-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathsshd_config.exec-sortorder
1842 lines (1735 loc) · 66.7 KB
/
sshd_config.exec-sortorder
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#
# File: sshd_config
#
# Edition: sshd(8) v7.9 compiled-default
#
# Sort Order: Program Execution
#
# Description: OpenSSH server daemon configuration file
#
# The possible keywords and their meanings are as
# follows (note that keywords are case-insensitive and
# arguments are case-sensitive):
# Item Template:
# Channel type: all, kex (pre-channel), auth (pre-channel),
# exec, shell, subsystem, pty-req, x11-req,
# auth-agent-req, env
# CLI option: -d
# Process context: monitor (client), server_loop2, main (server)
# SSH service: ssh-userauth (SSH2_MSG_USERAUTH_REQUEST)
# XXXXXX defaults to XXXXXX.
# state actions
# 0. SSH version exchange
# 1. SSH2_MSG_KEXINIT
# SSH2_MSG_KEX_ECDH_INIT
# SSH2_MSG_NEWKEYS
# SSH2_MSG_EXT_INFO
# 2. SSH2_MSG_CHANNEL_OPEN
# 3. SSH2_MSG_CHANNEL_REQUEST
# 3. SSH2_MSG_GLOBAL_REQUEST (request_pty)
# x. SSH2_MSG_CHANNEL_DATA
# x. SSH2_MSG_CHANNEL_EXTENDED_DATA
#
# Abstraction Layers
# * Transport
# ** SSHFP DNS record
# * User Authentication
# * Channel/Connection Layer
########################################################
# Daemon-related
########################################################
# LogLevel gives the verbosity level that is used when
# logging messages from sshd(8). The possible values
# are: QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG,
# DEBUG1, DEBUG2, and DEBUG3.
# DEBUG and DEBUG1 are equivalent.
# DEBUG2 and DEBUG3 each specify higher levels of
# debugging output. Logging with a DEBUG level
# violates the privacy of users and is not recommended.
# Channel type: all
# CLI option: -d
# CLI option: -q
# CLI option: -o
# Process Context: main, server_loop2
# options.log_level
# LogLevel defaults to INFO.
LogLevel VERBOSE
# SyslogFacility gives the facility code that is used
# when logging messages from sshd(8). The possible
# values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1,
# LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
#
# Channel type: all
# CLI option: -o
# Process Context: main, server_loop2
# options.log_facility
# SyslogFacility defaults to AUTH.
SyslogFacility AUTH
# Port specifies the port number that sshd(8) listens on.
# Multiple options of this type are permitted.
# Port keyword must be before ListenAddress.
#
# CLI option: -o
# CLI option: -p
# Process context: main
# options.num_ports
# options.ports[]/add_one_listen_addr()/add_listen_addr()
# options.ports_from_cmdline
# Port defaults to 22.
Port 2222
# ListenAddress specifies the local addresses sshd(8)
# should listen on. The following forms may be used:
#
# ListenAddress hostname|address [rdomain domain]
# ListenAddress hostname:port [rdomain domain]
# ListenAddress IPv4_address:port [rdomain domain]
# ListenAddress [hostname|address]:port [rdomain domain]
#
# The optional rdomain qualifier requests sshd(8)
# listen in an explicit routing domain. If port is not
# specified, sshd will listen on the address and all
# Port options specified.
# Multiple ListenAddress options are permitted.
# Port prefix in ListenAddress overrides Port keyword.
#
# CLI option: -o
# Process context: main
# options.num_listen_addrs[]
# options.listen_addrs[]/server_listen()/main()/sshd.c
# The default is to listen on all local addresses on
# the current default routing domain.
ListenAddress 0.0.0.0:2222
ListenAddress [::]:2222
# PidFile specifies the file that contains the process
# ID of the SSH daemon, or none to not write one.
# Valid PidFile values are 'none' or a valid filespec.
#
# CLI option: -o
# Process context: main
# options.pid_file/pidfile()
# PidFile default is /run/sshd.pid.
PidFile /run/sshd.pid
# MaxStartups specifies the maximum number of concurrent
# unauthenticated connections to the SSH daemon.
# Additional connections will be dropped until
# authentication succeeds or the LoginGraceTime expires
# for a connection. The default is 10:30:100.
#
# Alternatively, random early drop can be enabled by
# specifying the three colon separated values
# start:rate:full (e.g. "10:30:60"). sshd(8) will
# refuse connection attempts with a probability of
# rate/100 (30%) if there are currently start (10)
# unauthenticated connections. The probability
# increases linearly and all connection attempts are
# refused if the number of unauthenticated connections
# reaches full (60).
#
# CLI option: -o
# Process context: main()/server
# options.max_startups/server_accept_loop()/main()
# MaxStartups defaults to 10:30:100.
MaxStartups 10:30:100
