Index: sysconfig/zweat/etc/group
===================================================================
--- sysconfig/zweat/etc/group	(revision 399)
+++ sysconfig/zweat/etc/group	(revision 399)
@@ -0,0 +1,35 @@
+# $FreeBSD: releng/9.3/etc/group 256102 2013-10-07 08:19:41Z des $
+#
+wheel:*:0:root,rvdzwet,ed
+daemon:*:1:
+kmem:*:2:
+sys:*:3:
+tty:*:4:
+operator:*:5:root
+mail:*:6:
+bin:*:7:
+news:*:8:
+man:*:9:
+games:*:13:
+ftp:*:14:
+staff:*:20:
+sshd:*:22:
+smmsp:*:25:
+mailnull:*:26:
+guest:*:31:
+bind:*:53:
+unbound:*:59:
+proxy:*:62:
+authpf:*:63:
+_pflogd:*:64:
+_dhcp:*:65:
+uucp:*:66:
+dialer:*:68:
+network:*:69:
+audit:*:77:
+www:*:80:
+hast:*:845:
+nogroup:*:65533:
+nobody:*:65534:
+rvdzwet:*:1001:
+ed:*:1002:
Index: sysconfig/zweat/etc/passwd
===================================================================
--- sysconfig/zweat/etc/passwd	(revision 399)
+++ sysconfig/zweat/etc/passwd	(revision 399)
@@ -0,0 +1,28 @@
+# $FreeBSD: releng/9.3/etc/master.passwd 256102 2013-10-07 08:19:41Z des $
+#
+root:*:0:0:Charlie &:/root:/bin/csh
+toor:*:0:0:Bourne-again Superuser:/root:
+daemon:*:1:1:Owner of many system processes:/root:/usr/sbin/nologin
+operator:*:2:5:System &:/:/usr/sbin/nologin
+bin:*:3:7:Binaries Commands and Source:/:/usr/sbin/nologin
+tty:*:4:65533:Tty Sandbox:/:/usr/sbin/nologin
+kmem:*:5:65533:KMem Sandbox:/:/usr/sbin/nologin
+games:*:7:13:Games pseudo-user:/usr/games:/usr/sbin/nologin
+news:*:8:8:News Subsystem:/:/usr/sbin/nologin
+man:*:9:9:Mister Man Pages:/usr/share/man:/usr/sbin/nologin
+sshd:*:22:22:Secure Shell Daemon:/var/empty:/usr/sbin/nologin
+smmsp:*:25:25:Sendmail Submission User:/var/spool/clientmqueue:/usr/sbin/nologin
+mailnull:*:26:26:Sendmail Default User:/var/spool/mqueue:/usr/sbin/nologin
+bind:*:53:53:Bind Sandbox:/:/usr/sbin/nologin
+unbound:*:59:59:Unbound DNS Resolver:/var/unbound:/usr/sbin/nologin
+proxy:*:62:62:Packet Filter pseudo-user:/nonexistent:/usr/sbin/nologin
+_pflogd:*:64:64:pflogd privsep user:/var/empty:/usr/sbin/nologin
+_dhcp:*:65:65:dhcp programs:/var/empty:/usr/sbin/nologin
+uucp:*:66:66:UUCP pseudo-user:/var/spool/uucppublic:/usr/local/libexec/uucp/uucico
+pop:*:68:6:Post Office Owner:/nonexistent:/usr/sbin/nologin
+auditdistd:*:78:77:Auditdistd unprivileged user:/var/empty:/usr/sbin/nologin
+www:*:80:80:World Wide Web Owner:/nonexistent:/usr/sbin/nologin
+hast:*:845:845:HAST unprivileged user:/var/empty:/usr/sbin/nologin
+nobody:*:65534:65534:Unprivileged user:/nonexistent:/usr/sbin/nologin
+rvdzwet:*:1001:1001:Rick van der Zwet:/home/rvdzwet:/bin/csh
+ed:*:1002:1002:Eddie Kikkert:/home/ed:/bin/csh
Index: sysconfig/zweat/etc/rc.conf
===================================================================
