123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180 |
- # $OpenBSD: sshd_config,v 1.90 2013/05/16 04:09:14 dtucker Exp $
- # This is the sshd server system-wide configuration file. See
- # sshd_config(5) for more information.
- # This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin
- # The strategy used for options in the default sshd_config shipped with
- # OpenSSH is to specify options with their default value where
- # possible, but leave them commented. Uncommented options change a
- # default value.
- <% unless (s=scope.lookupvar('sshd::head_additional_options')).empty? -%>
- <%= s %>
- <% end -%>
- # If you want to change the port on a SELinux system, you have to tell
- # SELinux about this change.
- # semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
- #
- <% scope.lookupvar('sshd::ports').to_a.each do |port| -%>
- <% if port == 'off' -%>
- #Port -- disabled by puppet
- <% else -%>
- Port <%= port %>
- <% end -%>
- <% end -%>
- <% scope.lookupvar('sshd::listen_address').to_a.each do |address| -%>
- ListenAddress <%= address %>
- <% end -%>
- # The default requires explicit activation of protocol 1
- #Protocol 2
- # HostKey for protocol version 1
- #HostKey /etc/ssh/ssh_host_key
- # HostKeys for protocol version 2
- HostKey /etc/ssh/ssh_host_rsa_key
- #HostKey /etc/ssh/ssh_host_dsa_key
- HostKey /etc/ssh/ssh_host_ecdsa_key
- # Lifetime and size of ephemeral version 1 server key
- #KeyRegenerationInterval 1h
- #ServerKeyBits 1024
- # Ciphers and keying
- #RekeyLimit default none
- # Logging
- # obsoletes QuietMode and FascistLogging
- #SyslogFacility AUTH
- SyslogFacility AUTHPRIV
- #LogLevel INFO
- # Authentication:
- #LoginGraceTime 2m
- PermitRootLogin <%= scope.lookupvar('sshd::permit_root_login') %>
- StrictModes <%= scope.lookupvar('sshd::strict_modes') %>
- #MaxAuthTries 6
- #MaxSessions 10
- RSAAuthentication <%= scope.lookupvar('sshd::rsa_authentication') %>
- PubkeyAuthentication <%= scope.lookupvar('sshd::pubkey_authentication') %>
- AuthorizedKeysFile <%= scope.lookupvar('sshd::authorized_keys_file') %>
- #AuthorizedPrincipalsFile none
- #AuthorizedKeysCommand none
- #AuthorizedKeysCommandRunAs nobody
- # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
- RhostsRSAAuthentication <%= scope.lookupvar('sshd::rhosts_rsa_authentication') %>
- # similar for protocol version 2
- HostbasedAuthentication <%= scope.lookupvar('sshd::hostbased_authentication') %>
- # Change to yes if you don't trust ~/.ssh/known_hosts for
- # RhostsRSAAuthentication and HostbasedAuthentication
- #IgnoreUserKnownHosts no
- # Don't read the user's ~/.rhosts and ~/.shosts files
- IgnoreRhosts <%= scope.lookupvar('sshd::ignore_rhosts') %>
- # To disable tunneled clear text passwords, change to no here!
- PasswordAuthentication <%= scope.lookupvar('sshd::password_authentication') %>
- # To enable empty passwords, change to yes (NOT RECOMMENDED)
- PermitEmptyPasswords <%= scope.lookupvar('sshd::permit_empty_passwords') %>
- # Change to no to disable s/key passwords
- ChallengeResponseAuthentication <%= scope.lookupvar('sshd::challenge_response_authentication') %>
- # Kerberos options
- #KerberosAuthentication no
- #KerberosOrLocalPasswd yes
- #KerberosTicketCleanup yes
- #KerberosGetAFSToken no
- #KerberosUseKuserok yes
- # GSSAPI options
- GSSAPIAuthentication no
- GSSAPICleanupCredentials yes
- #GSSAPIStrictAcceptorCheck yes
- #GSSAPIKeyExchange no
- # Set this to 'yes' to enable PAM authentication, account processing,
- # and session processing. If this is enabled, PAM authentication will
- # be allowed through the ChallengeResponseAuthentication and
- # PasswordAuthentication. Depending on your PAM configuration,
- # PAM authentication via ChallengeResponseAuthentication may bypass
- # the setting of "PermitRootLogin without-password".
- # If you just want the PAM account and session checks to run without
- # PAM authentication, then enable this but set PasswordAuthentication
- # and ChallengeResponseAuthentication to 'no'.
- # WARNING: 'UsePAM no' is not supported in Red Hat Enterprise Linux and may cause several
- # problems.
- #UsePAM no
- UsePAM <%= scope.lookupvar('sshd::use_pam') %>
- #AllowAgentForwarding yes
- AllowTcpForwarding <%= scope.lookupvar('sshd::tcp_forwarding') %>
- #GatewayPorts no
- #X11Forwarding no
- X11Forwarding <%= scope.lookupvar('sshd::x11_forwarding') %>
- #X11DisplayOffset 10
- #X11UseLocalhost yes
- PrintMotd <%= scope.lookupvar('sshd::print_motd') %>
- #PrintLastLog yes
- #TCPKeepAlive yes
- #UseLogin no
- UsePrivilegeSeparation sandbox # Default for new installations.
- #PermitUserEnvironment no
- #Compression delayed
- #ClientAliveInterval 0
- #ClientAliveCountMax 3
- #ShowPatchLevel no
- #UseDNS yes
- #PidFile /var/run/sshd.pid
- #MaxStartups 10:30:100
- #PermitTunnel no
- #ChrootDirectory none
- #VersionAddendum none
- # no default banner path
- #Banner none
- # Accept locale-related environment variables
- AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
- AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
- AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
- AcceptEnv XMODIFIERS
- # override default of no subsystems
- Subsystem sftp <%= (s=scope.lookupvar('sshd::sftp_subsystem')).empty? ? '/usr/libexec/openssh/sftp-server' : s %>
- <% unless (s=scope.lookupvar('sshd::allowed_users')).empty? -%>
- AllowUsers <%= s %>
- <% end -%>
- <% unless (s=scope.lookupvar('sshd::allowed_groups')).empty? -%>
- AllowGroups <%= s %>
- <%- end -%>
- # Uncomment this if you want to use .local domain
- #Host *.local
- # CheckHostIP no
- <% if scope.lookupvar('sshd::hardened_ssl') == 'yes' -%>
- Ciphers aes256-ctr
- MACs hmac-sha1
- <% end -%>
- # Example of overriding settings on a per-user basis
- #Match User anoncvs
- # X11Forwarding no
- # AllowTcpForwarding no
- # ForceCommand cvs server
- <% unless (s=scope.lookupvar('sshd::tail_additional_options')).empty? -%>
- <%= s %>
- <% end -%>
|