Damien Miller | d27b947 | 2005-12-13 19:29:02 +1100 | [diff] [blame] | 1 | # $OpenBSD: sshd_config,v 1.73 2005/12/06 22:38:28 reyk Exp $ |
Tim Rice | 59ea0a0 | 2001-03-10 13:50:45 -0800 | [diff] [blame] | 2 | |
Ben Lindstrom | 9721e92 | 2002-06-21 01:06:03 +0000 | [diff] [blame] | 3 | # This is the sshd server system-wide configuration file. See |
| 4 | # sshd_config(5) for more information. |
Damien Miller | d4a8b7e | 1999-10-27 13:42:43 +1000 | [diff] [blame] | 5 | |
Tim Rice | 1e2c600 | 2002-01-30 22:14:03 -0800 | [diff] [blame] | 6 | # This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin |
| 7 | |
Damien Miller | 95ca7e9 | 2002-02-19 15:29:02 +1100 | [diff] [blame] | 8 | # The strategy used for options in the default sshd_config shipped with |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 9 | # OpenSSH is to specify options with their default value where |
| 10 | # possible, but leave them commented. Uncommented options change a |
| 11 | # default value. |
| 12 | |
| 13 | #Port 22 |
Damien Miller | 8bb73be | 2000-04-19 16:26:12 +1000 | [diff] [blame] | 14 | #Protocol 2,1 |
Darren Tucker | 0f38323 | 2005-01-20 10:57:56 +1100 | [diff] [blame] | 15 | #AddressFamily any |
Kevin Steves | 8ee4f69 | 2001-01-09 15:28:46 +0000 | [diff] [blame] | 16 | #ListenAddress 0.0.0.0 |
Damien Miller | 34132e5 | 2000-01-14 15:45:46 +1100 | [diff] [blame] | 17 | #ListenAddress :: |
Ben Lindstrom | c4b7225 | 2001-06-09 01:09:51 +0000 | [diff] [blame] | 18 | |
| 19 | # HostKey for protocol version 1 |
Damien Miller | 05eda43 | 2002-02-10 18:32:28 +1100 | [diff] [blame] | 20 | #HostKey /etc/ssh/ssh_host_key |
Ben Lindstrom | c4b7225 | 2001-06-09 01:09:51 +0000 | [diff] [blame] | 21 | # HostKeys for protocol version 2 |
Damien Miller | 05eda43 | 2002-02-10 18:32:28 +1100 | [diff] [blame] | 22 | #HostKey /etc/ssh/ssh_host_rsa_key |
| 23 | #HostKey /etc/ssh/ssh_host_dsa_key |
Ben Lindstrom | c4b7225 | 2001-06-09 01:09:51 +0000 | [diff] [blame] | 24 | |
| 25 | # Lifetime and size of ephemeral version 1 server key |
Darren Tucker | b8dae8e | 2003-06-22 20:48:45 +1000 | [diff] [blame] | 26 | #KeyRegenerationInterval 1h |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 27 | #ServerKeyBits 768 |
Damien Miller | 192bd01 | 1999-11-13 23:56:35 +1100 | [diff] [blame] | 28 | |
Damien Miller | 886c63a | 2000-01-20 23:13:36 +1100 | [diff] [blame] | 29 | # Logging |
Damien Miller | 06b75ad | 2005-05-26 12:12:37 +1000 | [diff] [blame] | 30 | # obsoletes QuietMode and FascistLogging |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 31 | #SyslogFacility AUTH |
| 32 | #LogLevel INFO |
Damien Miller | 9ba3024 | 1999-11-11 21:07:00 +1100 | [diff] [blame] | 33 | |
Ben Lindstrom | c4b7225 | 2001-06-09 01:09:51 +0000 | [diff] [blame] | 34 | # Authentication: |
| 35 | |
Darren Tucker | b8dae8e | 2003-06-22 20:48:45 +1000 | [diff] [blame] | 36 | #LoginGraceTime 2m |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 37 | #PermitRootLogin yes |
| 38 | #StrictModes yes |
Darren Tucker | 89413db | 2004-05-24 10:36:23 +1000 | [diff] [blame] | 39 | #MaxAuthTries 6 |
Ben Lindstrom | c4b7225 | 2001-06-09 01:09:51 +0000 | [diff] [blame] | 40 | |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 41 | #RSAAuthentication yes |
| 42 | #PubkeyAuthentication yes |
| 43 | #AuthorizedKeysFile .ssh/authorized_keys |
Damien Miller | d4a8b7e | 1999-10-27 13:42:43 +1000 | [diff] [blame] | 44 | |
Damien Miller | 05eda43 | 2002-02-10 18:32:28 +1100 | [diff] [blame] | 45 | # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 46 | #RhostsRSAAuthentication no |
Ben Lindstrom | c4b7225 | 2001-06-09 01:09:51 +0000 | [diff] [blame] | 47 | # similar for protocol version 2 |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 48 | #HostbasedAuthentication no |
| 49 | # Change to yes if you don't trust ~/.ssh/known_hosts for |
| 50 | # RhostsRSAAuthentication and HostbasedAuthentication |
| 51 | #IgnoreUserKnownHosts no |
Darren Tucker | ec960f2 | 2003-08-13 20:37:05 +1000 | [diff] [blame] | 52 | # Don't read the user's ~/.rhosts and ~/.shosts files |
| 53 | #IgnoreRhosts yes |