--- sysconfig/zweat/etc/rc.conf	(revision 399)
+++ sysconfig/zweat/etc/rc.conf	(revision 399)
@@ -0,0 +1,64 @@
+hostname="zweat.vanderzwet.net"
+sshd_enable="YES"
+sendmail_enable="NONE"
+ntpd_enable="YES"
+defaultrouter="144.76.7.33"
+ifconfig_re0="144.76.7.34/27"
+ifconfig_re0_ipv6="2a01:4f8:190:8221::2/64"
+syslogd_flags="-s"
+
+smartd_enable="YES"
+
+ifconfig_re0_alias0="inet 144.76.7.58/27"
+ifconfig_re0_alias1="inet 144.76.7.59/27"
+ifconfig_re0_alias2="inet 144.76.7.61/27"
+ifconfig_re0_alias3="inet6 2a01:4f8:190:8221::1:1/64"
+ifconfig_re0_alias4="inet6 2a01:4f8:190:8221::2:1/64"
+ifconfig_re0_alias5="inet6 2a01:4f8:190:8221::3:1/64"
+ifconfig_re0_alias6="inet6 2a01:4f8:190:8221::4:1/64"
+
+ipv6_default_interface="re0"
+ipv6_defaultrouter="fe80::1%re0"
+
+jail_enable="YES"
+jail_sysvipc_allow="YES"
+jail_list="pzwet rzplay wasus wsoft"
+
+jail_pzwet_rootdir="/usr/jail/pzwet"
+jail_pzwet_hostname="pzwet.vanderzwet.net"
+jail_pzwet_ip="144.76.7.61,2a01:4f8:190:8221::1:1"
+jail_pzwet_devfs_enable="YES"
+jail_pzwet_devfs_ruleset="devfsrules_jail"
+jail_pzwet_parameters="allow.sysvipc=1"
+
+jail_wsoft_rootdir="/usr/jail/wsoft"
+jail_wsoft_hostname="wsoft.vanderzwet.net"
+jail_wsoft_ip="144.76.7.59,2a01:4f8:190:8221::3:1"
+jail_wsoft_devfs_enable="YES"
+jail_wsoft_devfs_ruleset="devfsrules_jail"
+
+jail_rzplay_rootdir="/usr/jail/rzplay"
+jail_rzplay_hostname="rzplay.vanderzwet.net"
+jail_rzplay_ip="144.76.7.34,2a01:4f8:190:8221::2:1"
+jail_rzplay_devfs_enable="YES"
+jail_rzplay_devfs_ruleset="devfsrules_jail"
+
+jail_wasus_rootdir="/usr/jail/wasus"
+jail_wasus_hostname="wasus.vanderzwet.net"
+jail_wasus_ip="144.76.7.58,2a01:4f8:190:8221::4:1"
+jail_wasus_devfs_enable="YES"
+jail_wasus_devfs_ruleset="devfsrules_jail"
+
+firewall_enable="YES"
+firewall_nat_enable="YES"
+firewall_script="/etc/rc.firewall.local"
+firewall_oif="re0"
+
+ipv6_firewall_enable="YES"
+ipv6_firewall_script="/etc/rc.firewall6.local"
+ipv6_firewall_oif="re0"
+smartd_enable="YES"
+
+darkstat_enable="YES"
+darkstat_interface="re0"
+darkstat_flags="-b 144.76.7.34 -l 144.76.7.32/255.255.255.224"
Index: sysconfig/zweat/etc/rc.firewall.local
===================================================================
--- sysconfig/zweat/etc/rc.firewall.local	(revision 399)
+++ sysconfig/zweat/etc/rc.firewall.local	(revision 399)
@@ -0,0 +1,319 @@
+#!/bin/sh -
+# Copyright (c) 1996  Poul-Henning Kamp
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+# ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+# SUCH DAMAGE.
+#
+# $FreeBSD: src/etc/rc.firewall,v 1.52.2.3.4.1 2009/04/15 03:14:26 kensmith Exp $
+#
+
+#
+# Setup system for ipfw(4) firewall service.
