Damien Miller | d681d26 | 2002-09-27 13:21:57 +1000 | [diff] [blame] | 1 | # $OpenBSD: sshd_config,v 1.59 2002/09/25 11:17:16 markus Exp $ |
Tim Rice | 59ea0a0 | 2001-03-10 13:50:45 -0800 | [diff] [blame] | 2 | |
Ben Lindstrom | 9721e92 | 2002-06-21 01:06:03 +0000 | [diff] [blame] | 3 | # This is the sshd server system-wide configuration file. See |
| 4 | # sshd_config(5) for more information. |
Damien Miller | d4a8b7e | 1999-10-27 13:42:43 +1000 | [diff] [blame] | 5 | |
Tim Rice | 1e2c600 | 2002-01-30 22:14:03 -0800 | [diff] [blame] | 6 | # This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin |
| 7 | |
Damien Miller | 95ca7e9 | 2002-02-19 15:29:02 +1100 | [diff] [blame] | 8 | # The strategy used for options in the default sshd_config shipped with |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 9 | # OpenSSH is to specify options with their default value where |
| 10 | # possible, but leave them commented. Uncommented options change a |
| 11 | # default value. |
| 12 | |
| 13 | #Port 22 |
Damien Miller | 8bb73be | 2000-04-19 16:26:12 +1000 | [diff] [blame] | 14 | #Protocol 2,1 |
Kevin Steves | 8ee4f69 | 2001-01-09 15:28:46 +0000 | [diff] [blame] | 15 | #ListenAddress 0.0.0.0 |
Damien Miller | 34132e5 | 2000-01-14 15:45:46 +1100 | [diff] [blame] | 16 | #ListenAddress :: |
Ben Lindstrom | c4b7225 | 2001-06-09 01:09:51 +0000 | [diff] [blame] | 17 | |
| 18 | # HostKey for protocol version 1 |
Damien Miller | 05eda43 | 2002-02-10 18:32:28 +1100 | [diff] [blame] | 19 | #HostKey /etc/ssh/ssh_host_key |
Ben Lindstrom | c4b7225 | 2001-06-09 01:09:51 +0000 | [diff] [blame] | 20 | # HostKeys for protocol version 2 |
Damien Miller | 05eda43 | 2002-02-10 18:32:28 +1100 | [diff] [blame] | 21 | #HostKey /etc/ssh/ssh_host_rsa_key |
| 22 | #HostKey /etc/ssh/ssh_host_dsa_key |
Ben Lindstrom | c4b7225 | 2001-06-09 01:09:51 +0000 | [diff] [blame] | 23 | |
| 24 | # Lifetime and size of ephemeral version 1 server key |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 25 | #KeyRegenerationInterval 3600 |
| 26 | #ServerKeyBits 768 |
Damien Miller | 192bd01 | 1999-11-13 23:56:35 +1100 | [diff] [blame] | 27 | |
Damien Miller | 886c63a | 2000-01-20 23:13:36 +1100 | [diff] [blame] | 28 | # Logging |
Damien Miller | 886c63a | 2000-01-20 23:13:36 +1100 | [diff] [blame] | 29 | #obsoletes QuietMode and FascistLogging |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 30 | #SyslogFacility AUTH |
| 31 | #LogLevel INFO |
Damien Miller | 9ba3024 | 1999-11-11 21:07:00 +1100 | [diff] [blame] | 32 | |
Ben Lindstrom | c4b7225 | 2001-06-09 01:09:51 +0000 | [diff] [blame] | 33 | # Authentication: |
| 34 | |
Damien Miller | d681d26 | 2002-09-27 13:21:57 +1000 | [diff] [blame] | 35 | #LoginGraceTime 120 |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 36 | #PermitRootLogin yes |
| 37 | #StrictModes yes |
Ben Lindstrom | c4b7225 | 2001-06-09 01:09:51 +0000 | [diff] [blame] | 38 | |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 39 | #RSAAuthentication yes |
| 40 | #PubkeyAuthentication yes |
| 41 | #AuthorizedKeysFile .ssh/authorized_keys |
Damien Miller | d4a8b7e | 1999-10-27 13:42:43 +1000 | [diff] [blame] | 42 | |
Ben Lindstrom | c4b7225 | 2001-06-09 01:09:51 +0000 | [diff] [blame] | 43 | # rhosts authentication should not be used |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 44 | #RhostsAuthentication no |
Ben Lindstrom | c4b7225 | 2001-06-09 01:09:51 +0000 | [diff] [blame] | 45 | # Don't read the user's ~/.rhosts and ~/.shosts files |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 46 | #IgnoreRhosts yes |
