Damien Miller | ff9d6c2 | 2013-09-14 09:48:55 +1000 | [diff] [blame] | 1 | # $OpenBSD: sshd_config,v 1.91 2013/09/07 13:53:11 sthen Exp $ |
Tim Rice | 59ea0a0 | 2001-03-10 13:50:45 -0800 | [diff] [blame] | 2 | |
Ben Lindstrom | 9721e92 | 2002-06-21 01:06:03 +0000 | [diff] [blame] | 3 | # This is the sshd server system-wide configuration file. See |
| 4 | # sshd_config(5) for more information. |
Damien Miller | d4a8b7e | 1999-10-27 13:42:43 +1000 | [diff] [blame] | 5 | |
Tim Rice | 1e2c600 | 2002-01-30 22:14:03 -0800 | [diff] [blame] | 6 | # This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin |
| 7 | |
Damien Miller | 95ca7e9 | 2002-02-19 15:29:02 +1100 | [diff] [blame] | 8 | # The strategy used for options in the default sshd_config shipped with |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 9 | # OpenSSH is to specify options with their default value where |
Damien Miller | fd53abd | 2011-05-15 08:36:02 +1000 | [diff] [blame] | 10 | # possible, but leave them commented. Uncommented options override the |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 11 | # default value. |
| 12 | |
| 13 | #Port 22 |
Darren Tucker | 0f38323 | 2005-01-20 10:57:56 +1100 | [diff] [blame] | 14 | #AddressFamily any |
Kevin Steves | 8ee4f69 | 2001-01-09 15:28:46 +0000 | [diff] [blame] | 15 | #ListenAddress 0.0.0.0 |
Damien Miller | 34132e5 | 2000-01-14 15:45:46 +1100 | [diff] [blame] | 16 | #ListenAddress :: |
Ben Lindstrom | c4b7225 | 2001-06-09 01:09:51 +0000 | [diff] [blame] | 17 | |
Darren Tucker | bad5076 | 2009-10-11 21:51:08 +1100 | [diff] [blame] | 18 | # The default requires explicit activation of protocol 1 |
| 19 | #Protocol 2 |
Darren Tucker | 506ed88 | 2007-03-21 20:42:24 +1100 | [diff] [blame] | 20 | |
Ben Lindstrom | c4b7225 | 2001-06-09 01:09:51 +0000 | [diff] [blame] | 21 | # HostKey for protocol version 1 |
Damien Miller | 05eda43 | 2002-02-10 18:32:28 +1100 | [diff] [blame] | 22 | #HostKey /etc/ssh/ssh_host_key |
Ben Lindstrom | c4b7225 | 2001-06-09 01:09:51 +0000 | [diff] [blame] | 23 | # HostKeys for protocol version 2 |
Damien Miller | 05eda43 | 2002-02-10 18:32:28 +1100 | [diff] [blame] | 24 | #HostKey /etc/ssh/ssh_host_rsa_key |
| 25 | #HostKey /etc/ssh/ssh_host_dsa_key |
Damien Miller | 80ed82a | 2010-09-10 11:20:11 +1000 | [diff] [blame] | 26 | #HostKey /etc/ssh/ssh_host_ecdsa_key |
Ben Lindstrom | c4b7225 | 2001-06-09 01:09:51 +0000 | [diff] [blame] | 27 | |
| 28 | # Lifetime and size of ephemeral version 1 server key |
Darren Tucker | b8dae8e | 2003-06-22 20:48:45 +1000 | [diff] [blame] | 29 | #KeyRegenerationInterval 1h |
Darren Tucker | 7499b0c | 2008-07-02 22:35:43 +1000 | [diff] [blame] | 30 | #ServerKeyBits 1024 |
Damien Miller | 192bd01 | 1999-11-13 23:56:35 +1100 | [diff] [blame] | 31 | |
Darren Tucker | 5f96f3b | 2013-05-16 20:29:28 +1000 | [diff] [blame] | 32 | # Ciphers and keying |
| 33 | #RekeyLimit default none |
| 34 | |
Damien Miller | 886c63a | 2000-01-20 23:13:36 +1100 | [diff] [blame] | 35 | # Logging |
Damien Miller | 06b75ad | 2005-05-26 12:12:37 +1000 | [diff] [blame] | 36 | # obsoletes QuietMode and FascistLogging |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 37 | #SyslogFacility AUTH |
| 38 | #LogLevel INFO |
Damien Miller | 9ba3024 | 1999-11-11 21:07:00 +1100 | [diff] [blame] | 39 | |
Ben Lindstrom | c4b7225 | 2001-06-09 01:09:51 +0000 | [diff] [blame] | 40 | # Authentication: |