# AddressFamily specifies which address family should
# be used by sshd(8).
# Valid arguments are any, inet (use IPv4 only), or
# inet6 (use IPv6 only).
#
# CLI option: -4
# CLI option: -6
# CLI option: -o
# Process context: main()/server
# options.address_family/channel_set_af()/main()
# AddressFamily defaults to any.
AddressFamily any
# TCPKeepAlive specifies whether the system should send
# TCP keepalive messages to the other side. If they
# are sent, death of the connection or crash of one of
# the machines will be properly noticed. However,
# this means that connections will die if the route is
# down temporarily, and some people find it annoying.
# On the other hand, if TCP keepalives are not sent,
# sessions may hang indefinitely on the server,
# leaving "ghost" users and consuming server resources.
#
# This option was formerly called KeepAlive.
# To disable TCP keepalive messages, the value should
# be set to no.
#
# CLI option: -o
# Process context: main
# options.tcp_keep_alive/main()
# The default is yes (to send TCP keepalive messages),
# and the server will notice if the network goes down
# or the client host crashes. This avoids infinitely
# hanging sessions.
TcpKeepAlive no
# RDomain specifies an explicit routing domain that is
# applied after authentication has completed. The
# user session, as well and any forwarded or listening
# IP sockets, will be bound to this rdomain(4). If
# the routing domain is set to %D, then the domain in
# which the incoming connection was received will be
# applied.
# RDomain accepts the token %D, 'none', or a valid domain.
#
# CLI option: -o
# Process context: main
# options.routing_domain/main()
# RDOmain defaults to 'none'.
RDomain none
# IP Network-based connection made at this point
# LoginGraceTime disconnects after this time if the
# user has not successfully logged into the server.
# If the value is 0, there is no time limit.
#
# Channel type: version (pre-channel)
# CLI option: -g
# CLI option: -o
# Process context: main
# options.login_grace_time/main()
# LoginGraceTime defaults to 120 seconds.
LoginGraceTime 35
# VersionAddendum optionally specifies additional text
# to append to the SSH protocol banner sent by the
# server upon connection.
#
# Channel type: version (pre-channel)
# CLI option: -o
# Process context: main
# options.version_addendum/main()
# VersionAddendum defaults to 'none'.
VersionAddendum none
# DebianBanner specifies whether the distribution-
# specified extra version suffix is included during
# initial protocol handshake. The default is yes.
#
# Channel type: version (pre-channel)
# Process context: main
# DebianBanner no
# KexAlgorithms specifies the available KEX (Key
# Exchange) algorithms. Multiple algorithms must be
# comma-separated. Alternately if the specified value
# begins with a ‘+’ character, then the specified
# methods will be appended to the default set instead
# of replacing them. If the specified value begins
# with a ‘-’ character, then the specified methods
# (including wildcards) will be removed from the
# default set instead of replacing them. The
# supported algorithms are:
#
# curve25519-sha256
# curve25519-sha256@libssh.org
# diffie-hellman-group1-sha1
# diffie-hellman-group14-sha1
# diffie-hellman-group14-sha256
# diffie-hellman-group16-sha512
# diffie-hellman-group18-sha512
# diffie-hellman-group-exchange-sha1
# diffie-hellman-group-exchange-sha256
# ecdh-sha2-nistp256
# ecdh-sha2-nistp384
# ecdh-sha2-nistp521
#
# The list of available key exchange algorithms may
# also be obtained using "ssh -Q kex".
#
# Need to execute the following commands for a safer KexAlgorithms
#
# SSH_MODULI_BITS=4096
# ssh-keygen -G moduli-${SSH_MODULI_BITS}.candidates -b ${SSH_MODULI_BITS}
# ssh-keygen -T moduli.safe \
# -f moduli-${SSH_MODULI_BITS}.candidates \
# -b ${SSH_MODULI_BITS}
# awk '$5 > 3071' moduli-${SSH_MODULI_BITS}.candidates \
# > moduli-${SSH_MODULI_BITS}
# cp moduli-${SSH_MODULI_BITS} /etc/ssh/moduli
#
# Channel type: kex (pre-channel)
# CLI option: -o
# Process context: main
# options.kex_algorithms/do_ssh2_kex()
# The default is:
# curve25519-sha256,curve25519-sha256@libssh.org,
# ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
# diffie-hellman-group-exchange-sha256,
# diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,
# diffie-hellman-group14-sha256,diffie-hellman-group14-sha1
KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256
