| | 1 | # $OpenBSD: sshd_config,v 1.69 2004/05/23 23:59:53 dtucker Exp $ |
| | 2 | |
| | 3 | # This is the sshd server system-wide configuration file. See |
| | 4 | # sshd_config(5) for more information. |
| | 5 | |
| | 6 | # This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin |
| | 7 | |
| | 8 | # The strategy used for options in the default sshd_config shipped with |
| | 9 | # OpenSSH is to specify options with their default value where |
| | 10 | # possible, but leave them commented. Uncommented options change a |
| | 11 | # default value. |
| | 12 | |
| | 13 | #Port 22 |
| | 14 | #Protocol 2,1 |
| | 15 | #ListenAddress 0.0.0.0 |
| | 16 | #ListenAddress :: |
| | 17 | |
| | 18 | # HostKey for protocol version 1 |
| | 19 | #HostKey /etc/ssh/ssh_host_key |
| | 20 | # HostKeys for protocol version 2 |
| | 21 | #HostKey /etc/ssh/ssh_host_rsa_key |
| | 22 | #HostKey /etc/ssh/ssh_host_dsa_key |
| | 23 | |
| | 24 | # Lifetime and size of ephemeral version 1 server key |
| | 25 | #KeyRegenerationInterval 1h |
| | 26 | #ServerKeyBits 768 |
| | 27 | |
| | 28 | # Logging |
| | 29 | #obsoletes QuietMode and FascistLogging |
| | 30 | #SyslogFacility AUTH |
| | 31 | #LogLevel INFO |
| | 32 | |
| | 33 | # Authentication: |
| | 34 | |
| | 35 | #LoginGraceTime 2m |
| | 36 | #PermitRootLogin yes |
| | 37 | #StrictModes yes |
| | 38 | #MaxAuthTries 6 |
| | 39 | |
| | 40 | #RSAAuthentication yes |
| | 41 | #PubkeyAuthentication yes |
| | 42 | #AuthorizedKeysFile .ssh/authorized_keys |
| | 43 | |
| | 44 | # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts |
| | 45 | #RhostsRSAAuthentication no |
| | 46 | # similar for protocol version 2 |
| | 47 | #HostbasedAuthentication no |
| | 48 | # Change to yes if you don't trust ~/.ssh/known_hosts for |
| | 49 | # RhostsRSAAuthentication and HostbasedAuthentication |
| | 50 | #IgnoreUserKnownHosts no |
| | 51 | # Don't read the user's ~/.rhosts and ~/.shosts files |
| | 52 | #IgnoreRhosts yes |
| | 53 | |
| | 54 | # To disable tunneled clear text passwords, change to no here! |
| | 55 | #PasswordAuthentication yes |
| | 56 | #PermitEmptyPasswords no |
| | 57 | |
| | 58 | # Change to no to disable s/key passwords |
| | 59 | #ChallengeResponseAuthentication yes |
| | 60 | |
| | 61 | # Kerberos options |
| | 62 | #KerberosAuthentication no |
| | 63 | #KerberosOrLocalPasswd yes |
| | 64 | #KerberosTicketCleanup yes |
| | 65 | #KerberosGetAFSToken no |
| | 66 | |
| | 67 | # GSSAPI options |
| | 68 | #GSSAPIAuthentication no |
| | 69 | #GSSAPICleanupCredentials yes |
| | 70 | |
| | 71 | # Set this to 'yes' to enable PAM authentication, account processing, |
| | 72 | # and session processing. If this is enabled, PAM authentication will |
| | 73 | # be allowed through the ChallengeResponseAuthentication mechanism. |
| | 74 | # Depending on your PAM configuration, this may bypass the setting of |
| | 75 | # PasswordAuthentication, PermitEmptyPasswords, and |
| | 76 | # "PermitRootLogin without-password". If you just want the PAM account and |
| | 77 | # session checks to run without PAM authentication, then enable this but set |
| | 78 | # ChallengeResponseAuthentication=no |
| | 79 | #UsePAM no |
| | 80 | |
| | 81 | #AllowTcpForwarding yes |
| | 82 | #GatewayPorts no |
| | 83 | #X11Forwarding no |
| | 84 | #X11DisplayOffset 10 |
| | 85 | #X11UseLocalhost yes |
| | 86 | #PrintMotd yes |
| | 87 | #PrintLastLog yes |
| | 88 | #TCPKeepAlive yes |
| | 89 | #UseLogin no |
| | 90 | #UsePrivilegeSeparation yes |
| | 91 | #PermitUserEnvironment no |
| | 92 | #Compression yes |
| | 93 | #ClientAliveInterval 0 |
| | 94 | #ClientAliveCountMax 3 |
| | 95 | #UseDNS yes |
| | 96 | #PidFile /var/run/sshd.pid |
| | 97 | #MaxStartups 10 |
| | 98 | |
| | 99 | # no default banner path |
| | 100 | #Banner /some/path |
| | 101 | |
| | 102 | # override default of no subsystems |
| | 103 | Subsystem sftp /usr/libexec/sftp-server |
andersk / openssh.git / blame_incremental