123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168 |
- # $OpenBSD: sshd_config,v 1.81 2009/10/08 14:03:41 markus Exp $
- # $FreeBSD: src/crypto/openssh/sshd_config,v 1.49.2.2.2.1 2010/06/14 02:09:06 kensmith Exp $
- # This is the sshd server system-wide configuration file. See
- # sshd_config(5) for more information.
- # This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
- # The strategy used for options in the default sshd_config shipped with
- # OpenSSH is to specify options with their default value where
- # possible, but leave them commented. Uncommented options change a
- # default value.
- # Note that some of FreeBSD's defaults differ from OpenBSD's, and
- # FreeBSD has a few additional options.
- #VersionAddendum FreeBSD-20100308
- <% unless (s=scope.lookupvar('sshd::head_additional_options')).empty? -%>
- <%= s %>
- <% end -%>
- # What ports, IPs and protocols we listen for
- <% scope.lookupvar('sshd::ports').to_a.each do |port| -%>
- <% if port == 'off' -%>
- #Port -- disabled by puppet
- <% else -%>
- Port <%= port %>
- <% end -%>
- <% end -%>
- #AddressFamily any
- <% scope.lookupvar('sshd::listen_address').to_a.each do |address| -%>
- ListenAddress <%= address %>
- <% end -%>
- # The default requires explicit activation of protocol 1
- Protocol 2
- # HostKey for protocol version 1
- #HostKey /etc/ssh/ssh_host_key
- # HostKeys for protocol version 2
- <% scope.lookupvar('sshd::hostkey_type').to_a.each do |hostkey_type| -%>
- HostKey /etc/ssh/ssh_host_<%=hostkey_type %>_key
- <% end -%>
- # Lifetime and size of ephemeral version 1 server key
- #KeyRegenerationInterval 1h
- #ServerKeyBits 1024
- # Logging
- # obsoletes QuietMode and FascistLogging
- SyslogFacility AUTH
- LogLevel INFO
- # Authentication:
- LoginGraceTime 600
- PermitRootLogin <%= scope.lookupvar('sshd::permit_root_login') %>
- StrictModes <%= scope.lookupvar('sshd::strict_modes') %>
- #MaxAuthTries 6
- #MaxSessions 10
- RSAAuthentication <%= scope.lookupvar('sshd::rsa_authentication') %>
- PubkeyAuthentication <%= scope.lookupvar('sshd::pubkey_authentication') %>
- AuthorizedKeysFile <%= scope.lookupvar('sshd::authorized_keys_file') %>
- # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
- RhostsRSAAuthentication <%= scope.lookupvar('sshd::rhosts_rsa_authentication') %>
- # similar for protocol version 2
- HostbasedAuthentication <%= scope.lookupvar('sshd::hostbased_authentication') %>
- # Change to yes if you don't trust ~/.ssh/known_hosts for
- # RhostsRSAAuthentication and HostbasedAuthentication
- #IgnoreUserKnownHosts no
- # Don't read the user's ~/.rhosts and ~/.shosts files
- #IgnoreRhosts yes
- # Change to yes to enable built-in password authentication.
- PasswordAuthentication <%= scope.lookupvar('sshd::password_authentication') %>
- PermitEmptyPasswords <%= scope.lookupvar('sshd::permit_empty_passwords') %>
- # Change to no to disable PAM authentication
- ChallengeResponseAuthentication <%= scope.lookupvar('sshd::challenge_response_authentication') %>
- # Kerberos options
- KerberosAuthentication <%= scope.lookupvar('sshd::kerberos_authentication') %>
- KerberosOrLocalPasswd <%= scope.lookupvar('sshd::kerberos_orlocalpasswd') %>
- KerberosTicketCleanup <%= scope.lookupvar('sshd::kerberos_ticketcleanup') %>
- # GSSAPI options
- GSSAPIAuthentication <%= scope.lookupvar('sshd::gssapi_authentication') %>
- GSSAPICleanupCredentials <%= scope.lookupvar('sshd::gssapi_cleanupcredentials') %>
- # Set this to 'no' to disable PAM authentication, account processing,
- # and session processing. If this is enabled, PAM authentication will
- # be allowed through the ChallengeResponseAuthentication and
- # PasswordAuthentication. Depending on your PAM configuration,
- # PAM authentication via ChallengeResponseAuthentication may bypass
- # the setting of "PermitRootLogin without-password".
- # If you just want the PAM account and session checks to run without
- # PAM authentication, then enable this but set PasswordAuthentication
- # and ChallengeResponseAuthentication to 'no'.
- UsePAM <%= scope.lookupvar('sshd::use_pam') %>
- AllowAgentForwarding <%= scope.lookupvar('sshd::agent_forwarding') %>
- AllowTcpForwarding <%= scope.lookupvar('sshd::tcp_forwarding') %>
- #GatewayPorts no
- X11Forwarding <%= scope.lookupvar('sshd::x11_forwarding') %>
- X11DisplayOffset 10
- #X11UseLocalhost yes
- PrintMotd <%= sshd_print_motd %>
- #PrintLastLog yes
- TCPKeepAlive yes
- #UseLogin no
- #UsePrivilegeSeparation yes
- #PermitUserEnvironment no
- #Compression delayed
- #ClientAliveInterval 0
- #ClientAliveCountMax 3
- #UseDNS yes
- #PidFile /var/run/sshd.pid
- #MaxStartups 10
- #PermitTunnel no
- #ChrootDirectory none
- # no default banner path
- #Banner none
- # override default of no subsystems
- Subsystem sftp <%= (s=scope.lookupvar('sshd::sftp_subsystem')).empty? ? '/usr/libexec/sftp-server' : s %>
- # Example of overriding settings on a per-user basis
- #Match User anoncvs
- # X11Forwarding no
- # AllowTcpForwarding no
- # ForceCommand cvs server
- <% unless (s=scope.lookupvar('sshd::allowed_users')).empty? -%>
- AllowUsers <%= s %>
- <% end -%>
- <% unless (s=scope.lookupvar('sshd::allowed_groups')).empty? -%>
- AllowGroups <%= s %>
- <%- end -%>
- <% if scope.lookupvar('sshd::hardened') == 'yes' -%>
- <% if (scope.function_versioncmp([scope.lookupvar('::ssh_version'),'6.5'])) >= 0 -%>
- KexAlgorithms curve25519-sha256@libssh.org
- Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
- MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com
- <% else -%>
- Ciphers aes256-ctr
- MACs hmac-sha1
- <% end -%>
- <% end -%>
- <% unless (s=scope.lookupvar('sshd::tail_additional_options')).empty? -%>
- <%= s %>
- <% end -%>
|