# Ciphers specifies the ciphers allowed. Multiple
# ciphers must be comma-separated. If the specified
# value begins with a ‘+’ character, then the
# specified ciphers will be appended to the default
# set instead of replacing them. If the specified
# value begins with a ‘-’ character, then the
# specified ciphers (including wildcards) will be
# removed from the default set instead of replacing
# them.
#
# The supported ciphers are:
#
# 3des-cbc
# aes128-cbc
# aes192-cbc
# aes256-cbc
# aes128-ctr
# aes192-ctr
# aes256-ctr
# aes128-gcm@openssh.com
# aes256-gcm@openssh.com
# chacha20-poly1305@openssh.com
#
# The list of available ciphers may also be obtained
# using "ssh -Q cipher".
#
# Channel type: kex (pre-channel)
# CLI option: -o
# Process context: main
# options.ciphers/do_ssh2_kex()
# The default is:
# chacha20-poly1305@openssh.com,
# aes128-ctr,aes192-ctr,aes256-ctr,
# aes128-gcm@openssh.com,aes256-gcm@openssh.com
#
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
# MACs specifies the available MAC (message
# authentication code) algorithms. The MAC algorithm
# is used for data integrity protection. Multiple
# algorithms must be comma-separated. If the
# specified value begins with a ‘+’ character, then
# the specified algorithms will be appended to the
# default set instead of replacing them. If the
# specified value begins with a ‘-’ character, then
# the specified algorithms (including wildcards) will
# be removed from the default set instead of replacing
# them.
#
# The algorithms that contain "-etm" calculate the MAC
# after encryption (encrypt-then-mac). These are
# considered safer and their use recommended. The
# supported MACs are:
#
# hmac-md5
# hmac-md5-96
# hmac-sha1
# hmac-sha1-96
# hmac-sha2-256
# hmac-sha2-512
# umac-64@openssh.com
# umac-128@openssh.com
# hmac-md5-etm@openssh.com
# hmac-md5-96-etm@openssh.com
# hmac-sha1-etm@openssh.com
# hmac-sha1-96-etm@openssh.com
# hmac-sha2-256-etm@openssh.com
# hmac-sha2-512-etm@openssh.com
# umac-64-etm@openssh.com
# umac-128-etm@openssh.com
#
# The list of available MAC algorithms may also be
# obtained using "ssh -Q mac".
#
# Channel type: kex (pre-channel)
# CLI option: -o
# Process context: main
# options.macs/do_ssh2_kex()/main()
# The default is:
# umac-64-etm@openssh.com,umac-128-etm@openssh.com,
# hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,
# hmac-sha1-etm@openssh.com,
# umac-64@openssh.com,umac-128@openssh.com,
# hmac-sha2-256,hmac-sha2-512,hmac-sha1
#
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
# Compression specifies whether compression is enabled
# after the user has authenticated successfully. The
# argument must be yes, delayed (a legacy synonym for
# yes) or no.
#
# Channel type: kex (pre-channel)
# CLI option: -o
# Process context: main
# options.compression/do_ssh2_kex()/main()
# Compression defaults to yes.
Compression no
# RekeyLimit specifies the maximum amount of data that
# may be transmitted before the session key is
# renegotiated, optionally followed a maximum amount
# of time that may pass before the session key is
# renegotiated.
#
# The first argument is specified in bytes and may
# have a suffix of ‘K’, ‘M’, or ‘G’ to indicate
# Kilobytes, Megabytes, or Gigabytes, respectively.
# The default is between ‘1G’ and ‘4G’, depending on
# the cipher.
# The optional second value is specified in seconds
# and may use any of the units documented in the
# TIME FORMATS section.
#
# Channel type: kex (pre-channel)
# CLI option: -o
# Process context: main
# options.rekey_limit/do_ssh2_kex()/main()
# options.rekey_interval/do_ssh2_kex()/main()
# RekeyLimit defaults to 'none'.
# which means that rekeying is performed after the
# cipher's default amount of data has been sent or
# received and no time based rekeying is done.
RekeyLimit 0 0
