blob: 9f09e4a6e7dff18b2df42a1558be405990cabd70 [file] [log] [blame]
naddy@openbsd.orgffe65492016-08-15 12:32:04 +00001# $OpenBSD: sshd_config,v 1.100 2016/08/15 12:32:04 naddy Exp $
Tim Rice59ea0a02001-03-10 13:50:45 -08002
Ben Lindstrom9721e922002-06-21 01:06:03 +00003# This is the sshd server system-wide configuration file. See
4# sshd_config(5) for more information.
Damien Millerd4a8b7e1999-10-27 13:42:43 +10005
Tim Rice1e2c6002002-01-30 22:14:03 -08006# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
7
Damien Miller95ca7e92002-02-19 15:29:02 +11008# The strategy used for options in the default sshd_config shipped with
Damien Miller2bec5c12002-01-22 23:32:07 +11009# OpenSSH is to specify options with their default value where
Damien Millerfd53abd2011-05-15 08:36:02 +100010# possible, but leave them commented. Uncommented options override the
Damien Miller2bec5c12002-01-22 23:32:07 +110011# default value.
12
13#Port 22
Darren Tucker0f383232005-01-20 10:57:56 +110014#AddressFamily any
Kevin Steves8ee4f692001-01-09 15:28:46 +000015#ListenAddress 0.0.0.0
Damien Miller34132e52000-01-14 15:45:46 +110016#ListenAddress ::
Ben Lindstromc4b72252001-06-09 01:09:51 +000017
Damien Miller05eda432002-02-10 18:32:28 +110018#HostKey /etc/ssh/ssh_host_rsa_key
19#HostKey /etc/ssh/ssh_host_dsa_key
Damien Miller80ed82a2010-09-10 11:20:11 +100020#HostKey /etc/ssh/ssh_host_ecdsa_key
Damien Milleraf5d4482014-01-12 19:20:47 +110021#HostKey /etc/ssh/ssh_host_ed25519_key
Ben Lindstromc4b72252001-06-09 01:09:51 +000022
Darren Tucker5f96f3b2013-05-16 20:29:28 +100023# Ciphers and keying
24#RekeyLimit default none
25
Damien Miller886c63a2000-01-20 23:13:36 +110026# Logging
Damien Miller2bec5c12002-01-22 23:32:07 +110027#SyslogFacility AUTH
28#LogLevel INFO
Damien Miller9ba30241999-11-11 21:07:00 +110029
Ben Lindstromc4b72252001-06-09 01:09:51 +000030# Authentication:
31
Darren Tuckerb8dae8e2003-06-22 20:48:45 +100032#LoginGraceTime 2m
deraadt@openbsd.org1dc8d932015-08-06 14:53:21 +000033#PermitRootLogin prohibit-password
Damien Miller2bec5c12002-01-22 23:32:07 +110034#StrictModes yes
Darren Tucker89413db2004-05-24 10:36:23 +100035#MaxAuthTries 6
Damien Miller7207f642008-05-19 15:34:50 +100036#MaxSessions 10
Ben Lindstromc4b72252001-06-09 01:09:51 +000037
Damien Miller2bec5c12002-01-22 23:32:07 +110038#PubkeyAuthentication yes
Damien Millerd8478b62011-05-29 21:39:36 +100039
40# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
41# but this is overridden so installations will only check .ssh/authorized_keys
42AuthorizedKeysFile .ssh/authorized_keys
Damien Millerd4a8b7e1999-10-27 13:42:43 +100043
Damien Miller8fef9eb2012-04-22 11:25:10 +100044#AuthorizedPrincipalsFile none
45
Damien Miller09d3e122012-10-31 08:58:58 +110046#AuthorizedKeysCommand none
47#AuthorizedKeysCommandUser nobody
48
Damien Miller05eda432002-02-10 18:32:28 +110049# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
Damien Miller2bec5c12002-01-22 23:32:07 +110050#HostbasedAuthentication no
51# Change to yes if you don't trust ~/.ssh/known_hosts for
naddy@openbsd.orgffe65492016-08-15 12:32:04 +000052# HostbasedAuthentication
Damien Miller2bec5c12002-01-22 23:32:07 +110053#IgnoreUserKnownHosts no
Darren Tuckerec960f22003-08-13 20:37:05 +100054# Don't read the user's ~/.rhosts and ~/.shosts files
55#IgnoreRhosts yes
Ben Lindstromc4b72252001-06-09 01:09:51 +000056
Damien Millerd4a8b7e1999-10-27 13:42:43 +100057# To disable tunneled clear text passwords, change to no here!