+#
+
+# Suck in the configuration variables.
+if [ -z "${source_rc_confs_defined}" ]; then
+	if [ -r /etc/defaults/rc.conf ]; then
+		. /etc/defaults/rc.conf
+		source_rc_confs
+	elif [ -r /etc/rc.conf ]; then
+		. /etc/rc.conf
+	fi
+fi
+
+trusted_net="84.106.113.143"
+
+# Deny and (if wanted) log the rest unconditionally.
+log="log logamount 500"	# The default of 100 is too low.
+sysctl net.inet.ip.fw.verbose=1 >/dev/null
+
+setup_loopback () {
+    log="log logamount 500"	# The default of 100 is too low.
+	############
+	# Only in rare cases do you want to change these rules
+	#
+	${fwcmd} add 100 pass all from any to any via lo0
+	${fwcmd} add 200 deny ${log} all from any to 127.0.0.0/8
+	#${fwcmd} add 300 deny ${log} ip from 127.0.0.0/8 to any
+
+	${fw6cmd} add 100 pass ip6 from any to any via lo0
+	${fw6cmd} add 200 deny ${log} ip6 from any to ::1
+	${fw6cmd} add 300 deny ${log} ip6 from ::1 to any
+	#
+	# ND
+	#
+	# DAD
+	${fw6cmd} add pass ip6 from :: to ff02::/16 proto ipv6-icmp
+	# RS, RA, NS, NA, redirect...
+	${fw6cmd} add pass ip6 from fe80::/10 to fe80::/10 proto ipv6-icmp
+	${fw6cmd} add pass ip6 from fe80::/10 to ff02::/16 proto ipv6-icmp
+}
+
+if [ -n "${1}" ]; then
+	firewall_type="${1}"
+fi
+
+############
+# Set quiet mode if requested
+#
+case ${firewall_quiet} in
+[Yy][Ee][Ss])
+	fwcmd="/sbin/ipfw -q"
+	;;
+*)
+	fwcmd="/sbin/ipfw"
+	;;
+esac
+case ${ipv6_firewall_quiet} in
+[Yy][Ee][Ss])
+	fw6cmd="/sbin/ipfw -q"
+	;;
+*)
+	fw6cmd="/sbin/ipfw"
+	;;
+esac
+
+############
+# Flush out the list before we begin.
+${fwcmd} -f flush
+
+setup_loopback
+
+############
+# If you just configured ipfw in the kernel as a tool to solve network
+# problems or you just want to disallow some particular kinds of traffic
+# then you will want to change the default policy to open.  You can also
+# do this as your only action by setting the firewall_type to ``open''.
+#
+# ${fwcmd} add 65000 pass all from any to any
+
+
+
+############
+# This is a prototype setup based after simple firewall. 
+#
+# Configuration:
+#  firewall_oif:		Outside network interface.
