62 lines
1.2 KiB
Plaintext
62 lines
1.2 KiB
Plaintext
|
LogLevel INFO
|
||
|
AllowUsers root
|
||
|
Subsystem sftp internal-sftp
|
||
|
UsePAM yes
|
||
|
|
||
|
# Network
|
||
|
|
||
|
AddressFamily any
|
||
|
ListenAddress [::]
|
||
|
ListenAddress 0.0.0.0
|
||
|
Port 42022
|
||
|
|
||
|
# Cryptography
|
||
|
|
||
|
HostKey /etc/ssh/ed25519
|
||
|
|
||
|
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com
|
||
|
HostKeyAlgorithms ssh-ed25519
|
||
|
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org
|
||
|
MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com
|
||
|
|
||
|
# Sessions
|
||
|
|
||
|
PermitRootLogin prohibit-password
|
||
|
StrictModes yes
|
||
|
MaxAuthTries 6
|
||
|
MaxSessions 1
|
||
|
MaxStartups 3:20:200
|
||
|
LoginGraceTime 3m
|
||
|
PrintMotd yes
|
||
|
|
||
|
# Disable everything
|
||
|
|
||
|
PermitTTY no
|
||
|
PermitTunnel no
|
||
|
|
||
|
AllowTcpForwarding no
|
||
|
X11Forwarding no
|
||
|
AllowAgentForwarding no
|
||
|
AllowStreamLocalForwarding no
|
||
|
DisableForwarding yes # Disables all forwarding features, including X11, ssh-agent(1), TCP and StreamLocal.
|
||
|
|
||
|
PermitUserRC no
|
||
|
PermitUserEnvironment no
|
||
|
IgnoreRhosts yes
|
||
|
AuthorizedKeysFile none
|
||
|
|
||
|
AuthenticationMethods none
|
||
|
PubkeyAuthentication no
|
||
|
PasswordAuthentication no
|
||
|
KbdInteractiveAuthentication no
|
||
|
PermitEmptyPasswords no
|
||
|
ChallengeResponseAuthentication no
|
||
|
|
||
|
# Enable what is necessary
|
||
|
|
||
|
Match User root
|
||
|
PermitTTY yes
|
||
|
PubkeyAuthentication yes
|
||
|
AuthenticationMethods publickey
|
||
|
AuthorizedKeysFile .ssh/authorized_keys
|