From 06163fbb920bf7f8dbb7ae2018e1f861003ed9ce Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Fri, 26 Sep 2008 17:34:09 -0400 Subject: added sshd_rhosts_rsa_authentication variable, default set to no added sshd_hostbased_authentication variable, default set to no --- templates/sshd_config/Debian_normal.erb | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) (limited to 'templates/sshd_config/Debian_normal.erb') diff --git a/templates/sshd_config/Debian_normal.erb b/templates/sshd_config/Debian_normal.erb index 155c4da..28e799d 100644 --- a/templates/sshd_config/Debian_normal.erb +++ b/templates/sshd_config/Debian_normal.erb @@ -53,8 +53,12 @@ PubkeyAuthentication no #AuthorizedKeysFile %h/.ssh/authorized_keys -# rhosts authentication should not be used -#RhostsAuthentication no +# For this to work you will also need host keys in /etc/ssh_known_hosts +<%- if real_sshd_rhosts_rsa_authentication.to_s == 'yes' then %> +RhostsRSAAuthentication yes +<%- else %> +RhostsRSAAuthentication no +<% end -%> # Don't read the user's ~/.rhosts and ~/.shosts files <%- if real_sshd_pubkey_authentication.to_s == 'yes' then %> @@ -63,10 +67,13 @@ IgnoreRhosts yes IgnoreRhosts no <% end -%> -# For this to work you will also need host keys in /etc/ssh_known_hosts -RhostsRSAAuthentication no # similar for protocol version 2 +<%- if real_sshd_hostbased_authentication.to_s == 'yes' then %> +HostbasedAuthentication yes +<%- else %> HostbasedAuthentication no +<% end -%> + # Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication #IgnoreUserKnownHosts yes -- cgit v1.2.3