+############
+
+# set these to your outside interface network
+oif="$firewall_oif"
+
+# Allow jail to reach outside world
+${fwcmd} add nat 1 ip from 10.0.0.0/24 to any out via ${oif}
+${fwcmd} add nat 1 ip from any to 78.46.85.230 in via ${oif}
+${fwcmd} nat 1 config if ${oif}
+
+# Stop RFC1918 nets on the outside interface
+${fwcmd} add deny ${log} all from any to 10.0.0.0/8 via ${oif}
+${fwcmd} add deny ${log} all from any to 172.16.0.0/12 via ${oif}
+${fwcmd} add deny ${log} all from any to 192.168.0.0/16 via ${oif}
+
+# Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
+# DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
+# on the outside interface
+${fwcmd} add deny ${log} all from any to 0.0.0.0/8 via ${oif}
+${fwcmd} add deny ${log} all from any to 169.254.0.0/16 via ${oif}
+${fwcmd} add deny ${log} all from any to 192.0.2.0/24 via ${oif}
+${fwcmd} add deny ${log} all from any to 224.0.0.0/4 via ${oif}
+${fwcmd} add deny ${log} all from any to 240.0.0.0/4 via ${oif}
+
+# Stop RFC1918 nets on the outside interface
+${fwcmd} add deny ${log} all from 10.0.0.0/8 to any via ${oif}
+${fwcmd} add deny ${log} all from 172.16.0.0/12 to any via ${oif}
+${fwcmd} add deny ${log} all from 192.168.0.0/16 to any via ${oif}
+
+# Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
+# DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
+# on the outside interface
+${fwcmd} add deny ${log} all from 0.0.0.0/8 to any via ${oif}
+${fwcmd} add deny ${log} all from 169.254.0.0/16 to any via ${oif}
+${fwcmd} add deny ${log} all from 192.0.2.0/24 to any via ${oif}
+${fwcmd} add deny ${log} all from 224.0.0.0/4 to any via ${oif}
+${fwcmd} add deny ${log} all from 240.0.0.0/4 to any via ${oif}
+
+# Stop unique local unicast address on the outside interface
+${fw6cmd} add deny ${log} ip6 from fc00::/7 to any via ${oif}
+${fw6cmd} add deny ${log} ip6 from any to fc00::/7 via ${oif}
+
+# Stop site-local on the outside interface
+${fw6cmd} add deny ${log} ip6 from fec0::/10 to any via ${oif}
+${fw6cmd} add deny ${log} ip6 from any to fec0::/10 via ${oif}
+
+# Disallow "internal" addresses to appear on the wire.
+${fw6cmd} add deny ${log} ip6 from ::ffff:0.0.0.0/96 to any via ${oif}
+${fw6cmd} add deny ${log} ip6 from any to ::ffff:0.0.0.0/96 via ${oif}
+
+# Disallow packets to malicious IPv4 compatible prefix.
+${fw6cmd} add deny ${log} ip6 from ::224.0.0.0/100 to any via ${oif}
+${fw6cmd} add deny ${log} ip6 from any to ::224.0.0.0/100 via ${oif}
+${fw6cmd} add deny ${log} ip6 from ::127.0.0.0/104 to any via ${oif}
+${fw6cmd} add deny ${log} ip6 from any to ::127.0.0.0/104 via ${oif}
+${fw6cmd} add deny ${log} ip6 from ::0.0.0.0/104 to any via ${oif}
+${fw6cmd} add deny ${log} ip6 from any to ::0.0.0.0/104 via ${oif}
+${fw6cmd} add deny ${log} ip6 from ::255.0.0.0/104 to any via ${oif}
+${fw6cmd} add deny ${log} ip6 from any to ::255.0.0.0/104 via ${oif}
+
+${fw6cmd} add deny ${log} ip6 from ::0.0.0.0/96 to any via ${oif}
+${fw6cmd} add deny ${log} ip6 from any to ::0.0.0.0/96 via ${oif}
+
+# Disallow packets to malicious 6to4 prefix.