Damien Miller2bec5c12002-01-22 23:32:07 +110058#PasswordAuthentication yes
59#PermitEmptyPasswords no
Damien Miller33804262001-02-04 23:20:18 +110060
Damien Miller2bec5c12002-01-22 23:32:07 +110061# Change to no to disable s/key passwords
62#ChallengeResponseAuthentication yes
Damien Millerf8154422001-04-25 22:44:14 +100063
Damien Miller2bec5c12002-01-22 23:32:07 +110064# Kerberos options
Damien Millerd7de14b2002-04-23 21:04:51 +100065#KerberosAuthentication no
Damien Miller2bec5c12002-01-22 23:32:07 +110066#KerberosOrLocalPasswd yes
67#KerberosTicketCleanup yes
Darren Tucker22ef5082003-12-31 11:37:34 +110068#KerberosGetAFSToken no
Damien Miller2bec5c12002-01-22 23:32:07 +110069
Darren Tucker0efd1552003-08-26 11:49:55 +100070# GSSAPI options
71#GSSAPIAuthentication no
Darren Tuckera49d36e2003-10-02 16:20:54 +100072#GSSAPICleanupCredentials yes
Darren Tucker0efd1552003-08-26 11:49:55 +100073
Darren Tuckere90a06a2013-09-18 15:09:38 +100074# Set this to 'yes' to enable PAM authentication, account processing,
75# and session processing. If this is enabled, PAM authentication will
Darren Tuckera4904f72006-02-23 21:35:30 +110076# be allowed through the ChallengeResponseAuthentication and
77# PasswordAuthentication. Depending on your PAM configuration,
78# PAM authentication via ChallengeResponseAuthentication may bypass
79# the setting of "PermitRootLogin without-password".
80# If you just want the PAM account and session checks to run without
81# PAM authentication, then enable this but set PasswordAuthentication
82# and ChallengeResponseAuthentication to 'no'.
Tim Riced4d18152003-09-25 19:04:34 -070083#UsePAM no
Damien Millerd4a8b7e1999-10-27 13:42:43 +100084
Damien Millerba3a6592008-05-19 14:58:22 +100085#AllowAgentForwarding yes
Darren Tuckerb8dae8e2003-06-22 20:48:45 +100086#AllowTcpForwarding yes
87#GatewayPorts no
Damien Miller2bec5c12002-01-22 23:32:07 +110088#X11Forwarding no
89#X11DisplayOffset 10
Damien Miller95c249f2002-02-05 12:11:34 +110090#X11UseLocalhost yes
Damien Miller5ff30c62013-10-30 22:21:50 +110091#PermitTTY yes
Damien Miller2bec5c12002-01-22 23:32:07 +110092#PrintMotd yes
93#PrintLastLog yes
Darren Tucker0b3b9752003-12-31 11:38:32 +110094#TCPKeepAlive yes
Damien Millerc30d35c2000-08-30 09:40:09 +110095#UseLogin no
djm@openbsd.orgc5c3f322016-02-17 05:29:04 +000096#UsePrivilegeSeparation sandbox
Ben Lindstrom5d860f02002-08-01 01:28:38 +000097#PermitUserEnvironment no
Damien Miller9786e6e2005-07-26 21:54:56 +100098#Compression delayed
Darren Tuckerb8dae8e2003-06-22 20:48:45 +100099#ClientAliveInterval 0
100#ClientAliveCountMax 3
deraadt@openbsd.org3cd51032015-02-02 01:57:44 +0000101#UseDNS no
Darren Tuckerb8dae8e2003-06-22 20:48:45 +1000102#PidFile /var/run/sshd.pid
Damien Miller1f583df2013-02-12 11:02:08 +1100103#MaxStartups 10:30:100
Damien Millerd27b9472005-12-13 19:29:02 +1100104#PermitTunnel no
Damien Millerd8cb1f12008-02-10 22:40:12 +1100105#ChrootDirectory none
Damien Miller23528812012-04-22 11:24:43 +1000106#VersionAddendum none
Darren Tuckerb8dae8e2003-06-22 20:48:45 +1000107
Damien Miller2bec5c12002-01-22 23:32:07 +1100108# no default banner path
Damien Miller4890e532007-09-17 11:57:38 +1000109#Banner none
Ben Lindstrome9d04442001-02-10 23:26:35 +0000110
Damien Miller2bec5c12002-01-22 23:32:07 +1100111# override default of no subsystems
Ben Lindstrome9d04442001-02-10 23:26:35 +0000112Subsystem sftp /usr/libexec/sftp-server
Damien Millere2754432006-07-24 14:06:47 +1000113
114# Example of overriding settings on a per-user basis
115#Match User anoncvs
116# X11Forwarding no
117# AllowTcpForwarding no
Damien Miller5ff30c62013-10-30 22:21:50 +1100118# PermitTTY no
Damien Millere2754432006-07-24 14:06:47 +1000119# ForceCommand cvs server