1#	$OpenBSD: sshd_config,v 1.104 2021/07/02 05:11:21 dtucker Exp $
2
3# This is the sshd server system-wide configuration file.  See
4# sshd_config(5) for more information.
5
6# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
7
8# The strategy used for options in the default sshd_config shipped with
9# OpenSSH is to specify options with their default value where
10# possible, but leave them commented.  Uncommented options override the
11# default value.
12
13# Note that some of FreeBSD's defaults differ from OpenBSD's, and
14# FreeBSD has a few additional options.
15
16#Port 22
17#AddressFamily any
18#ListenAddress 0.0.0.0
19#ListenAddress ::
20
21#HostKey /etc/ssh/ssh_host_rsa_key
22#HostKey /etc/ssh/ssh_host_ecdsa_key
23#HostKey /etc/ssh/ssh_host_ed25519_key
24
25# Ciphers and keying
26#RekeyLimit default none
27
28# Logging
29#SyslogFacility AUTH
30#LogLevel INFO
31
32# Authentication:
33
34#LoginGraceTime 2m
35#PermitRootLogin no
36#StrictModes yes
37#MaxAuthTries 6
38#MaxSessions 10
39
40#PubkeyAuthentication yes
41
42# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
43# but this is overridden so installations will only check .ssh/authorized_keys
44AuthorizedKeysFile	.ssh/authorized_keys
45
46#AuthorizedPrincipalsFile none
47
48#AuthorizedKeysCommand none
49#AuthorizedKeysCommandUser nobody
50
51# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
52#HostbasedAuthentication no
53# Change to yes if you don't trust ~/.ssh/known_hosts for
54# HostbasedAuthentication
55#IgnoreUserKnownHosts no
56# Don't read the user's ~/.rhosts and ~/.shosts files
57#IgnoreRhosts yes
58
59# Change to yes to enable built-in password authentication.
60# Note that passwords may also be accepted via KbdInteractiveAuthentication.
61#PasswordAuthentication no
62#PermitEmptyPasswords no
63
64# Change to no to disable PAM authentication
65#KbdInteractiveAuthentication yes
66
67# Kerberos options
68#KerberosAuthentication no
69#KerberosOrLocalPasswd yes
70#KerberosTicketCleanup yes
71#KerberosGetAFSToken no
72
73# GSSAPI options
74#GSSAPIAuthentication no
75#GSSAPICleanupCredentials yes
76
77# Set this to 'no' to disable PAM authentication, account processing,
78# and session processing. If this is enabled, PAM authentication will
79# be allowed through the KbdInteractiveAuthentication and
80# PasswordAuthentication.  Depending on your PAM configuration,
81# PAM authentication via KbdInteractiveAuthentication may bypass
82# the setting of "PermitRootLogin prohibit-password".
83# If you just want the PAM account and session checks to run without
84# PAM authentication, then enable this but set PasswordAuthentication
85# and KbdInteractiveAuthentication to 'no'.
86#UsePAM yes
87
88#AllowAgentForwarding yes
89#AllowTcpForwarding yes
90#GatewayPorts no
91#X11Forwarding no
92#X11DisplayOffset 10
93#X11UseLocalhost yes
94#PermitTTY yes
95#PrintMotd yes
96#PrintLastLog yes
97#TCPKeepAlive yes
98#PermitUserEnvironment no
99#Compression delayed
100#ClientAliveInterval 0
101#ClientAliveCountMax 3
102#UseDNS yes
103#PidFile /var/run/sshd.pid
104#MaxStartups 10:30:100
105#PermitTunnel no
106#ChrootDirectory none
107#UseBlacklist no
108#VersionAddendum FreeBSD-20240318
109
110# no default banner path
111#Banner none
112
113# override default of no subsystems
114Subsystem	sftp	/usr/libexec/sftp-server
115
116# Example of overriding settings on a per-user basis
117#Match User anoncvs
118#	X11Forwarding no
119#	AllowTcpForwarding no
120#	PermitTTY no
121#	ForceCommand cvs server
122