matthew-parlette
10 years ago
2 changed files with 1 additions and 123 deletions
+ 0
- 123
openssh/files/sshd_config
View File
| {%- endfor %} | {%- endfor %} | ||||
| {%- endif %} | {%- endif %} | ||||
| {%- endfor %} | {%- endfor %} | ||||
| # What ports, IPs and protocols we listen for | |||||
| #Port 22 | |||||
| # Use these options to restrict which interfaces/protocols sshd will bind to | |||||
| #ListenAddress :: | |||||
| #ListenAddress 0.0.0.0 | |||||
| #Protocol 2 | |||||
| # HostKeys for protocol version 2 | |||||
| #HostKey /etc/ssh/ssh_host_rsa_key | |||||
| #HostKey /etc/ssh/ssh_host_dsa_key | |||||
| #HostKey /etc/ssh/ssh_host_ecdsa_key | |||||
| #Privilege Separation is turned on for security | |||||
| #UsePrivilegeSeparation yes | |||||
| # Lifetime and size of ephemeral version 1 server key | |||||
| #KeyRegenerationInterval 3600 | |||||
| #ServerKeyBits 768 | |||||
| # Logging | |||||
| #SyslogFacility AUTH | |||||
| #LogLevel INFO | |||||
| # Authentication: | |||||
| #LoginGraceTime 120 | |||||
| #PermitRootLogin yes | |||||
| #StrictModes yes | |||||
| #RSAAuthentication yes | |||||
| #PubkeyAuthentication yes | |||||
| #AuthorizedKeysFile %h/.ssh/authorized_keys | |||||
| # Don't read the user's ~/.rhosts and ~/.shosts files | |||||
| #IgnoreRhosts yes | |||||
| # For this to work you will also need host keys in /etc/ssh_known_hosts | |||||
| #RhostsRSAAuthentication no | |||||
| # similar for protocol version 2 | |||||
| #HostbasedAuthentication no | |||||
| # Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication | |||||
| #IgnoreUserKnownHosts yes | |||||
| # To enable empty passwords, change to yes (NOT RECOMMENDED) | |||||
| #PermitEmptyPasswords no | |||||
| # Change to yes to enable challenge-response passwords (beware issues with | |||||
| # some PAM modules and threads) | |||||
| #ChallengeResponseAuthentication no | |||||
| # Change to no to disable tunnelled clear text passwords | |||||
| #PasswordAuthentication yes | |||||
| # Kerberos options | |||||
| #KerberosAuthentication no | |||||
| #KerberosGetAFSToken no | |||||
| #KerberosOrLocalPasswd yes | |||||
| #KerberosTicketCleanup yes | |||||
| # GSSAPI options | |||||
| #GSSAPIAuthentication no | |||||
| #GSSAPICleanupCredentials yes | |||||
| #X11Forwarding yes | |||||
| #X11DisplayOffset 10 | |||||
| #PrintMotd no | |||||
| #PrintLastLog yes | |||||
| #TCPKeepAlive yes | |||||
| #UseLogin no | |||||
| #MaxStartups 10:30:60 | |||||
| #Banner /etc/issue.net | |||||
| # Allow client to pass locale environment variables | |||||
| #AcceptEnv LANG LC_* | |||||
| #Subsystem sftp /usr/lib/openssh/sftp-server | |||||
| # Set this to 'yes' to enable PAM authentication, account processing, | |||||
| # and session processing. If this is enabled, PAM authentication will | |||||
| # be allowed through the ChallengeResponseAuthentication and | |||||
| # PasswordAuthentication. Depending on your PAM configuration, | |||||
| # PAM authentication via ChallengeResponseAuthentication may bypass | |||||
| # the setting of "PermitRootLogin without-password". | |||||
| # If you just want the PAM account and session checks to run without | |||||
| # PAM authentication, then enable this but set PasswordAuthentication | |||||
| # and ChallengeResponseAuthentication to 'no'. | |||||
| UsePAM yes | |||||
| #AllowAgentForwarding yes | |||||
| #AllowTcpForwarding yes | |||||
| #GatewayPorts no | |||||
| X11Forwarding yes | |||||
| #X11DisplayOffset 10 | |||||
| #X11UseLocalhost yes | |||||
| PrintMotd no # pam does that | |||||
| #PrintLastLog yes | |||||
| #TCPKeepAlive yes | |||||
| #UseLogin no | |||||
| {% if grains['os_family'] == 'RedHat' %} | |||||
| UsePrivilegeSeparation yes # RedHat/Centos 6.4 and earlier currently ship 5.3 (sandbox introduced in OpenSSH 5.9) | |||||
| {% else %} | |||||
| UsePrivilegeSeparation sandbox # Default for new installations. | |||||
| {% endif %} | |||||
| #PermitUserEnvironment no | |||||
| #Compression delayed | |||||
| #ClientAliveInterval 0 | |||||
| #ClientAliveCountMax 3 | |||||
| #UseDNS yes | |||||
| #PidFile /run/sshd.pid | |||||
| #MaxStartups 10:30:100 | |||||
| #PermitTunnel no | |||||
| #ChrootDirectory none | |||||
| #VersionAddendum none | |||||
| # no default banner path | |||||
| Banner /etc/ssh/banner | |||||
| # override default of no subsystems | |||||
| Subsystem sftp /usr/lib/ssh/sftp-server | |||||
| # Example of overriding settings on a per-user basis | |||||
| #Match User anoncvs | |||||
| # X11Forwarding no | |||||
| # AllowTcpForwarding no | |||||
| # ForceCommand cvs server |
+ 1
- 0
pillar.example
View File
| LogLevel: INFO | LogLevel: INFO | ||||
| LoginGraceTime: 120 | LoginGraceTime: 120 | ||||
| PermitRootLogin: yes | PermitRootLogin: yes | ||||
| PasswordAuthentication: no | |||||
| StrictModes: yes | StrictModes: yes | ||||
| RSAAuthentication: yes | RSAAuthentication: yes | ||||
| PubkeyAuthentication: yes | PubkeyAuthentication: yes |
Loading…