freebsd-skq/crypto/openssh/sshd_config

#	$OpenBSD: sshd_config,v 1.38 2001/04/15 21:41:29 deraadt Exp $
# $FreeBSD$

# This is the sshd server system-wide configuration file.  See sshd(8)
# for more information.

Port 22
#Protocol 2,1
#ListenAddress 0.0.0.0
#ListenAddress ::
HostKey /etc/ssh/ssh_host_key
HostKey /etc/ssh/ssh_host_dsa_key
ServerKeyBits 768
LoginGraceTime 120
KeyRegenerationInterval 3600
PermitRootLogin no
# ConnectionsPerPeriod has been deprecated completely

# After 10 unauthenticated connections, refuse 30% of the new ones, and
# refuse any more than 60 total.
MaxStartups 10:30:60
# Don't read ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes
StrictModes yes
X11Forwarding yes
X11DisplayOffset 10
PrintMotd yes
#PrintLastLog no
KeepAlive yes

# Logging
SyslogFacility AUTH
LogLevel INFO
#obsoletes QuietMode and FascistLogging

RhostsAuthentication no
#
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
#
RSAAuthentication yes

# To disable tunneled clear text passwords, change to no here!
PasswordAuthentication yes
PermitEmptyPasswords no

# Uncomment to disable s/key passwords 
#ChallengeResponseAuthentication no

# To change Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#AFSTokenPassing no
#KerberosTicketCleanup no

# Kerberos TGT Passing does only work with the AFS kaserver
#KerberosTgtPassing yes

CheckMail yes
#UseLogin no

#MaxStartups 10:30:60
#Banner /etc/issue.net
#ReverseMappingCheck yes

Subsystem	sftp	/usr/libexec/sftp-server
Fix conflicts for OpenSSH 2.9. 2001-05-04 04:14:23 +00:00			`# $OpenBSD: sshd_config,v 1.38 2001/04/15 21:41:29 deraadt Exp $`
Restore the RSA host key to /etc/ssh/ssh_host_key. Also fix $FreeBSD$ spamage in crypto/openssh/sshd_config rev. 1.16. 2001-05-18 18:10:02 +00:00			`# $FreeBSD$`
Fix conflicts for OpenSSH 2.9. 2001-05-04 04:14:23 +00:00
			`# This is the sshd server system-wide configuration file. See sshd(8)`
			`# for more information.`
Vendor import of OpenSSH. 2000-02-24 14:29:47 +00:00
			`Port 22`
Resolve conflicts and update for FreeBSD. 2000-05-15 05:24:25 +00:00			`#Protocol 2,1`
Vendor import of OpenSSH. 2000-02-24 14:29:47 +00:00			`#ListenAddress 0.0.0.0`
			`#ListenAddress ::`
sshd_config should still be keeping ssh host keys in /etc/ssh, not /etc. 2001-05-05 13:48:13 +00:00			`HostKey /etc/ssh/ssh_host_key`
			`HostKey /etc/ssh/ssh_host_dsa_key`
Vendor import of OpenSSH. 2000-02-24 14:29:47 +00:00			`ServerKeyBits 768`
Increase the default value of LoginGraceTime from 60 seconds to 120 seconds. PR: 20488 Submitted by: rwatson 2000-08-23 09:47:25 +00:00			`LoginGraceTime 120`
Vendor import of OpenSSH. 2000-02-24 14:29:47 +00:00			`KeyRegenerationInterval 3600`
Add the patches fom ports (QV: ports/security/openssh/patches/patch-*) 2000-02-24 15:29:42 +00:00			`PermitRootLogin no`
/Really/ deprecate ConnectionsPerPeriod, ripping out the code for it and giving a dire error to its lingering users. 2001-01-13 07:57:43 +00:00			`# ConnectionsPerPeriod has been deprecated completely`
Update to OpenSSH 2.3.0 with FreeBSD modifications. OpenSSH 2.3.0 new features description elided in favor of checking out their website. Important new FreeBSD-version stuff: PAM support has been worked in, partially from the "Unix" OpenSSH version, and a lot due to the work of Eivind Eklend, too. This requires at least the following in pam.conf: sshd auth sufficient pam_skey.so sshd auth required pam_unix.so try_first_pass sshd session required pam_permit.so Parts by: Eivind Eklend <eivind@FreeBSD.org> 2000-12-05 02:55:12 +00:00
			`# After 10 unauthenticated connections, refuse 30% of the new ones, and`
			`# refuse any more than 60 total.`
			`MaxStartups 10:30:60`
Vendor import of OpenSSH. 2000-02-24 14:29:47 +00:00			`# Don't read ~/.rhosts and ~/.shosts files`
			`IgnoreRhosts yes`
			`# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication`
			`#IgnoreUserKnownHosts yes`
			`StrictModes yes`
Turn on X11Forwarding by default on the server. Any risk is to the client, where it is already disabled by default. Reminded by: peter 2000-09-02 03:49:22 +00:00			`X11Forwarding yes`
Vendor import of OpenSSH. 2000-02-24 14:29:47 +00:00			`X11DisplayOffset 10`
			`PrintMotd yes`
Fix conflicts for OpenSSH 2.9. 2001-05-04 04:14:23 +00:00			`#PrintLastLog no`
Vendor import of OpenSSH. 2000-02-24 14:29:47 +00:00			`KeepAlive yes`

			`# Logging`
			`SyslogFacility AUTH`
			`LogLevel INFO`
			`#obsoletes QuietMode and FascistLogging`

			`RhostsAuthentication no`
			`#`
			`# For this to work you will also need host keys in /etc/ssh_known_hosts`
			`RhostsRSAAuthentication no`
Fix conflicts for OpenSSH 2.9. 2001-05-04 04:14:23 +00:00			`# similar for protocol version 2`
			`HostbasedAuthentication no`
Vendor import of OpenSSH. 2000-02-24 14:29:47 +00:00			`#`
			`RSAAuthentication yes`

			`# To disable tunneled clear text passwords, change to no here!`
			`PasswordAuthentication yes`
			`PermitEmptyPasswords no`
Fix conflicts for OpenSSH 2.9. 2001-05-04 04:14:23 +00:00
Vendor import of OpenSSH. 2000-02-24 14:29:47 +00:00			`# Uncomment to disable s/key passwords`
Fix conflicts for OpenSSH 2.9. 2001-05-04 04:14:23 +00:00			`#ChallengeResponseAuthentication no`
Vendor import of OpenSSH. 2000-02-24 14:29:47 +00:00
			`# To change Kerberos options`
			`#KerberosAuthentication no`
			`#KerberosOrLocalPasswd yes`
			`#AFSTokenPassing no`
			`#KerberosTicketCleanup no`

			`# Kerberos TGT Passing does only work with the AFS kaserver`
			`#KerberosTgtPassing yes`

Turn on CheckMail to be more login-compatible by default 2000-05-23 06:06:54 +00:00			`CheckMail yes`
Vendor import of OpenSSH. 2000-02-24 14:29:47 +00:00			`#UseLogin no`
Resolve conflicts and update for OpenSSH 2.2.0 Reviewed by: gshapiro, peter, green 2000-09-10 09:35:38 +00:00
Fix conflicts for OpenSSH 2.9. 2001-05-04 04:14:23 +00:00			`#MaxStartups 10:30:60`
			`#Banner /etc/issue.net`
			`#ReverseMappingCheck yes`

			`Subsystem sftp /usr/libexec/sftp-server`