2020-02-17 10:57:13 +00:00
|
|
|
diff -up openssh/ssh_config.redhat openssh/ssh_config
|
|
|
|
|
--- openssh/ssh_config.redhat 2020-02-11 23:28:35.000000000 +0100
|
|
|
|
|
+++ openssh/ssh_config 2020-02-13 18:13:39.180641839 +0100
|
|
|
|
|
@@ -43,3 +43,7 @@
|
2016-06-03 14:22:59 +00:00
|
|
|
# VisualHostKey no
|
|
|
|
|
# ProxyCommand ssh -q -W %h:%p gateway.example.com
|
|
|
|
|
# RekeyLimit 1G 1h
|
|
|
|
|
+#
|
2016-09-29 09:26:06 +00:00
|
|
|
+# To modify the system-wide ssh configuration, create a *.conf file under
|
|
|
|
|
+# /etc/ssh/ssh_config.d/ which will be automatically included below
|
2016-08-04 08:57:32 +00:00
|
|
|
+Include /etc/ssh/ssh_config.d/*.conf
|
2020-02-17 10:57:13 +00:00
|
|
|
diff -up openssh/ssh_config_redhat.redhat openssh/ssh_config_redhat
|
|
|
|
|
--- openssh/ssh_config_redhat.redhat 2020-02-13 18:13:39.180641839 +0100
|
|
|
|
|
+++ openssh/ssh_config_redhat 2020-02-13 18:13:39.180641839 +0100
|
2019-01-23 14:35:07 +00:00
|
|
|
@@ -0,0 +1,21 @@
|
|
|
|
|
+# The options here are in the "Match final block" to be applied as the last
|
|
|
|
|
+# options and could be potentially overwritten by the user configuration
|
|
|
|
|
+Match final all
|
|
|
|
|
+ # Follow system-wide Crypto Policy, if defined:
|
|
|
|
|
+ Include /etc/crypto-policies/back-ends/openssh.config
|
2016-09-29 09:26:06 +00:00
|
|
|
+
|
2011-09-07 13:12:54 +00:00
|
|
|
+ GSSAPIAuthentication yes
|
2016-08-04 08:57:32 +00:00
|
|
|
+
|
2011-09-07 13:12:54 +00:00
|
|
|
+# If this option is set to yes then remote X11 clients will have full access
|
|
|
|
|
+# to the original X11 display. As virtually no X11 client supports the untrusted
|
|
|
|
|
+# mode correctly we set this to yes.
|
|
|
|
|
+ ForwardX11Trusted yes
|
2016-08-04 08:57:32 +00:00
|
|
|
+
|
2011-09-07 13:12:54 +00:00
|
|
|
+# Send locale-related environment variables
|
2013-10-14 13:54:41 +00:00
|
|
|
+ SendEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
|
|
|
|
|
+ SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
|
2011-09-07 13:12:54 +00:00
|
|
|
+ SendEnv LC_IDENTIFICATION LC_ALL LANGUAGE
|
|
|
|
|
+ SendEnv XMODIFIERS
|
2019-01-23 14:35:07 +00:00
|
|
|
+
|
|
|
|
|
+# Uncomment this if you want to use .local domain
|
|
|
|
|
+# Host *.local
|
2020-02-17 10:57:13 +00:00
|
|
|
diff -up openssh/sshd_config.0.redhat openssh/sshd_config.0
|
|
|
|
|
--- openssh/sshd_config.0.redhat 2020-02-12 14:30:04.000000000 +0100
|
|
|
|
|
+++ openssh/sshd_config.0 2020-02-13 18:13:39.181641855 +0100
|
|
|
|
|
@@ -970,9 +970,9 @@ DESCRIPTION
|
2017-01-02 14:42:13 +00:00
|
|
|
|
|
|
|
|
SyslogFacility
|
|
|
|
|
Gives the facility code that is used when logging messages from
|
|
|
|
|
- sshd(8). The possible values are: DAEMON, USER, AUTH, LOCAL0,
|
|
|
|
|
- LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. The
|
|
|
|
|
- default is AUTH.
|
|
|
|
|
+ sshd(8). The possible values are: DAEMON, USER, AUTH, AUTHPRIV,
|
|
|
|
|
+ LOCAL0, LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
|
|
|
|
|
+ The default is AUTH.
|
|
|
|
|
|
|
|
|
|
TCPKeepAlive
|
|
|
|
|
Specifies whether the system should send TCP keepalive messages
|
2020-02-17 10:57:13 +00:00
|
|
|
diff -up openssh/sshd_config.5.redhat openssh/sshd_config.5
|
|
|
|
|
--- openssh/sshd_config.5.redhat 2020-02-11 23:28:35.000000000 +0100
|
|
|
|
|
+++ openssh/sshd_config.5 2020-02-13 18:13:39.181641855 +0100
|
|
|
|
|
@@ -1614,7 +1614,7 @@ By default no subsystems are defined.
