAM configuration,	98
85	# PAM authentication via ChallengeResponseAuthentication may bypass	99	# Set this to 'yes' to enable PAM authentication, account processing,
86	# the setting of "PermitRootLogin without-password".	100	# and session processing. If this is enabled, PAM authentication will
87	# If you just want the PAM account and session checks to run without	101	# be allowed through the ChallengeResponseAuthentication and
88	# PAM authentication, then enable this but set PasswordAuthentication	102	# PasswordAuthentication. Depending on your PAM configuration,
89	# and ChallengeResponseAuthentication to 'no'.	103	# PAM authentication via ChallengeResponseAuthentication may bypass
		104	# the setting of "PermitRootLogin without-password".
		105	# If you just want the PAM account and session checks to run without
		106	# PAM authentication, then enable this but set PasswordAuthentication
		107	# and ChallengeResponseAuthentication to 'no'.
90	#UsePAM no	108	#UsePAM no
91		109
92	#AllowAgentForwarding yes	110	#AllowAgentForwarding yes
Lines 111-124 AuthorizedKeysFile .ssh/authorized_keys Link Here
111	#ChrootDirectory none	129	#ChrootDirectory none
112	#VersionAddendum none	130	#VersionAddendum none
113		131
114	# no default banner path	132	# No default banner path
115	#Banner none	133	#Banner none
116		134
117	# override default of no subsystems	135	# Override default of no subsystems
118	Subsystem sftp /usr/libexec/sftp-server	136	Subsystem sftp /usr/libexec/sftp-server
		137
		138	############################################################################
		139	# Examples
		140	############################################################################
		141
		142	# Example of overriding settings on a per-user basis
119		143
120	# Example of overriding settings on a per-user basis
121	#Match User anoncvs	144	#Match User anoncvs
122	# X11Forwarding no	145	# X11Forwarding no
123	# AllowTcpForwarding no	146	# AllowTcpForwarding no
124	# ForceCommand cvs server	147	# ForceCommand cvs server
		148
		149	# Example of permitting root login only from local LAN
		150
		151	#Match Address 192.168.1.0/26
		152	# PermitRootLogin yes
		153
		154	# End of file
125	-