# HostKey specifies a file containing a private host
# key used by SSH.
# NOTE: sshd(8) will refuse to use a file if it is
# group/world-accessible and that the
# HostKeyAlgorithms option restricts which of the keys
# are actually used by sshd(8).
#
# It is possible to have multiple host key files. It
# is also possible to specify public host key files
# instead. In this case operations on the private key
# will be delegated to an ssh-agent(1).
#
# Channel type: kex (pre-channel)
# CLI option: -h
# CLI option: -o
# Process context: main
# options.host_key_files_userprovided[]/list_hostkey_types()/do_ssh2_kex()
# options.num_host_key_files/list_hostkey_types()/do_ssh2_kex()
# options.host_key_files[]/list_hostkey_types()/do_ssh2_kex()
# HostKey defaults to
# /etc/ssh/ssh_host_ecdsa_key,
# /etc/ssh/ssh_host_ed25519_key and
# /etc/ssh/ssh_host_rsa_key.
HostKey /etc/ssh/ssh_host_ed25519_key
# HostKeyAlgorithms specifies the host key algorithms
# that the server offers.
# The list of available key types may also be obtained
# using "ssh -Q key".
#
# Channel type: kex (pre-channel)
# CLI option: -o
# options.hostkeyalgorithms/append_hostkey_type()/list_hostkey_types()/do_ssh2_kex()
# HostKeyAlgorithms defaults to:
# ecdsa-sha2-nistp256-cert-v01@openssh.com,
# ecdsa-sha2-nistp384-cert-v01@openssh.com,
# ecdsa-sha2-nistp521-cert-v01@openssh.com,
# ssh-ed25519-cert-v01@openssh.com,
# rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,
# ssh-rsa-cert-v01@openssh.com,
# ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
# ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
HostKeyAlgorithms ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
# HostCertificate specifies a file containing a public
# host certificate. The certificate's public key must
# match a private host key already specified by
# HostKey.
# Channel type: kex (pre-channel)
# CLI option: -c
# CLI option: -o
# Process context: main
# options.num_host_cert_files/servconf_add_hostcert()
# options.host_cert_files/servconf_add_hostcert()
# HostCertificate defaults to 'none'.
HostCertificate none
# SecurityKeyProvider
# Also SSH_SK_PROVIDER environment name can be used
# to supply an external algorithm.
# Valid values to SecurityKeyProvider are 'none' or
# a valid filespec.
#
# CLI option: -o
# Process Context: monitor (client), server_loop2
# options.sk_provider/sshd_hostkey_sign()
# options.sk_provider/mm_answer_sign()
# SecurityKeyProvider defaults to 'internal'.
SecurityKeyProvider internal
# UseDNS specifies whether sshd(8) should look up the
# remote host name, and to check that the resolved
# host name for the remote IP address maps back to
# the very same IP address.
# You would only use UseDNS if you own the DNS
# network and/or have DNSSEC.
#
# Channel type: kex (pre-channel)
# CLI option: -o
# CLI option: -C
# options.use_dns/getpwamallow()
# options.use_dns/auth_get_canonical_hostname()/get_connection_info()
# If this option is set to no (the default) then only
# addresses and not host names may be used in
# ~/.ssh/authorized_keys from and sshd_config Match
# Host directives.
UseDns no
# UsePAM enables the Pluggable Authentication Module
# interface. If set to yes this will enable PAM
# authentication using ChallengeResponseAuthentication
# and PasswordAuthentication in addition to PAM account
# and session module processing for all authentication
# types.
#
# Because PAM challenge-response authentication usually
# serves an equivalent role to password authentication,
# you should disable either PasswordAuthentication or
# ChallengeResponseAuthentication.
#
# If UsePAM is enabled, you will not be able to run
# sshd(8) as a non-root user.
#
# NOTE: Debian openssh-server package sets UsePAM
# option to 'yes' as standard in
# /etc/ssh/sshd_config which are not the default in
# sshd(8):
#
# CLI option: -h, -o
# options.use_pam/allowed_user()
# options.use_pam/input_userauth_request()/input_service_request()/ssh_dispatch_set(SSH2_MSG_SERVICE_REQUEST)/do_authentication2()/main()
# options.use_pam/userauth_finish()//input_userauth_request()/ssh_dispatch_set(SSH2_MSG_USERAUTH_REQUEST)/input_service_reuqest()/ssh_dispatch_set(SSH2_MSG_SERVICE_REQUEST)/do_authentication2()/main()
