xref: /illumos-gate/usr/src/cmd/ssh/etc/sshd_config (revision 4a2e944d)
1#
2# Copyright (c) 2001, 2010, Oracle and/or its affiliates. All rights reserved.
3#
4# Configuration file for sshd(1m) (see also sshd_config(4))
5#
6
7# Protocol versions supported
8#
9# The sshd shipped in this release of Solaris has support for major versions
10# 1 and 2.  It is recommended due to security weaknesses in the v1 protocol
11# that sites run only v2 if possible. Support for v1 is provided to help sites
12# with existing ssh v1 clients/servers to transition.
13# Support for v1 may not be available in a future release of Solaris.
14#
15# To enable support for v1 an RSA1 key must be created with ssh-keygen(1).
16# RSA and DSA keys for protocol v2 are created by /etc/init.d/sshd if they
17# do not already exist, RSA1 keys for protocol v1 are not automatically created.
18
19# Uncomment ONLY ONE of the following Protocol statements.
20
21# Only v2 (recommended)
22Protocol 2
23
24# Both v1 and v2 (not recommended)
25#Protocol 2,1
26
27# Only v1 (not recommended)
28#Protocol 1
29
30# Listen port (the IANA registered port number for ssh is 22)
31Port 22
32
33# The default listen address is all interfaces, this may need to be changed
34# if you wish to restrict the interfaces sshd listens on for a multi homed host.
35# Multiple ListenAddress entries are allowed.
36
37# IPv4 only
38#ListenAddress 0.0.0.0
39# IPv4 & IPv6
40ListenAddress ::
41
42# If port forwarding is enabled (default), specify if the server can bind to
43# INADDR_ANY.
44# This allows the local port forwarding to work when connections are received
45# from any remote host.
46GatewayPorts no
47
48# X11 tunneling options
49X11Forwarding yes
50X11DisplayOffset 10
51X11UseLocalhost yes
52
53# The maximum number of concurrent unauthenticated connections to sshd.
54# start:rate:full see sshd(1) for more information.
55# The default is 10 unauthenticated clients.
56#MaxStartups 10:30:60
57
58# Banner to be printed before authentication starts.
59#Banner /etc/issue
60
61# Should sshd print the /etc/motd file and check for mail.
62# On Solaris it is assumed that the login shell will do these (eg /etc/profile).
63PrintMotd no
64
65# KeepAlive specifies whether keep alive messages are sent to the client.
66# See sshd(1) for detailed description of what this means.
67# Note that the client may also be sending keep alive messages to the server.
68KeepAlive yes
69
70# Syslog facility and level
71SyslogFacility auth
72LogLevel info
73
74#
75# Authentication configuration
76#
77
78# Host private key files
79# Must be on a local disk and readable only by the root user (root:sys 600).
80HostKey /etc/ssh/ssh_host_rsa_key
81HostKey /etc/ssh/ssh_host_dsa_key
82
83# Length of the server key
84# Default 768, Minimum 512
85ServerKeyBits 768
86
87# sshd regenerates the key every KeyRegenerationInterval seconds.
88# The key is never stored anywhere except the memory of sshd.
89# The default is 1 hour (3600 seconds).
90KeyRegenerationInterval 3600
91
92# Ensure secure permissions on users .ssh directory.
93StrictModes yes
94
95# Length of time in seconds before a client that hasn't completed
96# authentication is disconnected.
97# Default is 600 seconds. 0 means no time limit.
98LoginGraceTime 600
99
100# Maximum number of retries for authentication
101# Default is 6. Default (if unset) for MaxAuthTriesLog is MaxAuthTries / 2
102MaxAuthTries	6
103MaxAuthTriesLog	3
104
105# Are logins to accounts with empty passwords allowed.
106# If PermitEmptyPasswords is no, pass PAM_DISALLOW_NULL_AUTHTOK
107# to pam_authenticate(3PAM).
108PermitEmptyPasswords no
109
110# To disable tunneled clear text passwords, change PasswordAuthentication to no.
111PasswordAuthentication yes
112
113# Are root logins permitted using sshd.
114# Note that sshd uses pam_authenticate(3PAM) so the root (or any other) user
115# maybe denied access by a PAM module regardless of this setting.
116# Valid options are yes, without-password, no.
117PermitRootLogin no
118
119# sftp subsystem
120Subsystem	sftp	internal-sftp
121
122
123# SSH protocol v1 specific options
124#
125# The following options only apply to the v1 protocol and provide
126# some form of backwards compatibility with the very weak security
127# of /usr/bin/rsh.  Their use is not recommended and the functionality
128# will be removed when support for v1 protocol is removed.
129
130# Should sshd use .rhosts and .shosts for password less authentication.
131IgnoreRhosts yes
132RhostsAuthentication no
133
134# Rhosts RSA Authentication
135# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts.
136# If the user on the client side is not root then this won't work on
137# Solaris since /usr/bin/ssh is not installed setuid.
138RhostsRSAAuthentication no
139
140# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication.
141#IgnoreUserKnownHosts yes
142
143# Is pure RSA authentication allowed.
144# Default is yes
145RSAAuthentication yes
146