- up to 4.5p1

[packages/openssh.git] / opensshd.conf

diff --git a/opensshd.conf b/opensshd.conf
index 181725aeff1dc80e355630f93bebf0ee8795ed5b..b39904f11a52cf59b07cf983513656d9de72ed41 100644 (file)
--- a/opensshd.conf
+++ b/opensshd.conf
@@ -1,36 +1,99 @@
-# This is ssh server systemwide configuration file.
+# This is the sshd server system-wide configuration file.  See
+# sshd_config(5) for more information.
+
+# The strategy used for options in the default sshd_config shipped with
+# OpenSSH is to specify options with their default value where
+# possible, but leave them commented.  Uncommented options change a
+# default value.
 
 Port 22
-### For IPv6 
-# ListenAddress ::
-ListenAddress 0.0.0.0
-HostKey /etc/ssh/ssh_host_key
-#RandomSeed /etc/ssh/ssh_random_seed
+Protocol 2
+#Protocol 2,1
+#ListenAddress 0.0.0.0
+#ListenAddress ::
+
+# HostKey for protocol version 1
+#HostKey /etc/ssh/ssh_host_key
+# HostKeys for protocol version 2
+#HostKey /etc/ssh/ssh_host_rsa_key
+#HostKey /etc/ssh/ssh_host_dsa_key
+
+# Lifetime and size of ephemeral version 1 server key
+KeyRegenerationInterval 3600
 ServerKeyBits 768
+
+# Logging
+#obsoletes QuietMode and FascistLogging
+SyslogFacility AUTH
+LogLevel INFO
+
+# Authentication:
+
 LoginGraceTime 600
-#KerberosAuthentication no
-#KerberosOrLocalPasswd yes
-#KerberosTgtPassing yes
-KeyRegenerationInterval 3600
 PermitRootLogin no
-IgnoreRhosts yes
 StrictModes yes
-#QuietMode no
-X11Forwarding yes
+
+RSAAuthentication yes
+#PubkeyAuthentication yes
+#AuthorizedKeysFile    .ssh/authorized_keys
+
+# Don't read the user's ~/.rhosts and ~/.shosts files
+IgnoreRhosts yes
+# For this to work you will also need host keys in /etc/ssh_known_hosts
+RhostsRSAAuthentication no
+# similar for protocol version 2
+#HostbasedAuthentication no
+# Change to yes if you don't trust ~/.ssh/known_hosts for
+# RhostsRSAAuthentication and HostbasedAuthentication
+#IgnoreUserKnownHosts no
+
+# To disable tunneled clear text passwords, change to no here!
+PasswordAuthentication yes
+PermitEmptyPasswords no
+
+# Change to no to disable s/key passwords
+#ChallengeResponseAuthentication yes
+
+# Kerberos options
+#KerberosAuthentication no
+#KerberosOrLocalPasswd yes
+#KerberosTicketCleanup yes
+
+#AFSTokenPassing no
+
+# Kerberos TGT Passing only works with the AFS kaserver
+#KerberosTgtPassing no
+
+# Set this to 'yes' to enable PAM authentication (via challenge-response)
+# and session processing. Depending on your PAM configuration, this may
+# bypass the setting of 'PasswordAuthentication'
+UsePAM yes
+
+# Set this to 'yes' to enable support for chrooted user environment.
+# You must create such environment before you can use this feature.
+#UseChroot yes
+
+X11Forwarding no
 X11DisplayOffset 10
-#FascistLogging no
+X11UseLocalhost yes
 PrintMotd yes
+#PrintLastLog yes
 KeepAlive yes
-SyslogFacility DAEMON
-RhostsAuthentication no
-RhostsRSAAuthentication yes
-RSAAuthentication yes
-PasswordAuthentication yes
-PermitEmptyPasswords yes
-UseLogin yes
-CheckMail yes
-# PidFile /u/zappa/.ssh/pid
-# AllowHosts *.our.com friend.other.com
-# DenyHosts lowsecurity.theirs.com *.evil.org evil.org
-# Umask 022
-# SilentDeny yes
+UseLogin no
+
+# enabling this can cause some problems with for example pam_limit
+UsePrivilegeSeparation no
+
+#Compression yes
+
+#MaxStartups 10
+# no default banner path
+#Banner /some/path
+#VerifyReverseMapping no
+
+# override default of no subsystems
+Subsystem      sftp    /usr/lib/openssh/sftp-server
+
+# Security advisory:
+# http://securitytracker.com/alerts/2004/Sep/1011143.html
+AllowTcpForwarding no