(An Untitled Masterwork)
ActivePublic
Actions

Authored by Paladox on May 2 2017, 4:03 PM.

Tags

None

Referenced Files

	F7873195:
	May 2 2017, 4:03 PM

Subscribers

None

	# This file is managed by puppet!
	# Package generated configuration file
	# See the sshd_config(5) manpage for details

	# What ports, IPs and protocols we listen for
	Port 22

	# Use these options to restrict which interfaces/protocols sshd will bind to
	#ListenAddress ::
	#ListenAddress 0.0.0.0

	Protocol 2
	# HostKeys for protocol version 2
	HostKey /etc/ssh/ssh_host_rsa_key
	HostKey /etc/ssh/ssh_host_dsa_key
	HostKey /etc/ssh/ssh_host_ecdsa_key
	HostKey /etc/ssh/ssh_host_ed25519_key
	#Privilege Separation is turned on for security
	UsePrivilegeSeparation sandbox

	KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256

	# Lifetime and size of ephemeral version 1 server key
	KeyRegenerationInterval 3600
	ServerKeyBits 1024

	# Logging
	SyslogFacility AUTH
	LogLevel VERBOSE

	# Authentication:
	LoginGraceTime 120

	PermitRootLogin yes


	# Message Authentication codes
	MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com

	StrictModes yes

	Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr

	RSAAuthentication yes
	PubkeyAuthentication yes
	#AuthorizedKeysFile %h/.ssh/authorized_keys

	AuthorizedKeysFile /etc/ssh/userkeys/%u /etc/ssh/userkeys/%u.d/cumin


	# Don't read the user's ~/.rhosts and ~/.shosts files
	IgnoreRhosts yes
	# For this to work you will also need host keys in /etc/ssh_known_hosts
	RhostsRSAAuthentication no


	HostbasedAuthentication no

	IgnoreUserKnownHosts yes

	# To enable empty passwords, change to yes (NOT RECOMMENDED)
	PermitEmptyPasswords no

	# Change to yes to enable challenge-response passwords (beware issues with
	# some PAM modules and threads)
	ChallengeResponseAuthentication no

	# Globally deny logon via password, only allow SSH-key login.
	PasswordAuthentication no


	# Kerberos options
	#KerberosAuthentication no
	#KerberosGetAFSToken no
	#KerberosOrLocalPasswd yes
	#KerberosTicketCleanup yes

	# GSSAPI options
	#GSSAPIAuthentication no
	#GSSAPICleanupCredentials yes

	X11DisplayOffset 10
	PrintMotd no
	PrintLastLog yes
	TCPKeepAlive yes
	#UseLogin no



	#MaxStartups 10:30:60
	#Banner /etc/issue.net

	# Allow client to pass locale environment variables
	AcceptEnv LANG LC_*

	Subsystem sftp /usr/lib/openssh/sftp-server

	UsePAM yes


	AuthorizedKeysCommand /usr/sbin/ssh-key-ldap-lookup
	AuthorizedKeysCommandUser ssh-key-ldap-lookup

	##
	## Anything below this point must start with a match declaration
	## or will only apply to the previous Matches above.
	##

Event Timeline

Paladox created this paste.May 2 2017, 4:03 PM

(An Untitled Masterwork)ActivePublicActions

Event Timeline

(An Untitled Masterwork)
ActivePublic
Actions