Damien Miller | 05eda43 | 2002-02-10 18:32:28 +1100 | [diff] [blame] | 47 | # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 48 | #RhostsRSAAuthentication no |
Ben Lindstrom | c4b7225 | 2001-06-09 01:09:51 +0000 | [diff] [blame] | 49 | # similar for protocol version 2 |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 50 | #HostbasedAuthentication no |
| 51 | # Change to yes if you don't trust ~/.ssh/known_hosts for |
| 52 | # RhostsRSAAuthentication and HostbasedAuthentication |
| 53 | #IgnoreUserKnownHosts no |
Ben Lindstrom | c4b7225 | 2001-06-09 01:09:51 +0000 | [diff] [blame] | 54 | |
Damien Miller | d4a8b7e | 1999-10-27 13:42:43 +1000 | [diff] [blame] | 55 | # To disable tunneled clear text passwords, change to no here! |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 56 | #PasswordAuthentication yes |
| 57 | #PermitEmptyPasswords no |
Damien Miller | 3380426 | 2001-02-04 23:20:18 +1100 | [diff] [blame] | 58 | |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 59 | # Change to no to disable s/key passwords |
| 60 | #ChallengeResponseAuthentication yes |
Damien Miller | f815442 | 2001-04-25 22:44:14 +1000 | [diff] [blame] | 61 | |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 62 | # Kerberos options |
Damien Miller | d7de14b | 2002-04-23 21:04:51 +1000 | [diff] [blame] | 63 | #KerberosAuthentication no |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 64 | #KerberosOrLocalPasswd yes |
| 65 | #KerberosTicketCleanup yes |
| 66 | |
Damien Miller | 7a8558d | 2002-04-23 20:51:15 +1000 | [diff] [blame] | 67 | #AFSTokenPassing no |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 68 | |
| 69 | # Kerberos TGT Passing only works with the AFS kaserver |
| 70 | #KerberosTgtPassing no |
| 71 | |
Damien Miller | 2aa0ab4 | 2003-05-15 12:05:28 +1000 | [diff] [blame] | 72 | # Set this to 'yes' to enable PAM authentication (via challenge-response) |
Damien Miller | e3e7124 | 2003-05-16 12:00:44 +1000 | [diff] [blame] | 73 | # and session processing. Depending on your PAM configuration, this may |
| 74 | # bypass the setting of 'PasswordAuthentication' |
| 75 | #UsePAM yes |
Damien Miller | d4a8b7e | 1999-10-27 13:42:43 +1000 | [diff] [blame] | 76 | |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 77 | #X11Forwarding no |
| 78 | #X11DisplayOffset 10 |
Damien Miller | 95c249f | 2002-02-05 12:11:34 +1100 | [diff] [blame] | 79 | #X11UseLocalhost yes |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 80 | #PrintMotd yes |
| 81 | #PrintLastLog yes |
| 82 | #KeepAlive yes |
Damien Miller | c30d35c | 2000-08-30 09:40:09 +1100 | [diff] [blame] | 83 | #UseLogin no |
Ben Lindstrom | fb62a69 | 2002-06-06 19:47:11 +0000 | [diff] [blame] | 84 | #UsePrivilegeSeparation yes |
Ben Lindstrom | 5d860f0 | 2002-08-01 01:28:38 +0000 | [diff] [blame] | 85 | #PermitUserEnvironment no |
Ben Lindstrom | 1b8d730 | 2002-06-21 01:11:36 +0000 | [diff] [blame] | 86 | #Compression yes |
Damien Miller | f6d9e22 | 2000-06-18 14:50:44 +1000 | [diff] [blame] | 87 | |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 88 | #MaxStartups 10 |
| 89 | # no default banner path |
| 90 | #Banner /some/path |
Damien Miller | c5d8635 | 2002-02-05 12:13:41 +1100 | [diff] [blame] | 91 | #VerifyReverseMapping no |
Ben Lindstrom | e9d0444 | 2001-02-10 23:26:35 +0000 | [diff] [blame] | 92 | |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 93 | # override default of no subsystems |
Ben Lindstrom | e9d0444 | 2001-02-10 23:26:35 +0000 | [diff] [blame] | 94 | Subsystem sftp /usr/libexec/sftp-server |