| 41 | |
Darren Tucker | b8dae8e | 2003-06-22 20:48:45 +1000 | [diff] [blame] | 42 | #LoginGraceTime 2m |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 43 | #PermitRootLogin yes |
| 44 | #StrictModes yes |
Darren Tucker | 89413db | 2004-05-24 10:36:23 +1000 | [diff] [blame] | 45 | #MaxAuthTries 6 |
Damien Miller | 7207f64 | 2008-05-19 15:34:50 +1000 | [diff] [blame] | 46 | #MaxSessions 10 |
Ben Lindstrom | c4b7225 | 2001-06-09 01:09:51 +0000 | [diff] [blame] | 47 | |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 48 | #RSAAuthentication yes |
| 49 | #PubkeyAuthentication yes |
Damien Miller | d8478b6 | 2011-05-29 21:39:36 +1000 | [diff] [blame] | 50 | |
| 51 | # The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2 |
| 52 | # but this is overridden so installations will only check .ssh/authorized_keys |
| 53 | AuthorizedKeysFile .ssh/authorized_keys |
Damien Miller | d4a8b7e | 1999-10-27 13:42:43 +1000 | [diff] [blame] | 54 | |
Damien Miller | 8fef9eb | 2012-04-22 11:25:10 +1000 | [diff] [blame] | 55 | #AuthorizedPrincipalsFile none |
| 56 | |
Damien Miller | 09d3e12 | 2012-10-31 08:58:58 +1100 | [diff] [blame] | 57 | #AuthorizedKeysCommand none |
| 58 | #AuthorizedKeysCommandUser nobody |
| 59 | |
Damien Miller | 05eda43 | 2002-02-10 18:32:28 +1100 | [diff] [blame] | 60 | # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 61 | #RhostsRSAAuthentication no |
Ben Lindstrom | c4b7225 | 2001-06-09 01:09:51 +0000 | [diff] [blame] | 62 | # similar for protocol version 2 |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 63 | #HostbasedAuthentication no |
| 64 | # Change to yes if you don't trust ~/.ssh/known_hosts for |
| 65 | # RhostsRSAAuthentication and HostbasedAuthentication |
| 66 | #IgnoreUserKnownHosts no |
Darren Tucker | ec960f2 | 2003-08-13 20:37:05 +1000 | [diff] [blame] | 67 | # Don't read the user's ~/.rhosts and ~/.shosts files |
| 68 | #IgnoreRhosts yes |
Ben Lindstrom | c4b7225 | 2001-06-09 01:09:51 +0000 | [diff] [blame] | 69 | |
Damien Miller | d4a8b7e | 1999-10-27 13:42:43 +1000 | [diff] [blame] | 70 | # To disable tunneled clear text passwords, change to no here! |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 71 | #PasswordAuthentication yes |
| 72 | #PermitEmptyPasswords no |
Damien Miller | 3380426 | 2001-02-04 23:20:18 +1100 | [diff] [blame] | 73 | |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 74 | # Change to no to disable s/key passwords |
| 75 | #ChallengeResponseAuthentication yes |
Damien Miller | f815442 | 2001-04-25 22:44:14 +1000 | [diff] [blame] | 76 | |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 77 | # Kerberos options |
Damien Miller | d7de14b | 2002-04-23 21:04:51 +1000 | [diff] [blame] | 78 | #KerberosAuthentication no |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 79 | #KerberosOrLocalPasswd yes |
| 80 | #KerberosTicketCleanup yes |
Darren Tucker | 22ef508 | 2003-12-31 11:37:34 +1100 | [diff] [blame] | 81 | #KerberosGetAFSToken no |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 82 | |
Darren Tucker | 0efd155 | 2003-08-26 11:49:55 +1000 | [diff] [blame] | 83 | # GSSAPI options |
| 84 | #GSSAPIAuthentication no |
Darren Tucker | a49d36e | 2003-10-02 16:20:54 +1000 | [diff] [blame] | 85 | #GSSAPICleanupCredentials yes |
Darren Tucker | 0efd155 | 2003-08-26 11:49:55 +1000 | [diff] [blame] | 86 | |