Ben Lindstrom | c4b7225 | 2001-06-09 01:09:51 +0000 | [diff] [blame] | 54 | |
Damien Miller | d4a8b7e | 1999-10-27 13:42:43 +1000 | [diff] [blame] | 55 | # To disable tunneled clear text passwords, change to no here! |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 56 | #PasswordAuthentication yes |
| 57 | #PermitEmptyPasswords no |
Damien Miller | 3380426 | 2001-02-04 23:20:18 +1100 | [diff] [blame] | 58 | |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 59 | # Change to no to disable s/key passwords |
| 60 | #ChallengeResponseAuthentication yes |
Damien Miller | f815442 | 2001-04-25 22:44:14 +1000 | [diff] [blame] | 61 | |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 62 | # Kerberos options |
Damien Miller | d7de14b | 2002-04-23 21:04:51 +1000 | [diff] [blame] | 63 | #KerberosAuthentication no |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 64 | #KerberosOrLocalPasswd yes |
| 65 | #KerberosTicketCleanup yes |
Darren Tucker | 22ef508 | 2003-12-31 11:37:34 +1100 | [diff] [blame] | 66 | #KerberosGetAFSToken no |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 67 | |
Darren Tucker | 0efd155 | 2003-08-26 11:49:55 +1000 | [diff] [blame] | 68 | # GSSAPI options |
| 69 | #GSSAPIAuthentication no |
Darren Tucker | a49d36e | 2003-10-02 16:20:54 +1000 | [diff] [blame] | 70 | #GSSAPICleanupCredentials yes |
Darren Tucker | 0efd155 | 2003-08-26 11:49:55 +1000 | [diff] [blame] | 71 | |
Damien Miller | 701d051 | 2004-05-23 11:47:58 +1000 | [diff] [blame] | 72 | # Set this to 'yes' to enable PAM authentication, account processing, |
| 73 | # and session processing. If this is enabled, PAM authentication will |
Darren Tucker | a4904f7 | 2006-02-23 21:35:30 +1100 | [diff] [blame] | 74 | # be allowed through the ChallengeResponseAuthentication and |
| 75 | # PasswordAuthentication. Depending on your PAM configuration, |
| 76 | # PAM authentication via ChallengeResponseAuthentication may bypass |
| 77 | # the setting of "PermitRootLogin without-password". |
| 78 | # If you just want the PAM account and session checks to run without |
| 79 | # PAM authentication, then enable this but set PasswordAuthentication |
| 80 | # and ChallengeResponseAuthentication to 'no'. |
Tim Rice | d4d1815 | 2003-09-25 19:04:34 -0700 | [diff] [blame] | 81 | #UsePAM no |
Damien Miller | d4a8b7e | 1999-10-27 13:42:43 +1000 | [diff] [blame] | 82 | |
Darren Tucker | b8dae8e | 2003-06-22 20:48:45 +1000 | [diff] [blame] | 83 | #AllowTcpForwarding yes |
| 84 | #GatewayPorts no |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 85 | #X11Forwarding no |
| 86 | #X11DisplayOffset 10 |
Damien Miller | 95c249f | 2002-02-05 12:11:34 +1100 | [diff] [blame] | 87 | #X11UseLocalhost yes |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 88 | #PrintMotd yes |
| 89 | #PrintLastLog yes |
Darren Tucker | 0b3b975 | 2003-12-31 11:38:32 +1100 | [diff] [blame] | 90 | #TCPKeepAlive yes |
Damien Miller | c30d35c | 2000-08-30 09:40:09 +1100 | [diff] [blame] | 91 | #UseLogin no |
Ben Lindstrom | fb62a69 | 2002-06-06 19:47:11 +0000 | [diff] [blame] | 92 | #UsePrivilegeSeparation yes |
Ben Lindstrom | 5d860f0 | 2002-08-01 01:28:38 +0000 | [diff] [blame] | 93 | #PermitUserEnvironment no |
Damien Miller | 9786e6e | 2005-07-26 21:54:56 +1000 | [diff] [blame] | 94 | #Compression delayed |
Darren Tucker | b8dae8e | 2003-06-22 20:48:45 +1000 | [diff] [blame] | 95 | #ClientAliveInterval 0 |
| 96 | #ClientAliveCountMax 3 |
| 97 | #UseDNS yes |
| 98 | #PidFile /var/run/sshd.pid |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 99 | #MaxStartups 10 |
Damien Miller | d27b947 | 2005-12-13 19:29:02 +1100 | [diff] [blame] | 100 | #PermitTunnel no |
Darren Tucker | b8dae8e | 2003-06-22 20:48:45 +1000 | [diff] [blame] | 101 | |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 102 | # no default banner path |
| 103 | #Banner /some/path |
Ben Lindstrom | e9d0444 | 2001-02-10 23:26:35 +0000 | [diff] [blame] | 104 | |
Damien Miller | 2bec5c1 | 2002-01-22 23:32:07 +1100 | [diff] [blame] | 105 | # override default of no subsystems |
Ben Lindstrom | e9d0444 | 2001-02-10 23:26:35 +0000 | [diff] [blame] | 106 | Subsystem sftp /usr/libexec/sftp-server |