freebsd-dev/crypto/openssh/sshd_config

# This is ssh server systemwide configuration file.
#
# $FreeBSD$

Port 22
#Protocol 2,1
#ListenAddress 0.0.0.0
#ListenAddress ::
HostKey /etc/ssh/ssh_host_key
HostDsaKey /etc/ssh/ssh_host_dsa_key
ServerKeyBits 768
LoginGraceTime 120
KeyRegenerationInterval 3600
PermitRootLogin no
# ConnectionsPerPeriod has been deprecated completely

# After 10 unauthenticated connections, refuse 30% of the new ones, and
# refuse any more than 60 total.
MaxStartups 10:30:60
# Don't read ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes
StrictModes yes
X11Forwarding yes
X11DisplayOffset 10
PrintMotd yes
KeepAlive yes

# Logging
SyslogFacility AUTH
LogLevel INFO
#obsoletes QuietMode and FascistLogging

RhostsAuthentication no
#
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
#
RSAAuthentication yes

# To disable tunneled clear text passwords, change to no here!
PasswordAuthentication yes
PermitEmptyPasswords no
# Uncomment to disable s/key passwords 
#SkeyAuthentication no
#KbdInteractiveAuthentication yes

# To change Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#AFSTokenPassing no
#KerberosTicketCleanup no

# Kerberos TGT Passing does only work with the AFS kaserver
#KerberosTgtPassing yes

CheckMail yes
#UseLogin no

# Uncomment if you want to enable sftp
#Subsystem	sftp	/usr/libexec/sftp-server
Vendor import of OpenSSH. 2000-02-24 14:29:47 +00:00			`# This is ssh server systemwide configuration file.`
Add the patches fom ports (QV: ports/security/openssh/patches/patch-*) 2000-02-24 15:29:42 +00:00			`#`
			`# $FreeBSD$`
Vendor import of OpenSSH. 2000-02-24 14:29:47 +00:00
			`Port 22`
Resolve conflicts and update for FreeBSD. 2000-05-15 05:24:25 +00:00			`#Protocol 2,1`
Vendor import of OpenSSH. 2000-02-24 14:29:47 +00:00			`#ListenAddress 0.0.0.0`
			`#ListenAddress ::`
oops, update path to /etc/ssh/ssh_host_key 2000-02-26 02:24:38 +00:00			`HostKey /etc/ssh/ssh_host_key`
Correct two stupid typos in the DSA key location. Submitted by: Udo Schweigert <ust@cert.siemens.de> 2000-05-18 06:04:23 +00:00			`HostDsaKey /etc/ssh/ssh_host_dsa_key`
Vendor import of OpenSSH. 2000-02-24 14:29:47 +00:00			`ServerKeyBits 768`
Increase the default value of LoginGraceTime from 60 seconds to 120 seconds. PR: 20488 Submitted by: rwatson 2000-08-23 09:47:25 +00:00			`LoginGraceTime 120`
Vendor import of OpenSSH. 2000-02-24 14:29:47 +00:00			`KeyRegenerationInterval 3600`
Add the patches fom ports (QV: ports/security/openssh/patches/patch-*) 2000-02-24 15:29:42 +00:00			`PermitRootLogin no`
/Really/ deprecate ConnectionsPerPeriod, ripping out the code for it and giving a dire error to its lingering users. 2001-01-13 07:57:43 +00:00			`# ConnectionsPerPeriod has been deprecated completely`
Update to OpenSSH 2.3.0 with FreeBSD modifications. OpenSSH 2.3.0 new features description elided in favor of checking out their website. Important new FreeBSD-version stuff: PAM support has been worked in, partially from the "Unix" OpenSSH version, and a lot due to the work of Eivind Eklend, too. This requires at least the following in pam.conf: sshd auth sufficient pam_skey.so sshd auth required pam_unix.so try_first_pass sshd session required pam_permit.so Parts by: Eivind Eklend <eivind@FreeBSD.org> 2000-12-05 02:55:12 +00:00
			`# After 10 unauthenticated connections, refuse 30% of the new ones, and`
			`# refuse any more than 60 total.`
			`MaxStartups 10:30:60`
Vendor import of OpenSSH. 2000-02-24 14:29:47 +00:00			`# Don't read ~/.rhosts and ~/.shosts files`
			`IgnoreRhosts yes`
			`# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication`
			`#IgnoreUserKnownHosts yes`
			`StrictModes yes`
Turn on X11Forwarding by default on the server. Any risk is to the client, where it is already disabled by default. Reminded by: peter 2000-09-02 03:49:22 +00:00			`X11Forwarding yes`
Vendor import of OpenSSH. 2000-02-24 14:29:47 +00:00			`X11DisplayOffset 10`
			`PrintMotd yes`
			`KeepAlive yes`

			`# Logging`
			`SyslogFacility AUTH`
			`LogLevel INFO`
			`#obsoletes QuietMode and FascistLogging`

			`RhostsAuthentication no`
			`#`
			`# For this to work you will also need host keys in /etc/ssh_known_hosts`
			`RhostsRSAAuthentication no`
			`#`
			`RSAAuthentication yes`

			`# To disable tunneled clear text passwords, change to no here!`
			`PasswordAuthentication yes`
			`PermitEmptyPasswords no`
			`# Uncomment to disable s/key passwords`
			`#SkeyAuthentication no`
Update to OpenSSH 2.3.0 with FreeBSD modifications. OpenSSH 2.3.0 new features description elided in favor of checking out their website. Important new FreeBSD-version stuff: PAM support has been worked in, partially from the "Unix" OpenSSH version, and a lot due to the work of Eivind Eklend, too. This requires at least the following in pam.conf: sshd auth sufficient pam_skey.so sshd auth required pam_unix.so try_first_pass sshd session required pam_permit.so Parts by: Eivind Eklend <eivind@FreeBSD.org> 2000-12-05 02:55:12 +00:00			`#KbdInteractiveAuthentication yes`
Vendor import of OpenSSH. 2000-02-24 14:29:47 +00:00
			`# To change Kerberos options`
			`#KerberosAuthentication no`
			`#KerberosOrLocalPasswd yes`
			`#AFSTokenPassing no`
			`#KerberosTicketCleanup no`

			`# Kerberos TGT Passing does only work with the AFS kaserver`
			`#KerberosTgtPassing yes`

Turn on CheckMail to be more login-compatible by default 2000-05-23 06:06:54 +00:00			`CheckMail yes`
Vendor import of OpenSSH. 2000-02-24 14:29:47 +00:00			`#UseLogin no`
Resolve conflicts and update for OpenSSH 2.2.0 Reviewed by: gshapiro, peter, green 2000-09-10 09:35:38 +00:00
			`# Uncomment if you want to enable sftp`
			`#Subsystem sftp /usr/libexec/sftp-server`