Darren Tucker | e90a06a | 2013-09-18 15:09:38 +1000 | [diff] [blame] | 87 | # Set this to 'yes' to enable PAM authentication, account processing, |
| 88 | # and session processing. If this is enabled, PAM authentication will |
Darren Tucker | a4904f7 | 2006-02-23 21:35:30 +1100 | [diff] [blame] | 89 | # be allowed through the ChallengeResponseAuthentication and |
| 90 | # PasswordAuthentication. Depending on your PAM configuration, |
| 91 | # PAM authentication via ChallengeResponseAuthentication may bypass |
| 92 | # the setting of "PermitRootLogin without-password". |
| 93 | # If you just want the PAM account and session checks to run without |
| 94 | # PAM authentication, then enable this but set PasswordAuthentication |
| 95 | # and ChallengeResponseAuthentication to 'no'. |
Tim Rice | d4d1815 | 2003-09-25 19:04:34 -0700 | [diff] [blame] | 96 | #UsePAM no |
Damien Miller | d4a8b7e | 1999-10-27 13:42:43 +1000 | [diff] [blame] | 97 | |
Damien Miller | ba3a659 | 2008-05-19 14:58:22 +1000 | [diff] [blame] | 98 | #AllowAgentForwarding yes |
Darren Tucker | b8dae8e | 2003-06-22 20:48:45 +1000 | [diff] [blame] | 99 | #AllowTcpForwarding yes |
| 100 | #GatewayPorts no |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 101 | #X11Forwarding no |
| 102 | #X11DisplayOffset 10 |
Damien Miller | 95c249f | 2002-02-05 12:11:34 +1100 | [diff] [blame] | 103 | #X11UseLocalhost yes |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 104 | #PrintMotd yes |
| 105 | #PrintLastLog yes |
Darren Tucker | 0b3b975 | 2003-12-31 11:38:32 +1100 | [diff] [blame] | 106 | #TCPKeepAlive yes |
Damien Miller | c30d35c | 2000-08-30 09:40:09 +1100 | [diff] [blame] | 107 | #UseLogin no |
Damien Miller | 5a5c2b9 | 2012-07-31 12:21:34 +1000 | [diff] [blame] | 108 | UsePrivilegeSeparation sandbox # Default for new installations. |
Ben Lindstrom | 5d860f0 | 2002-08-01 01:28:38 +0000 | [diff] [blame] | 109 | #PermitUserEnvironment no |
Damien Miller | 9786e6e | 2005-07-26 21:54:56 +1000 | [diff] [blame] | 110 | #Compression delayed |
Darren Tucker | b8dae8e | 2003-06-22 20:48:45 +1000 | [diff] [blame] | 111 | #ClientAliveInterval 0 |
| 112 | #ClientAliveCountMax 3 |
| 113 | #UseDNS yes |
| 114 | #PidFile /var/run/sshd.pid |
Damien Miller | 1f583df | 2013-02-12 11:02:08 +1100 | [diff] [blame] | 115 | #MaxStartups 10:30:100 |
Damien Miller | d27b947 | 2005-12-13 19:29:02 +1100 | [diff] [blame] | 116 | #PermitTunnel no |
Damien Miller | d8cb1f1 | 2008-02-10 22:40:12 +1100 | [diff] [blame] | 117 | #ChrootDirectory none |
Damien Miller | 2352881 | 2012-04-22 11:24:43 +1000 | [diff] [blame] | 118 | #VersionAddendum none |
Darren Tucker | b8dae8e | 2003-06-22 20:48:45 +1000 | [diff] [blame] | 119 | |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 120 | # no default banner path |
Damien Miller | 4890e53 | 2007-09-17 11:57:38 +1000 | [diff] [blame] | 121 | #Banner none |
Ben Lindstrom | e9d0444 | 2001-02-10 23:26:35 +0000 | [diff] [blame] | 122 | |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 123 | # override default of no subsystems |
Ben Lindstrom | e9d0444 | 2001-02-10 23:26:35 +0000 | [diff] [blame] | 124 | Subsystem sftp /usr/libexec/sftp-server |
Damien Miller | e275443 | 2006-07-24 14:06:47 +1000 | [diff] [blame] | 125 | |
| 126 | # Example of overriding settings on a per-user basis |
| 127 | #Match User anoncvs |
| 128 | # X11Forwarding no |
| 129 | # AllowTcpForwarding no |
| 130 | # ForceCommand cvs server |