+${fw6cmd} add deny ${log} ip6 from 2002:e000::/20 to any via ${oif}
+${fw6cmd} add deny ${log} ip6 from any to 2002:e000::/20 via ${oif}
+${fw6cmd} add deny ${log} ip6 from 2002:7f00::/24 to any via ${oif}
+${fw6cmd} add deny ${log} ip6 from any to 2002:7f00::/24 via ${oif}
+${fw6cmd} add deny ${log} ip6 from 2002:0000::/24 to any via ${oif}
+${fw6cmd} add deny ${log} ip6 from any to 2002:0000::/24 via ${oif}
+${fw6cmd} add deny ${log} ip6 from 2002:ff00::/24 to any via ${oif}
+${fw6cmd} add deny ${log} ip6 from any to 2002:ff00::/24 via ${oif}
+
+${fw6cmd} add deny ${log} ip6 from 2002:0a00::/24 to any via ${oif}
+${fw6cmd} add deny ${log} ip6 from any to 2002:0a00::/24 via ${oif}
+${fw6cmd} add deny ${log} ip6 from 2002:ac10::/28 to any via ${oif}
+${fw6cmd} add deny ${log} ip6 from any to 2002:ac10::/28 via ${oif}
+${fw6cmd} add deny ${log} ip6 from 2002:c0a8::/32 to any via ${oif}
+${fw6cmd} add deny ${log} ip6 from any to 2002:c0a8::/32 via ${oif}
+
+${fw6cmd} add deny ${log} ip6 from ff05::/16 to any via ${oif}
+${fw6cmd} add deny ${log} ip6 from any to ff05::/16 via ${oif}
+
+# Allow TCP through if setup succeeded
+${fw6cmd} add pass ip6 from any to any established proto tcp
+${fwcmd} add pass tcp from any to any established
+
+# Allow any link-local multicast traffic
+${fw6cmd} add pass ip6 from fe80::/10 to ff02::/16
+
+# Deployment to production system, thus limited exposure
+# ${fwcmd} add pass tcp from 213.125.247.82 to 144.76.7.58 25,80,443
+# ${fwcmd} add deny ${log} tcp from any to 144.76.7.58 25,80,443
+# ${fw6cmd} add pass tcp from 2001:1af8:febe:0:b6b6:76ff:fe4f:1cd5 to 2a01:4f8:190:8221::4:1 25,80,443
+# ${fw6cmd} add pass tcp from 2001:980:488a:1:b6b6:76ff:fe4f:1cd5 to 2a01:4f8:190:8221::4:1 25,80,443
+# ${fw6cmd} add deny ${log} tcp from any to 2a01:4f8:190:8221::4:1 25,80,443
+
+# HACK!
+${fw6cmd} add pass ip6 from any to any
+
+# Allow IP fragments to pass through
+${fwcmd} add pass all from any to any frag
+${fw6cmd} add pass ip6 from any to any frag
+
+# Allow ICMP queries to arrive
+${fwcmd} add pass icmp from any to any icmptype 0,3,4,8,11
+${fw6cmd} add pass ip6 from any to any icmp6types 1,2,3,4,128 proto ipv6-icmp
+
+# Allow NS/ACK/NA/toobig (don't filter it out)
+${fw6cmd} add pass ip6 from any to me icmp6types 2,129,135,136 proto ipv6-icmp
+${fw6cmd} add pass ip6 from me to any proto ipv6-icmp
+
+
+# Allow setup of incoming email
+${fwcmd} add pass tcp from any to me 25 setup
+${fw6cmd} add pass ip6 from any to me 25 setup proto tcp
+
+# Allow setup of incoming email (smtps)
+${fwcmd} add pass tcp from any to me 465 setup
+${fw6cmd} add pass ip6 from any to me 465 setup proto tcp
+
+# Allow setup of incoming email (submission)
+${fwcmd} add pass tcp from any to me 587 setup
+${fw6cmd} add pass ip6 from any to me 587 setup proto tcp
+
+# Allow access to our FTP
+${fwcmd} add pass tcp from any to me 21 setup
+${fw6cmd} add pass ip6 from any to me 21 setup proto tcp
+
+# Allow access to our DNS
+${fwcmd} add pass tcp from any to me 53 setup
+${fw6cmd} add pass ip6 from any to me 53 setup proto tcp
+
+# Allow access to our Syslog
+${fwcmd} add pass udp from any to me 514
+${fwcmd} add pass udp from me 514 to any
+
+# Allow access to our DNS (ivp6)
+${fwcmd} add pass udp from any to me 53
+${fwcmd} add pass udp from me 53 to any
+${fw6cmd} add pass ip6 from any to me 53 proto udp
+${fw6cmd} add pass ip6 from me 53 to any proto udp
+
+# Allow access to our NTP
+${fwcmd} add pass udp from any to me 123
+${fwcmd} add pass udp from me 123 to any
