2021-08-29 17:39:12 +02:00
|
|
|
# Potiron
|
|
|
|
|
|
|
|
LogLevel INFO # The possible values are: QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3.
|
|
|
|
#VersionAddendum Niver
|
|
|
|
AllowGroups root ht
|
2021-08-29 21:41:15 +02:00
|
|
|
Subsystem sftp internal-sftp
|
|
|
|
#Subsystem sftp sftp-server
|
2021-08-29 17:39:12 +02:00
|
|
|
|
|
|
|
## Network
|
|
|
|
|
|
|
|
AddressFamily any
|
|
|
|
ListenAddress 0.0.0.0
|
|
|
|
ListenAddress ::
|
|
|
|
Port 22
|
|
|
|
|
|
|
|
## Cryptography
|
|
|
|
|
2021-08-29 21:41:15 +02:00
|
|
|
HostKey /etc/ssh/ed25519
|
|
|
|
HostKey /etc/ssh/rsa-3072
|
2021-08-29 17:39:12 +02:00
|
|
|
|
|
|
|
Ciphers chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr
|
|
|
|
HostKeyAlgorithms ssh-ed25519,rsa-sha2-256,rsa-sha2-512
|
|
|
|
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
|
|
|
|
MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com
|
|
|
|
|
|
|
|
## Sessions
|
|
|
|
|
|
|
|
PermitRootLogin prohibit-password
|
|
|
|
StrictModes yes
|
|
|
|
MaxAuthTries 6
|
|
|
|
MaxSessions 1
|
|
|
|
MaxStartups 3:20:200
|
|
|
|
LoginGraceTime 3m
|
|
|
|
PrintMotd yes
|
|
|
|
|
2021-08-29 21:41:15 +02:00
|
|
|
UsePAM yes
|
|
|
|
|
2021-08-29 17:39:12 +02:00
|
|
|
## Disable everything
|
|
|
|
|
|
|
|
PermitTTY no
|
|
|
|
PermitTunnel no
|
|
|
|
|
|
|
|
AllowTcpForwarding no
|
|
|
|
X11Forwarding no
|
|
|
|
AllowAgentForwarding no
|
|
|
|
AllowStreamLocalForwarding no
|
|
|
|
DisableForwarding yes # Disables all forwarding features, including X11, ssh-agent(1), TCP and StreamLocal.
|
|
|
|
|
|
|
|
PermitUserRC no
|
|
|
|
PermitUserEnvironment no
|
|
|
|
IgnoreRhosts yes
|
|
|
|
AuthorizedKeysFile none
|
|
|
|
|
|
|
|
AuthenticationMethods none
|
|
|
|
PubkeyAuthentication no
|
|
|
|
PasswordAuthentication no
|
|
|
|
KbdInteractiveAuthentication no
|
|
|
|
PermitEmptyPasswords no
|
|
|
|
ChallengeResponseAuthentication no
|
|
|
|
|
|
|
|
## Enable usefull features
|
|
|
|
|
|
|
|
### Administrator access
|
|
|
|
Match Group root
|
|
|
|
|
|
|
|
#### Authentication
|
|
|
|
PubkeyAuthentication yes
|
|
|
|
AuthenticationMethods publickey
|
|
|
|
AuthorizedKeysFile .ssh/authorized_keys
|
|
|
|
|
|
|
|
#### Allow the use of a terminal
|
|
|
|
PermitTTY yes
|
|
|
|
|
|
|
|
### SFTP access
|
|
|
|
Match Group ht
|
|
|
|
|
|
|
|
#### Authentication
|
|
|
|
PasswordAuthentication yes
|
|
|
|
AuthenticationMethods password
|
|
|
|
#AuthorizedKeysFile keys
|
|
|
|
|
|
|
|
#### Chroot to the home directory
|
|
|
|
ChrootDirectory %h # %h is home directory, %u is username
|
|
|
|
|
|
|
|
#### Only SFTP can be used
|
|
|
|
ForceCommand internal-sftp
|
|
|
|
|
|
|
|
#### Print a message before login
|
|
|
|
Banner /usr/local/share/niver/banner.txt
|