|
2017-01-02 14:42:13 +00:00
|
|
|
.It Cm SyslogFacility
|
|
|
|
|
Gives the facility code that is used when logging messages from
|
|
|
|
|
.Xr sshd 8 .
|
|
|
|
|
-The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2,
|
|
|
|
|
+The possible values are: DAEMON, USER, AUTH, AUTHPRIV, LOCAL0, LOCAL1, LOCAL2,
|
|
|
|
|
LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
|
|
|
|
|
The default is AUTH.
|
|
|
|
|
.It Cm TCPKeepAlive
|
2020-02-17 10:57:13 +00:00
|
|
|
diff -up openssh/sshd_config.redhat openssh/sshd_config
|
|
|
|
|
--- openssh/sshd_config.redhat 2020-02-11 23:28:35.000000000 +0100
|
|
|
|
|
+++ openssh/sshd_config 2020-02-13 18:20:16.349913681 +0100
|
2019-11-19 12:16:28 +00:00
|
|
|
@@ -10,6 +10,10 @@
|
2012-10-26 14:34:55 +00:00
|
|
|
# possible, but leave them commented. Uncommented options override the
|
|
|
|
|
# default value.
|
|
|
|
|
|
|
|
|
|
+# If you want to change the port on a SELinux system, you have to tell
|
|
|
|
|
+# SELinux about this change.
|
|
|
|
|
+# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
|
|
|
|
|
+#
|
|
|
|
|
#Port 22
|
|
|
|
|
#AddressFamily any
|
|
|
|
|
#ListenAddress 0.0.0.0
|
2020-02-17 10:57:13 +00:00
|
|
|
@@ -114,3 +118,7 @@ Subsystem sftp /usr/libexec/sftp-server
|
|
|
|
|
# AllowTcpForwarding no
|
|
|
|
|
# PermitTTY no
|
|
|
|
|
# ForceCommand cvs server
|
|
|
|
|
+
|
|
|
|
|
+# To modify the system-wide ssh configuration, create a *.conf file under
|
|
|
|
|
+# /etc/ssh/sshd_config.d/ which will be automatically included below
|
|
|
|
|
+Include /etc/ssh/sshd_config.d/*.conf
|
|
|
|
|
diff -up openssh/sshd_config_redhat.redhat openssh/sshd_config_redhat
|
|
|
|
|
--- openssh/sshd_config_redhat.redhat 2020-02-13 18:14:02.268006439 +0100
|
|
|
|
|
+++ openssh/sshd_config_redhat 2020-02-13 18:19:20.765035947 +0100
|
|
|
|
|
@@ -0,0 +1,31 @@
|
2017-08-09 13:14:13 +00:00
|
|
|
+# System-wide Crypto policy:
|
2018-07-03 09:26:01 +00:00
|
|
|
+# This system is following system-wide crypto policy. The changes to
|
2017-08-09 13:14:13 +00:00
|
|
|
+# Ciphers, MACs, KexAlgoritms and GSSAPIKexAlgorithsm will not have any
|
|
|
|
|
+# effect here. They will be overridden by command-line options passed on
|
|
|
|
|
+# the server start up.
|
|
|
|
|
+# To opt out, uncomment a line with redefinition of CRYPTO_POLICY=
|
|
|
|
|
+# variable in /etc/sysconfig/sshd to overwrite the policy.
|
|
|
|
|
+# For more information, see manual page for update-crypto-policies(8).
|
|
|
|
|
+
|
2011-09-07 13:12:54 +00:00
|
|
|
+SyslogFacility AUTHPRIV
|
2020-02-17 10:57:13 +00:00
|
|
|
+
|
2011-09-07 13:12:54 +00:00
|
|
|
+PasswordAuthentication yes
|
|
|
|
|
+ChallengeResponseAuthentication no
|
2020-02-17 10:57:13 +00:00
|
|
|
+
|
2011-09-07 13:12:54 +00:00
|
|
|
+GSSAPIAuthentication yes
|
2014-02-26 16:08:07 +00:00
|
|
|
+GSSAPICleanupCredentials no
|
2020-02-17 10:57:13 +00:00
|
|
|
+
|
2011-09-07 13:12:54 +00:00
|
|
|
+UsePAM yes
|
2020-02-17 10:57:13 +00:00
|
|
|
+
|
2011-09-07 13:12:54 +00:00
|
|
|
+X11Forwarding yes
|
2018-07-03 09:26:01 +00:00
|
|
|
+
|
2018-10-26 12:02:32 +00:00
|
|
|
+# It is recommended to use pam_motd in /etc/pam.d/sshd instead of PrintMotd,
|
2018-07-03 09:26:01 +00:00
|
|
|
+# as it is more configurable and versatile than the built-in version.
|
|
|
|
|
+PrintMotd no
|
|
|
|
|
+
|
2011-09-07 13:12:54 +00:00
|
|
|
+# Accept locale-related environment variables
|
|
|
|
|
+AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
|
|
|
|
|
+AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
|
|
|
|
|
+AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
|
|
|
|
|
+AcceptEnv XMODIFIERS
|
|
|
|
|
+
|