# UsePAM defaults to no.
UsePAM no
# ChrootDirectory specifies the pathname of a
# directory to chroot(2) to after authentication.
# At session startup sshd(8) checks that all
# components of the pathname are root-owned
# directories which are not writable by any other user
# or group. After the chroot, sshd(8) changes the
# working directory to the user's home directory.
# Arguments to ChrootDirectory accept the tokens
# described in the TOKENS section.
#
# The ChrootDirectory must contain the necessary files
# and directories to support the user's session. For
# an interactive session this requires at least a shell,
# typically sh(1), and basic /dev nodes such as
# null(4), zero(4), stdin(4), stdout(4), stderr(4),
# and tty(4) devices. For file transfer sessions
# using SFTP no additional configuration of the
# environment is necessary if the inprocess
# sftp-server is used, though sessions which use
# logging may require /dev/log inside the chroot
# directory on some operating systems (see
# sftp-server(8) for details).
#
# For safety, it is very important that the directory
# hierarchy be prevented from modification by other
# processes on the system (especially those outside the
# jail). Misconfiguration can lead to unsafe
# environments which sshd(8) cannot detect.
#
# ChrootDirectory accepts the tokens %%, %h, %U, and %u.
# ChrootDirectory none # that doesn't work @ 7.9p1, so commenting out ChrootDirectory: error: Missing privilege separation directory: /var/empty
# ChrootDirectory # missing filenam @ 7.9p1
#
# Channel type: TODO ChrootDirectory channel-type
# CLI option: -o
# Process context: main
# options.chroot_directory
# ChrootDirectory defaults to none, indicating not to chroot(2).
# DenyUsers keyword can be followed by a list of user
# name patterns, separated by spaces. Login is
# disallowed for user names that match one of the
# patterns. Only user names are valid; a numerical
# user ID is not recognized. By default, login is
# allowed for all users. If the pattern takes the
# form USER@HOST then USER and HOST are separately
# checked, restricting logins to particular users from
# particular hosts. HOST criteria may additionally
# contain addresses to match in CIDR address/masklen
# format. The allow/deny directives are processed in
# the following order: DenyUsers, AllowUsers,
# DenyGroups, and finally AllowGroups.
#
# CLI option: -o
# options.deny_users[]/allowed_user()
# DenyUsers default is not to use its keyword.
DenyUsers root
# AllowUsers keyword can be followed by a list of user
# name patterns, separated by spaces. If specified,
# login is allowed only for user names that match one
# of the patterns. Only user names are valid; a
# numerical user ID is not recognized. By default,
# login is allowed for all users. If the pattern
# takes the form USER@HOST then USER and HOST are
# separately checked, restricting logins to particular
# users from particular hosts. HOST criteria may
# additionally contain addresses to match in CIDR
# address/masklen format. The allow/deny directives
# are processed in the following order: DenyUsers,
# AllowUsers, DenyGroups, and finally AllowGroups.
#
# CLI option: -o
# config.allow_users[]/allowed_user()
# AllowUsers default is not to use its keyword.
# DenyGroups keyword can be followed by a list of
# group name patterns, separated by spaces. Login
# is disallowed for users whose primary group or
# supplementary group list matches one of the
# patterns. Only group names are valid; a numerical
# group ID is not recognized. By default, login is
# allowed for all groups. The allow/deny directives
# are processed in the following order: DenyUsers,
# AllowUsers, DenyGroups, and finally AllowGroups.
#
# CLI option: -o
# options.deny_groups[]/allowed_user()
# DenyGroups default is not to use its keyword.
DenyGroups root
# AllowGroups keyword can be followed by a list of
# group name patterns, separated by spaces. If
# specified, login is allowed only for users whose
# primary group or supplementary group list
# matches one of the patterns. Only group names are
# valid; a numerical group ID is not recognized.
# By default, login is allowed for all groups.
# The allow/deny directives are processed in the
# following order: DenyUsers, AllowUsers, DenyGroups,
# and finally AllowGroups.
#
# CLI option: -o
# options.allow_groups[]/allowed_user()
# AllowGroups default is not to use its keyword.
AllowGroups ssh
# AuthorizedKeysCommandUser specifies the user under
# whose account the AuthorizedKeysCommand is run.
# It is recommended to use a dedicated user that has
# no other role on the host than running authorized
# keys commands. If AuthorizedKeysCommand is
# specified but AuthorizedKeysCommandUser is not, then
# sshd(8) will refuse to start.
#
# CLI option: -o
# options.authorized_keys_command_user[]/main()
# options.authorized_keys_command_user[]/user_key_command_allowed2()/user_key_allowed()/userauth_pubkey()/*method_pubkey[]/
