89 lines
2.0 KiB
Plaintext
89 lines
2.0 KiB
Plaintext
|
# Potiron
|
||
|
|
||
|
LogLevel INFO # The possible values are: QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3.
|
||
|
#VersionAddendum Niver
|
||
|
AllowGroups root ht
|
||
|
Subsystem sftp /usr/lib/ssh/sftp-server
|
||
|
|
||
|
## Network
|
||
|
|
||
|
AddressFamily any
|
||
|
ListenAddress 0.0.0.0
|
||
|
ListenAddress ::
|
||
|
Port 22
|
||
|
|
||
|
## Cryptography
|
||
|
|
||
|
HostKey /etc/ssh/keys/ed25519
|
||
|
HostKey /etc/ssh/keys/rsa-3072
|
||
|
|
||
|
Ciphers chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr
|
||
|
HostKeyAlgorithms ssh-ed25519,rsa-sha2-256,rsa-sha2-512
|
||
|
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
|
||
|
MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com
|
||
|
|
||
|
## Sessions
|
||
|
|
||
|
PermitRootLogin prohibit-password
|
||
|
StrictModes yes
|
||
|
MaxAuthTries 6
|
||
|
MaxSessions 1
|
||
|
MaxStartups 3:20:200
|
||
|
LoginGraceTime 3m
|
||
|
PrintMotd yes
|
||
|
|
||
|
## Disable everything
|
||
|
|
||
|
PermitTTY no
|
||
|
PermitTunnel no
|
||
|
|
||
|
AllowTcpForwarding no
|
||
|
X11Forwarding no
|
||
|
AllowAgentForwarding no
|
||
|
AllowStreamLocalForwarding no
|
||
|
DisableForwarding yes # Disables all forwarding features, including X11, ssh-agent(1), TCP and StreamLocal.
|
||
|
|
||
|
PermitUserRC no
|
||
|
PermitUserEnvironment no
|
||
|
IgnoreRhosts yes
|
||
|
AuthorizedKeysFile none
|
||
|
|
||
|
AuthenticationMethods none
|
||
|
PubkeyAuthentication no
|
||
|
PasswordAuthentication no
|
||
|
KbdInteractiveAuthentication no
|
||
|
PermitEmptyPasswords no
|
||
|
ChallengeResponseAuthentication no
|
||
|
|
||
|
UsePAM no
|
||
|
|
||
|
## Enable usefull features
|
||
|
|
||
|
### Administrator access
|
||
|
Match Group root
|
||
|
|
||
|
#### Authentication
|
||
|
PubkeyAuthentication yes
|
||
|
AuthenticationMethods publickey
|
||
|
AuthorizedKeysFile .ssh/authorized_keys
|
||
|
|
||
|
#### Allow the use of a terminal
|
||
|
PermitTTY yes
|
||
|
|
||
|
### SFTP access
|
||
|
Match Group ht
|
||
|
|
||
|
#### Authentication
|
||
|
PasswordAuthentication yes
|
||
|
AuthenticationMethods password
|
||
|
#AuthorizedKeysFile keys
|
||
|
|
||
|
#### Chroot to the home directory
|
||
|
ChrootDirectory %h # %h is home directory, %u is username
|
||
|
|
||
|
#### Only SFTP can be used
|
||
|
ForceCommand internal-sftp
|
||
|
|
||
|
#### Print a message before login
|
||
|
Banner /usr/local/share/niver/banner.txt
|