UNIX for Advanced & Expert Users

    #   $OpenBSD: sshd_config,v 1.82 2010/09/06 17:10:19 naddy Exp $

    # This is the sshd server system-wide configuration file.  See
    # sshd_config(5) for more information.

    # This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

    # The strategy used for options in the default sshd_config shipped with
    # OpenSSH is to specify options with their default value where
    # possible, but leave them commented.  Uncommented options change a
    # default value.

    Port 22
    AddressFamily inet
    ListenAddress 0.0.0.0
    #ListenAddress ::

    # The default requires explicit activation of protocol 1
    Protocol 2

    # HostKey for protocol version 1
    #HostKey /etc/ssh/ssh_host_key
    # HostKeys for protocol version 2
    #HostKey /etc/ssh/ssh_host_rsa_key
    HostKey /etc/ssh/ssh_host_dsa_key
    #HostKey /etc/ssh/ssh_host_ecdsa_key

    # Lifetime and size of ephemeral version 1 server key
    #KeyRegenerationInterval 1h
    #ServerKeyBits 1024

    # Logging
    # obsoletes QuietMode and FascistLogging
    #SyslogFacility AUTH
    #LogLevel INFO

    # Authentication:

    LoginGraceTime 2m
    PermitRootLogin no
    #StrictModes yes
    MaxAuthTries 3
    #MaxSessions 10

    RSAAuthentication no
    PasswordAuthentication no
    UsePAM no
     
    PubkeyAuthentication yes
    AuthorizedKeysFile   .ssh/authorized_keys

    # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
    #RhostsRSAAuthentication no
    # similar for protocol version 2
    #HostbasedAuthentication no
    # Change to yes if you don't trust ~/.ssh/known_hosts for
    # RhostsRSAAuthentication and HostbasedAuthentication
    #IgnoreUserKnownHosts no
    # Don't read the user's ~/.rhosts and ~/.shosts files
    #IgnoreRhosts yes

    # To disable tunneled clear text passwords, change to no here!
    #PasswordAuthentication yes
    #PermitEmptyPasswords no

    # Change to no to disable s/key passwords
    #ChallengeResponseAuthentication yes
    ChallengeResponseAuthentication no

    # Kerberos options
    KerberosAuthentication no
    GSSAPIAuthentication no
    #KerberosOrLocalPasswd yes
    #KerberosTicketCleanup yes
    #KerberosGetAFSToken no

    AllowGroups sshusers

    # GSSAPI options
    #GSSAPIAuthentication no
    #GSSAPICleanupCredentials yes

    # Set this to 'yes' to enable PAM authentication, account processing,
    # and session processing. If this is enabled, PAM authentication will
    # be allowed through the ChallengeResponseAuthentication and
    # PasswordAuthentication.  Depending on your PAM configuration,
    # PAM authentication via ChallengeResponseAuthentication may bypass
    # the setting of "PermitRootLogin without-password".
    # If you just want the PAM account and session checks to run without
    # PAM authentication, then enable this but set PasswordAuthentication
    # and ChallengeResponseAuthentication to 'no'.
    UsePAM yes
    #UsePAM no

    #AllowAgentForwarding yes
    AllowTcpForwarding no
    #GatewayPorts no
    #X11Forwarding no
    #X11DisplayOffset 10
    #X11UseLocalhost yes
    #PrintMotd yes
    #PrintLastLog yes
    #TCPKeepAlive yes
    #UseLogin no
    #UsePrivilegeSeparation yes
    #PermitUserEnvironment no
    #Compression delayed
    #ClientAliveInterval 0
    #ClientAliveCountMax 3
    UseDNS no
    #PidFile /var/run/sshd.pid
    MaxStartups 2
    #PermitTunnel no
    ChrootDirectory none
    #ChrootDirectory /var/services/homes/%u
    #DenyUsers admin

    # no default banner path
    #Banner none

    # override default of no subsystems
    #Subsystem   sftp   /usr/libexec/sftp-server
    #Subsystem       sftp    internal-sftp -f DAEMON -l VERBOSE -u 000
    Subsystem       sftp    internal-sftp -f DAEMON -u 000
    #Subsystem       sftp    /usr/syno/sbin/sftp-server -l DEBUG3

    # the following are HPN related configuration options
    # tcp receive buffer polling. disable in non autotuning kernels
    #TcpRcvBufPoll yes
     
    # allow the use of the none cipher
    #NoneEnabled no

    # disable hpn performance boosts.
    #HPNDisabled no

    # buffer size for hpn to non-hpn connections
    #HPNBufferSize 2048


    # Example of overriding settings on a per-user basis
    Match User root
    #   X11Forwarding no
       AllowTcpForwarding yes
    #   ForceCommand cvs server