# options.authorized_keys_command_user[]/user_key_command_allowed2()/user_key_allowed()/auth2-pubkey.c
# AuthorizedKeysCommandUser default is not to use its keyword.
# AuthorizedKeysCommand specifies a program to be used
# to look up the user's public keys.
# The program must be owned by root, not writable by
# group or others and specified by an absolute path.
# Arguments to AuthorizedKeysCommand accept the tokens
# described in the TOKENS section of sshd_config(5)
# man page. If no arguments are specified then the
# username of the target user is used.
#
# The program should produce on standard output zero
# or more lines of authorized_keys output (see
# AUTHORIZED_KEYS in sshd(8)). If a key supplied by
# AuthorizedKeysCommand does not successfully
# authenticate and authorize the user then public key
# authentication continues using the usual
# AuthorizedKeysFile files. By default, no
# AuthorizedKeysCommand is run.
# Valid values are: 'none', '', and a command line.
#
# AuthorizedKeysCommand accepts the tokens %%, %f, %h,
# %k, %t, %U, and %u.
#
# CLI option: -o
# options.authorized_keys_command[]/main()
# AuthorizedKeysCommandUser defaults to 'none'.
AuthorizedKeysCommand none
# AuthorizedPrincipalsCommandUser specifies the user
# under whose account the AuthorizedPrincipalsCommand
# is run. It is recommended to use a dedicated user
# that has no other role on the host than running
# authorized principals commands. If
# AuthorizedPrincipalsCommand is specified but
# AuthorizedPrincipalsCommandUser is not, then sshd(8)
# will refuse to start.
#
# CLI option: -o
# options.authorized_principals_command_user[]/main()
# AuthorizedPrincipalsCommandUser username
# AuthorizedPrincipalsCommand specifies a program to
# be used to generate the list of allowed certificate
# principals as per AuthorizedPrincipalsFile. The
# program must be owned by root, not writable by group
# or others and specified by an absolute path.
# Arguments to AuthorizedPrincipalsCommand accept the
# tokens described in the TOKENS section. If no
# arguments are specified then the username of the
# target user is used.
#
# The program should produce on standard output zero
# or more lines of AuthorizedPrincipalsFile output.
# If either AuthorizedPrincipalsCommand or
# AuthorizedPrincipalsFile is specified, then
# certificates offered by the client for
# authentication must contain a principal that is
# listed.
# By default, no AuthorizedPrincipalsCommand is run.
# Valid values are 'none', '', and a valid command.
#
# AuthorizedPrincipalsCommand accepts the tokens %%,
# %F, %f, %h, %i, %K, %k, %s, %T, %t, %U, and %u.
#
# CLI option: -o
# options.authorized_principals_command[]/main()
# AuthorizedKeysCommandUser defaults to 'none'.
AuthorizedPrincipalsCommand none
# HostKeyAgent identifies the UNIX-domain socket used
# to communicate with an agent that has access to the
# private host keys. If the string "SSH_AUTH_SOCK" is
# specified, the location of the socket will be read
# from the SSH_AUTH_SOCK environment variable over
# the keyword HostKeyAgent.
# Valid values are 'none', '', or a valid filespec.
#
# Channel type: authenticate (pre-channel)
# CLI option: -o
# Process context: main
# options.host_key_agent/main()
# options.host_key_agent/auth_sock/privsep_preauth()
# HostKeyAgent defaults to 'none'.
HostKeyAgent none
# At this execution point, '-t' CLI option will quit here.
# Banner sends the contents of the specified file the
# remote user before authentication is allowed. If
# the argument is none then no banner is displayed.
#
# Channel type: auth (pre-channel)
# CLI option: -o
# options.banner[]/auth2_read_banner()/userauth_banner()/input_userauth_request()/ssh_dispatch_set(SSH2_MSG_USERAUTH_REQUEST)