+${fw6cmd} add pass ip6 from any to me 123 proto udp
+${fw6cmd} add pass ip6 from me 123 to any proto udp
+
+# Allow access to our WWW
+${fwcmd} add pass tcp from any to me 80 setup
+${fw6cmd} add pass ip6 from any to me 80 setup proto tcp
+${fwcmd} add pass tcp from any to me 443 setup
+${fw6cmd} add pass ip6 from any to me 443 setup proto tcp
+
+# Allow access to our SNMP
+${fwcmd} add pass udp from any to me 161
+${fwcmd} add pass udp from me 161 to any
+${fw6cmd} add pass ip6 from any to me 161 proto udp
+${fw6cmd} add pass ip6 from me 161 to any proto udp
+
+# Allow access to our SSH (sshguard operating in 55000 - 55050)
+${fwcmd} add 56000 pass tcp from any to me 22 setup
+${fw6cmd} add 56001 pass ip6 from any to me 22 setup proto tcp
+${fwcmd} add 56002 pass tcp from any to me 1022 setup
+${fw6cmd} add 56003 pass ip6 from any to me 1022 setup proto tcp
+
+# Allow access to our IMAP
+${fwcmd} add pass tcp from any to me 143 setup
+${fw6cmd} add pass ip6 from any to me 143 setup proto tcp
+
+# Allow access to our IMAPS
+${fwcmd} add pass tcp from any to me 993 setup
+${fw6cmd} add pass ip6 from any to me 993 setup proto tcp
+
+# Allow access to our IPERF
+${fwcmd} add pass tcp from any to me 5001 setup
+${fw6cmd} add pass ip6 from any to me 5001 setup proto tcp
+
+# Allow access to our DARKSTAT
+${fwcmd} add pass tcp from ${trusted_net} to me 667 setup
+${fw6cmd} add pass ip6 from ${trusted_net} to me 667 setup proto tcp
+
+# Reject&Log all setup of incoming connections from the outside
+${fwcmd} add deny ${log} tcp from any to any in via ${oif} setup
+
+# Allow setup of outgoing connections only
+${fwcmd} add pass tcp from me to any setup
+${fw6cmd} add pass ip6 from me to any setup proto tcp
+
+# Allow DNS queries out in the world
+${fwcmd} add pass udp from me to any 53 keep-state
+${fw6cmd} add pass ip6 from me to any 53 proto udp
+
+# Allow NTP queries out in the world
+${fwcmd} add pass udp from me to any 123 keep-state
+${fw6cmd} add pass ip6 from any 123 to me proto udp
+${fw6cmd} add pass ip6 from me to any 123 proto udp
+
+# Everything else is denied by default, unless the
+# IPFIREWALL_DEFAULT_TO_ACCEPT option is set in your kernel
+# config file.
+${fwcmd} add deny ${log} ip from any to any
+${fwcmd} add deny ${log} ip6 from any to any
Index: sysconfig/zweat/etc/rc.firewall6.local
===================================================================
--- sysconfig/zweat/etc/rc.firewall6.local	(revision 399)
+++ sysconfig/zweat/etc/rc.firewall6.local	(revision 399)
@@ -0,0 +1,2 @@
+#!/bin/sh -
+echo "IPv6 firewalling configured in /etc/rc.firewall.local"
Index: sysconfig/zweat/etc/ssh/sshd_config
===================================================================
--- sysconfig/zweat/etc/ssh/sshd_config	(revision 399)
+++ sysconfig/zweat/etc/ssh/sshd_config	(revision 399)
@@ -0,0 +1,151 @@
+#	$OpenBSD: sshd_config,v 1.93 2014/01/10 05:59:19 djm Exp $
+#	$FreeBSD: releng/9.3/crypto/openssh/sshd_config 264693 2014-04-20 13:12:32Z des $
+
+# This is the sshd server system-wide configuration file.  See
+# sshd_config(5) for more information.
+
+# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
+
+# The strategy used for options in the default sshd_config shipped with
+# OpenSSH is to specify options with their default value where
+# possible, but leave them commented.  Uncommented options override the
+# default value.
+
+# Note that some of FreeBSD's defaults differ from OpenBSD's, and
+# FreeBSD has a few additional options.
