diff options
Diffstat (limited to 'templates/sshd_config/Debian_etch.erb')
| -rw-r--r-- | templates/sshd_config/Debian_etch.erb | 55 |
1 files changed, 34 insertions, 21 deletions
diff --git a/templates/sshd_config/Debian_etch.erb b/templates/sshd_config/Debian_etch.erb index 09be201..28aa52c 100644 --- a/templates/sshd_config/Debian_etch.erb +++ b/templates/sshd_config/Debian_etch.erb @@ -2,14 +2,14 @@ # See the sshd(8) manpage for details # What ports, IPs and protocols we listen for -<%- unless real_sshd_port.to_s.empty? then -%> -Port <%= real_sshd_port -%> +<%- unless sshd_port.to_s.empty? then -%> +Port <%= sshd_port -%> <%- else -%> Port 22 <%- end -%> # Use these options to restrict which interfaces/protocols sshd will bind to -<% for address in real_sshd_listen_address -%> +<% for address in sshd_listen_address -%> ListenAddress <%= address %> <% end -%> Protocol 2 @@ -33,52 +33,52 @@ LogLevel INFO # Authentication: LoginGraceTime 600 -<%- unless real_sshd_permit_root_login.to_s.empty? then -%> -PermitRootLogin <%= real_sshd_permit_root_login -%> +<%- unless sshd_permit_root_login.to_s.empty? then -%> +PermitRootLogin <%= sshd_permit_root_login -%> <%- else -%> PermitRootLogin without-password <%- end -%> -<%- if real_sshd_strict_modes.to_s == 'yes' then -%> +<%- if sshd_strict_modes.to_s == 'yes' then -%> StrictModes yes <%- else -%> StrictModes no <%- end -%> -<%- if real_sshd_rsa_authentication.to_s == 'yes' then -%> +<%- if sshd_rsa_authentication.to_s == 'yes' then -%> RSAAuthentication yes <%- else -%> RSAAuthentication no <%- end -%> -<%- if real_sshd_pubkey_authentication.to_s == 'yes' then -%> +<%- if sshd_pubkey_authentication.to_s == 'yes' then -%> PubkeyAuthentication yes <%- else -%> PubkeyAuthentication no <%- end -%> -<%- unless real_sshd_authorized_keys_file.to_s.empty? then -%> -AuthorizedKeysFile <%= real_sshd_authorized_keys_file %> +<%- unless sshd_authorized_keys_file.to_s.empty? then -%> +AuthorizedKeysFile <%= sshd_authorized_keys_file %> <%- else -%> AuthorizedKeysFile %h/.ssh/authorized_keys <%- end -%> # For this to work you will also need host keys in /etc/ssh_known_hosts -<%- if real_sshd_rhosts_rsa_authentication.to_s == 'yes' then -%> +<%- if sshd_rhosts_rsa_authentication.to_s == 'yes' then -%> RhostsRSAAuthentication yes <%- else -%> RhostsRSAAuthentication no <% end -%> # Don't read the user's ~/.rhosts and ~/.shosts files -<%- if real_sshd_ignore_rhosts.to_s == 'yes' then -%> +<%- if sshd_ignore_rhosts.to_s == 'yes' then -%> IgnoreRhosts yes <%- else -%> IgnoreRhosts no <% end -%> # similar for protocol version 2 -<%- if real_sshd_hostbased_authentication.to_s == 'yes' then -%> +<%- if sshd_hostbased_authentication.to_s == 'yes' then -%> HostbasedAuthentication yes <%- else -%> HostbasedAuthentication no @@ -88,21 +88,21 @@ HostbasedAuthentication no #IgnoreUserKnownHosts yes # To enable empty passwords, change to yes (NOT RECOMMENDED) -<%- if real_sshd_permit_empty_passwords.to_s == 'yes' then -%> +<%- if sshd_permit_empty_passwords.to_s == 'yes' then -%> PermitEmptyPasswords yes <% else -%> PermitEmptyPasswords no <% end -%> # Change to no to disable s/key passwords -<%- if real_sshd_challenge_response_authentication.to_s == 'yes' then -%> +<%- if sshd_challenge_response_authentication.to_s == 'yes' then -%> ChallengeResponseAuthentication yes <%- else -%> ChallengeResponseAuthentication no <%- end -%> # To disable tunneled clear text passwords, change to no here! -<%- if real_sshd_password_authentication.to_s == 'yes' then -%> +<%- if sshd_password_authentication.to_s == 'yes' then -%> PasswordAuthentication yes <%- else -%> PasswordAuthentication no @@ -117,7 +117,7 @@ PasswordAuthentication no # Kerberos TGT Passing does only work with the AFS kaserver #KerberosTgtPassing yes -<%- if real_sshd_x11_forwarding.to_s == 'yes' then -%> +<%- if sshd_x11_forwarding.to_s == 'yes' then -%> X11Forwarding yes <%- else -%> X11Forwarding no @@ -130,7 +130,11 @@ KeepAlive yes #Banner /etc/issue.net #ReverseMappingCheck yes +<%- if sshd_sftp_subsystem.to_s.empty? then %> #Subsystem sftp /usr/lib/sftp-server +<%- else %> +Subsystem sftp <%= sshd_sftp_subsystem %> +<%- end %> # Set this to 'yes' to enable PAM authentication, account processing, # and session processing. If this is enabled, PAM authentication will @@ -141,7 +145,7 @@ KeepAlive yes # If you just want the PAM account and session checks to run without # PAM authentication, then enable this but set PasswordAuthentication # and ChallengeResponseAuthentication to 'no'. -<%- if real_sshd_use_pam.to_s == 'yes' then -%> +<%- if sshd_use_pam.to_s == 'yes' then -%> UsePAM yes <%- else -%> UsePAM no @@ -149,7 +153,7 @@ UsePAM no HostbasedUsesNameFromPacketOnly yes -<%- if real_sshd_tcp_forwarding.to_s == 'yes' then -%> +<%- if sshd_tcp_forwarding.to_s == 'yes' then -%> AllowTcpForwarding yes <%- else -%> AllowTcpForwarding no @@ -157,7 +161,16 @@ AllowTcpForwarding no ChallengeResponseAuthentication no -<%- unless real_sshd_allowed_users.to_s.empty? then -%> -AllowUsers <%= real_sshd_allowed_users -%> +<%- unless sshd_allowed_users.to_s.empty? then -%> +AllowUsers <%= sshd_allowed_users -%> <%- end -%> +<%- unless sshd_allowed_groups.to_s.empty? then %> +AllowGroups <%= sshd_allowed_groups %> +<%- end %> + + +<%- unless sshd_additional_options.to_s.empty? then %> +<%= sshd_additional_options %> +<%- end %> + |