ad-rbac

1.3.0

misc/sshd_config.txt

                                #    $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $

# This is the sshd server system-wide configuration file.  See

# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin

# The strategy used for options in the default sshd_config shipped with

# OpenSSH is to specify options with their default value where

# possible, but leave them commented.  Uncommented options override the

# default value.

# If you want to change the port on a SELinux system, you have to tell

# SELinux about this change.

# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER

#

#Port 22

#AddressFamily any

#ListenAddress 0.0.0.0

#ListenAddress ::

HostKey /etc/ssh/ssh_host_ed25519_key

#HostKey /etc/ssh/ssh_host_rsa_key

#HostKey /etc/ssh/ssh_host_ecdsa_key

# Ciphers and keying

RekeyLimit 512M 1h

# System-wide Crypto policy:

# This system is following system-wide crypto policy. The changes to

# Ciphers, MACs, KexAlgoritms and GSSAPIKexAlgorithsm will not have any

# effect here. They will be overridden by command-line options passed on

# the server start up.

# To opt out, uncomment a line with redefinition of  CRYPTO_POLICY=

# variable in  /etc/sysconfig/sshd  to overwrite the policy.

# For more information, see manual page for update-crypto-policies(8).

# Logging

#SyslogFacility AUTH

SyslogFacility AUTHPRIV

LogLevel INFO

ClientAliveInterval 120

ClientAliveCountMax 0

# Authentication:

LoginGraceTime 2m

PermitRootLogin yes

StrictModes yes

MaxAuthTries 5

MaxSessions 10

PubkeyAuthentication yes

# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2

# but this is overridden so installations will only check .ssh/authorized_keys

AuthorizedKeysFile    .ssh/authorized_keys

#AuthorizedPrincipalsFile none

# This enables AD-based sshPublicKey fetching in conjunction with configuration in /etc/sssd/sssd.conf

AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys

AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts

HostbasedAuthentication no

# Change to yes if you don't trust ~/.ssh/known_hosts for

# HostbasedAuthentication

IgnoreUserKnownHosts no

# Don't read the user's ~/.rhosts and ~/.shosts files

IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!

PasswordAuthentication no

PermitEmptyPasswords no

# Needed for Duo 2FA

ChallengeResponseAuthentication yes

# Sends IP instead of hostname

UseDns yes

# Kerberos options

#KerberosAuthentication no

#KerberosOrLocalPasswd yes

#KerberosTicketCleanup yes

#KerberosGetAFSToken no

#KerberosUseKuserok yes

# GSSAPI options

GSSAPIAuthentication yes

GSSAPICleanupCredentials yes

GSSAPIStrictAcceptorCheck yes

GSSAPIKeyExchange yes

GSSAPIStoreCredentialsOnRekey yes

#GSSAPIEnablek5users no

# Set this to 'yes' to enable PAM authentication, account processing,

# and session processing. If this is enabled, PAM authentication will

# be allowed through the ChallengeResponseAuthentication and

# PasswordAuthentication.  Depending on your PAM configuration,

# PAM authentication via ChallengeResponseAuthentication may bypass

# the setting of "PermitRootLogin without-password".

# If you just want the PAM account and session checks to run without

# PAM authentication, then enable this but set PasswordAuthentication

# and ChallengeResponseAuthentication to 'no'.

# WARNING: 'UsePAM no' is not supported in Fedora and may cause several

# problems.

UsePAM yes

#AllowAgentForwarding yes

#AllowTcpForwarding yes

GatewayPorts no

X11Forwarding no

#X11DisplayOffset 10

#X11UseLocalhost yes

#PermitTTY yes

# It is recommended to use pam_motd in /etc/pam.d/sshd instead of PrintMotd,

# as it is more configurable and versatile than the built-in version.

PrintMotd no

#PrintLastLog yes

#TCPKeepAlive yes

#PermitUserEnvironment no

#Compression delayed

#ClientAliveInterval 0

#ClientAliveCountMax 3

#ShowPatchLevel no

#PidFile /var/run/sshd.pid

#MaxStartups 10:30:100

PermitTunnel no

#ChrootDirectory none

#VersionAddendum none

# no default banner path

#Banner none

# Accept locale-related environment variables

AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES

AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT

AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE

AcceptEnv XMODIFIERS

# override default of no subsystems

Subsystem    sftp    /usr/libexec/openssh/sftp-server

# Example of overriding settings on a per-user basis

#Match User anoncvs

#    AllowTcpForwarding no

#    X11Forwarding no

#    PermitTTY no

#    ForceCommand cvs server

# Required for Duo. Defines multiple auth lists; comma-seperated lists are boolean AND

# space-seperated are boolean OR

AuthenticationMethods gssapi-keyex gssapi-with-mic publickey,keyboard-interactive gssapi-with-mic,keyboard-interactive

#Host *.example.com

#    ProxyCommand /usr/bin/sss_ssh_knownhostsproxy -p %p %h

#    GlobalKnownHostsFile /var/lib/sss/pubconf/known_hosts