# Banner defaults to 'none'.
Banner /etc/issue.net
# AuthenticationMethods specifies the authentication
# methods that must be successfully completed for a
# user to be granted access. This option must be
# followed by one or more lists of comma-separated
# authentication method names, or by the single string
# any to indicate the default behaviour of accepting
# any single authentication method. If the default is
# overridden, then successful authentication requires
# completion of every method in at least one of these
# lists.
# For example,
# "publickey,password publickey,keyboard-interactive"
# would require the user to complete public key
# authentication, followed by either password or
# keyboard interactive authentication. Only methods
# that are next in one or more lists are offered at
# each stage, so for this example it would not be
# possible to attempt password or keyboard-interactive
# authentication before public key.
#
# For keyboard interactive authentication it is also
# possible to restrict authentication to a specific
# device by appending a colon followed by the device
# identifier bsdauth or pam depending on the server
# configuration. For example,
# "keyboard-interactive:bsdauth"
# would restrict keyboard interactive authentication
# to the bsdauth device.
#
# If the publickey method is listed more than once,
# sshd(8) verifies that keys that have been used
# successfully are not reused for subsequent
# authentications.
#
# For example, "publickey,publickey" requires
# successful authentication using two # different
# public keys.
#
# Comma separates auth options that should be tried together.
# Space separates auth options that should be tried separately.
#
# Note that each authentication method listed should
# also be explicitly enabled in the configuration.
#
# The available authentication methods are:
# "gssapi-with-mic",
# "hostbased",
# "keyboard-interactive",
# "none" (used for access to password-less
# accounts when PermitEmptyPasswords is
# enabled),
# "password" and
# "publickey".
#
# Channel type: auth (pre-channel)
# CLI option: -o
# Process context: main?
# SSH service: ssh-userauth (SSH2_MSG_USERAUTH_REQUEST)
# options.auth_methods[]/auth2_setup_methods_lists()/input_userauth_request()
# AuthenticationMethods defaults to 'any'.
AuthenticationMethods gssapi-with-mic publickey,keyboard-interactive publickey,password password
