source: sysconfig/zweat/etc/ssh/sshd_config@ 422

#       $OpenBSD: sshd_config,v 1.93 2014/01/10 05:59:19 djm Exp $

#       $FreeBSD: releng/9.3/crypto/openssh/sshd_config 264693 2014-04-20 13:12:32Z des $



# This is the sshd server system-wide configuration file.  See

# sshd_config(5) for more information.



# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin



# The strategy used for options in the default sshd_config shipped with

# OpenSSH is to specify options with their default value where

# possible, but leave them commented.  Uncommented options override the

# default value.



# Note that some of FreeBSD's defaults differ from OpenBSD's, and

# FreeBSD has a few additional options.



Port 1022

#AddressFamily any

#ListenAddress 0.0.0.0

#ListenAddress ::

#ListenAddress 144.76.7.34

ListenAddress 2a01:4f8:190:8221::2



# The default requires explicit activation of protocol 1

#Protocol 2



# HostKey for protocol version 1

#HostKey /etc/ssh/ssh_host_key

# HostKeys for protocol version 2

#HostKey /etc/ssh/ssh_host_rsa_key

#HostKey /etc/ssh/ssh_host_dsa_key

#HostKey /etc/ssh/ssh_host_ecdsa_key

#HostKey /etc/ssh/ssh_host_ed25519_key



# Lifetime and size of ephemeral version 1 server key

#KeyRegenerationInterval 1h

#ServerKeyBits 1024



# Ciphers and keying

#RekeyLimit default none



# Logging

# obsoletes QuietMode and FascistLogging

#SyslogFacility AUTH

#LogLevel INFO



# Authentication:



#LoginGraceTime 2m

#PermitRootLogin no

#StrictModes yes

#MaxAuthTries 6

#MaxSessions 10



#RSAAuthentication yes

#PubkeyAuthentication yes



# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2

#AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2



#AuthorizedPrincipalsFile none



#AuthorizedKeysCommand none

#AuthorizedKeysCommandUser nobody



# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts

#RhostsRSAAuthentication no

# similar for protocol version 2

#HostbasedAuthentication no

# Change to yes if you don't trust ~/.ssh/known_hosts for

# RhostsRSAAuthentication and HostbasedAuthentication

#IgnoreUserKnownHosts no

# Don't read the user's ~/.rhosts and ~/.shosts files

#IgnoreRhosts yes



# Change to yes to enable built-in password authentication.

#PasswordAuthentication no

#PermitEmptyPasswords no



# Change to no to disable PAM authentication

#ChallengeResponseAuthentication yes



# Kerberos options

#KerberosAuthentication no

#KerberosOrLocalPasswd yes

#KerberosTicketCleanup yes

#KerberosGetAFSToken no



# GSSAPI options

#GSSAPIAuthentication no

#GSSAPICleanupCredentials yes



# Set this to 'no' to disable PAM authentication, account processing,

# and session processing. If this is enabled, PAM authentication will

# be allowed through the ChallengeResponseAuthentication and

# PasswordAuthentication.  Depending on your PAM configuration,

# PAM authentication via ChallengeResponseAuthentication may bypass

# the setting of "PermitRootLogin without-password".

# If you just want the PAM account and session checks to run without

# PAM authentication, then enable this but set PasswordAuthentication

# and ChallengeResponseAuthentication to 'no'.

#UsePAM yes



#AllowAgentForwarding yes

#AllowTcpForwarding yes

#GatewayPorts no

#X11Forwarding yes

#X11DisplayOffset 10

#X11UseLocalhost yes

#PermitTTY yes

#PrintMotd yes

#PrintLastLog yes

#TCPKeepAlive yes

#UseLogin no

#UsePrivilegeSeparation yes

#PermitUserEnvironment no

#Compression delayed

#ClientAliveInterval 0

#ClientAliveCountMax 3

#UseDNS yes

#PidFile /var/run/sshd.pid

#MaxStartups 10:30:100

#PermitTunnel no

#ChrootDirectory none

#VersionAddendum FreeBSD-20140420



# no default banner path

#Banner none



# override default of no subsystems

Subsystem       sftp    /usr/libexec/sftp-server



# Disable HPN tuning improvements.

#HPNDisabled no



# Buffer size for HPN to non-HPN connections.

#HPNBufferSize 2048



# TCP receive socket buffer polling for HPN.  Disable on non autotuning kernels.

#TcpRcvBufPoll yes



# Allow the use of the NONE cipher.

#NoneEnabled no



# Example of overriding settings on a per-user basis

#Match User anoncvs

#       X11Forwarding no

#       AllowTcpForwarding no

#       PermitTTY no

#       ForceCommand cvs server

PermitRootLogin yes