+
+Port 1022
+#AddressFamily any
+#ListenAddress 0.0.0.0
+#ListenAddress ::
+#ListenAddress 144.76.7.34
+ListenAddress 2a01:4f8:190:8221::2
+
+# The default requires explicit activation of protocol 1
+#Protocol 2
+
+# HostKey for protocol version 1
+#HostKey /etc/ssh/ssh_host_key
+# HostKeys for protocol version 2
+#HostKey /etc/ssh/ssh_host_rsa_key
+#HostKey /etc/ssh/ssh_host_dsa_key
+#HostKey /etc/ssh/ssh_host_ecdsa_key
+#HostKey /etc/ssh/ssh_host_ed25519_key
+
+# Lifetime and size of ephemeral version 1 server key
+#KeyRegenerationInterval 1h
+#ServerKeyBits 1024
+
+# Ciphers and keying
+#RekeyLimit default none
+
+# Logging
+# obsoletes QuietMode and FascistLogging
+#SyslogFacility AUTH
+#LogLevel INFO
+
+# Authentication:
+
+#LoginGraceTime 2m
+#PermitRootLogin no
+#StrictModes yes
+#MaxAuthTries 6
+#MaxSessions 10
+
+#RSAAuthentication yes
+#PubkeyAuthentication yes
+
+# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
+#AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2
+
+#AuthorizedPrincipalsFile none
+
+#AuthorizedKeysCommand none
+#AuthorizedKeysCommandUser nobody
+
+# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
+#RhostsRSAAuthentication no
+# similar for protocol version 2
+#HostbasedAuthentication no
+# Change to yes if you don't trust ~/.ssh/known_hosts for
+# RhostsRSAAuthentication and HostbasedAuthentication
+#IgnoreUserKnownHosts no
+# Don't read the user's ~/.rhosts and ~/.shosts files
+#IgnoreRhosts yes
+
+# Change to yes to enable built-in password authentication.
+#PasswordAuthentication no
+#PermitEmptyPasswords no
+
+# Change to no to disable PAM authentication
+#ChallengeResponseAuthentication yes
+
+# Kerberos options
+#KerberosAuthentication no
+#KerberosOrLocalPasswd yes
+#KerberosTicketCleanup yes
+#KerberosGetAFSToken no
+
+# GSSAPI options
+#GSSAPIAuthentication no
+#GSSAPICleanupCredentials yes
+
+# Set this to 'no' to disable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will
+# be allowed through the ChallengeResponseAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via ChallengeResponseAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and ChallengeResponseAuthentication to 'no'.
+#UsePAM yes
+
+#AllowAgentForwarding yes
+#AllowTcpForwarding yes
+#GatewayPorts no
+#X11Forwarding yes
+#X11DisplayOffset 10
+#X11UseLocalhost yes
+#PermitTTY yes
+#PrintMotd yes
+#PrintLastLog yes
+#TCPKeepAlive yes
+#UseLogin no
+#UsePrivilegeSeparation yes
+#PermitUserEnvironment no
+#Compression delayed
+#ClientAliveInterval 0
+#ClientAliveCountMax 3
+#UseDNS yes
+#PidFile /var/run/sshd.pid
+#MaxStartups 10:30:100
+#PermitTunnel no
+#ChrootDirectory none
+#VersionAddendum FreeBSD-20140420
+
+# no default banner path
+#Banner none
+
+# override default of no subsystems
+Subsystem	sftp	/usr/libexec/sftp-server
+
+# Disable HPN tuning improvements.
+#HPNDisabled no
+
+# Buffer size for HPN to non-HPN connections.
+#HPNBufferSize 2048
+
+# TCP receive socket buffer polling for HPN.  Disable on non autotuning kernels.
+#TcpRcvBufPoll yes
+
+# Allow the use of the NONE cipher.
+#NoneEnabled no
+
+# Example of overriding settings on a per-user basis
+#Match User anoncvs
+#	X11Forwarding no
+#	AllowTcpForwarding no
+#	PermitTTY no
+#	ForceCommand cvs server
+PermitRootLogin yes