# MaxAuthTries specifies the maximum number of
# authentication attempts permitted per connection.
# Once the number of failures reaches half this value,
# additional failures are logged.
#
# Channel type: auth (pre-channel)
# CLI option: -o
# Process context: main?
# SSH service: ssh-userauth (SSH2_MSG_USERAUTH_REQUEST)
# options.max_authtries/input_userauth_request()
# MaxAuthTries defaults to '6'.
MaxAuthtries 3
# PermitEmptyPasswords, when password authentication is
# allowed, it specifies whether the server allows login
# to accounts with empty password strings.
# PermitEmptyPasswords default is no.
#
# Authenticate Method: none, password
# Channel type: auth (pre-channel)
# CLI option: -o
# Process context: main?
# SSH service: ssh-userauth (SSH2_MSG_USERAUTH_REQUEST)
# options.permit_empty_passwd/userauth_none()/&method_none
# options.permit_empty_passwd/auth_password()/mm_answer_authpassword()
PermitEmptyPasswords no
# PasswordAuthentication specifies whether password
# authentication is allowed.
#
# Authenticate Method: password
# Channel type: auth (pre-channel)
# CLI option: -o
# Process context: main?
# SSH service: ssh-userauth (SSH2_MSG_USERAUTH_REQUEST)
# options.password_authentication/mm_answer_authpassword()
# PasswordAuthentication defaults to 'yes'.
PasswordAuthentication yes
# FingerprintHash specifies the hash algorithm used
# when logging key fingerprints.
# Valid options are: md5 and sha256.
#
# CLI option: -o
# options.fingerprint_hash
# FingerprintHash defaults to 'sha256'.
FingerprintHash sha256
# PubkeyAuthentication specifies whether public key
# authentication is allowed.
#
# Authenticate Method: pubkey
# Channel type: auth (pre-channel)
# CLI option: -o
# Process Context: monitor (client)
# options.pubkey_authentication/mm_answer_keyallowed()
# PubkeyAuthentication defaults to 'yes'.
PubkeyAuthentication yes
# PubkeyAcceptedKeyTypes specifies the key types that
# will be accepted for public key authentication as a
# list of comma-separated patterns. Alternately if
# the specified value begins with a ‘+’ character,
# then the specified key types will be appended to
# the default set instead of replacing them. If the
# specified value begins with a ‘-’ character, then
# the specified key types (including wildcards) will
# be removed from the default set instead of replacing
# them.
# The list of available key types may also be obtained
# using "ssh -Q key".
#
# Authenticate Method: pubkey
# Channel type: auth (pre-channel)
# CLI option: -o
# Monitor type: key-allowed
# options.pubkey_key_types
# PubkeyAcceptedKeyTypes defaults to:
# ecdsa-sha2-nistp256-cert-v01@openssh.com,
# ecdsa-sha2-nistp384-cert-v01@openssh.com,
# ecdsa-sha2-nistp521-cert-v01@openssh.com,
# ssh-ed25519-cert-v01@openssh.com,
# rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,
# ssh-rsa-cert-v01@openssh.com,
# ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
# ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
PubkeyAcceptedKeyTypes ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
# CASignatureAlgorithms specifies which algorithms are
# allowed for signing of certificates by certificate
# authorities (CAs).
#
# Certificates signed using other algorithms will not
# be accepted for public key or host-based
# authentication.
#
# Authenticate Method: hostbased, pubkey
# Channel type: auth (pre-channel)
# CLI option: -o
# options.ca_sign_algorithms/
# CASignatureAlgorithms defaults to:
# ecdsa-sha2-nistp256.ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
# ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
CASignatureAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
# RevokedKeys specifies revoked public keys file, or
# none to not use one. Keys listed in this file will
# be refused for public key authentication. Note that
# if this file is not readable, then public key
# authentication will be refused for all users.
# Keys may be specified as a text file, listing one
# public key per line, or as an OpenSSH Key
# Revocation List (KRL) as generated by ssh-keygen(1).
# For more information on KRLs, see the KEY REVOCATION
# LISTS section in ssh-keygen(1).
#
# Authenticate Method: hostbased, pubkey
# Channel type: auth (pre-channel)
# CLI option: -o
# SSH service: ssh-userauth (SSH2_MSG_USERAUTH_REQUEST)
# options.revoked_keys_file[]/auth_key_is_revoked()/user_key_allowed()/userauth_pubkey()
# options.revoked_keys_file[]/auth_key_is_revoked()/hostbased_key_allowed()
RevokedKeys none
# AuthorizedKeysFile specifies the file that contains
# the public keys used for user authentication. The
# format is described in the AUTHORIZED_KEYS FILE
# FORMAT section of sshd(8). Arguments to
# AuthorizedKeysFile accept the tokens described in
# the TOKENS section. After expansion,
# AuthorizedKeysFile is taken to be an absolute path
# or one relative to the user's home directory.
# Multiple files may be listed, separated by
# whitespace. Alternately this option may be set to
# none to skip checking for user keys in files.
#
# AuthorizedKeysFile accepts the tokens %%, %h, %U, and %u.
#
# Authenticate Method: pubkey
# Channel type: auth (pre-channel)
# CLI option: -o
# options.authorized_keys_file[]
# AuthorizedKeysFile defaults to ".ssh/authorized_keys .ssh/authorized_keys2".
AuthorizedKeysFile %h/.ssh/authorized_keys
# StrictModes specifies whether sshd(8) should check
# file modes and ownership of the user's files and
# home directory before accepting login. This is
# normally desirable because novices sometimes
# accidentally leave their directory or files
# world-writable.
#
# NOTE: this does not apply to ChrootDirectory,
# whose permissions and ownership are checked
# unconditionally.
#
# Authenticate Method: hostbased
# Channel type: auth (pre-channel)
# CLI option: -o
# options.strict_modes/auth_rhosts2()/hostbased_key_allowed()
# options.strict_modes/user_key_allowed2()
# StrictModes default is yes.
StrictModes yes
# TrustedUserCAKeys specifies a file containing public
# keys of certificate authorities that are trusted to
# sign user certificates for authentication, or none
# to not use one. Keys are listed one per line; empty
# lines and comments starting with ‘#’ are allowed.
# If a certificate is presented for authentication and
# has its signing CA key listed in this file, then
# it may be used for authentication for any user
# listed in the certificate's principals list.
# NOTE: certificates that lack a list of principals
# will not be permitted for authentication
# using TrustedUserCAKeys. For more details on
# certificates, see the CERTIFICATES section
# in ssh-keygen(1).
#
# Authenticate Method: hostbased?, pubkey
# Channel type: auth (pre-channel)
# CLI option: -o
# options.trusted_user_ca_keys/user_cert_trusted_ca()
# TrustedUserCAKeys defaults to 'none'.
TrustedUserCAKeys none
# ChallengeResponseAuthentication specifies whether
# challenge-response authentication is allowed (e.g.
# via PAM).
#
# NOTE: Debian openssh-server package sets
# ChallengeResponseAuthentication option to 'no'
# as standard in /etc/ssh/sshd_config # which are
# not the default in sshd(8):
#
# Authenticate Method: keyboard-interactive
# Channel type: auth (pre-channel)
# CLI option: -o
# options.challenge_response_authentication/userauth_kbdinit()
# ChallengeResponseAuthentication defaults to 'yes'.
ChallengeResponseAuthentication yes
# HostbasedAuthentication specifies whether rhosts or
# /etc/hosts.equiv authentication together with
# successful public key client host authentication is