sshd_config (3498B)
1
2 # This is the sshd server system-wide configuration file. See
3 # sshd_config(5) for more information.
4
5 # This sshd was compiled with PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
6
7 # The strategy used for options in the default sshd_config shipped with
8 # OpenSSH is to specify options with their default value where
9 # possible, but leave them commented. Uncommented options override the
10 # default value.
11
12 Include /etc/ssh/sshd_config.d/*.conf
13
14 # When systemd socket activation is used (the default), the socket
15 # configuration must be re-generated after changing Port, AddressFamily, or
16 # ListenAddress.
17 #
18 # For changes to take effect, run:
19 #
20 # systemctl daemon-reload
21 # systemctl restart ssh.socket
22 #
23 #Port 22
24 #AddressFamily any
25 #ListenAddress 0.0.0.0
26 #ListenAddress ::
27
28 #HostKey /etc/ssh/ssh_host_rsa_key
29 #HostKey /etc/ssh/ssh_host_ecdsa_key
30 #HostKey /etc/ssh/ssh_host_ed25519_key
31
32 # Ciphers and keying
33 #RekeyLimit default none
34
35 # Logging
36 #SyslogFacility AUTH
37 #LogLevel INFO
38
39 # Authentication:
40
41 #LoginGraceTime 2m
42 PermitRootLogin no
43 #StrictModes yes
44 #MaxAuthTries 6
45 #MaxSessions 10
46
47 #PubkeyAuthentication yes
48
49 # Expect .ssh/authorized_keys2 to be disregarded by default in future.
50 #AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2
51
52 #AuthorizedPrincipalsFile none
53
54 #AuthorizedKeysCommand none
55 #AuthorizedKeysCommandUser nobody
56
57 # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
58 #HostbasedAuthentication no
59 # Change to yes if you don't trust ~/.ssh/known_hosts for
60 # HostbasedAuthentication
61 #IgnoreUserKnownHosts no
62 # Don't read the user's ~/.rhosts and ~/.shosts files
63 #IgnoreRhosts yes
64
65 # To disable tunneled clear text passwords, change to no here!
66 PasswordAuthentication no
67 #PermitEmptyPasswords no
68
69 # Change to yes to enable challenge-response passwords (beware issues with
70 # some PAM modules and threads)
71 KbdInteractiveAuthentication no
72
73 # Kerberos options
74 #KerberosAuthentication no
75 #KerberosOrLocalPasswd yes
76 #KerberosTicketCleanup yes
77 #KerberosGetAFSToken no
78
79 # GSSAPI options
80 #GSSAPIAuthentication no
81 #GSSAPICleanupCredentials yes
82 #GSSAPIStrictAcceptorCheck yes
83 #GSSAPIKeyExchange no
84
85 # Set this to 'yes' to enable PAM authentication, account processing,
86 # and session processing. If this is enabled, PAM authentication will
87 # be allowed through the KbdInteractiveAuthentication and
88 # PasswordAuthentication. Depending on your PAM configuration,
89 # PAM authentication via KbdInteractiveAuthentication may bypass
90 # the setting of "PermitRootLogin prohibit-password".
91 # If you just want the PAM account and session checks to run without
92 # PAM authentication, then enable this but set PasswordAuthentication
93 # and KbdInteractiveAuthentication to 'no'.
94 UsePAM no
95
96 #AllowAgentForwarding yes
97 #AllowTcpForwarding yes
98 #GatewayPorts no
99 X11Forwarding yes
100 #X11DisplayOffset 10
101 #X11UseLocalhost yes
102 #PermitTTY yes
103 PrintMotd no
104 #PrintLastLog yes
105 #TCPKeepAlive yes
106 #PermitUserEnvironment no
107 #Compression delayed
108 #ClientAliveInterval 0
109 #ClientAliveCountMax 3
110 #UseDNS no
111 #PidFile /run/sshd.pid
112 #MaxStartups 10:30:100
113 #PermitTunnel no
114 #ChrootDirectory none
115 #VersionAddendum none
116
117 # no default banner path
118 #Banner none
119
120 # Allow client to pass locale environment variables
121 AcceptEnv LANG LC_*
122
123 # override default of no subsystems
124 Subsystem sftp /usr/lib/openssh/sftp-server
125
126 # Example of overriding settings on a per-user basis
127 #Match User anoncvs
128 # X11Forwarding no
129 # AllowTcpForwarding no
130 # PermitTTY no
131 # ForceCommand cvs server