From ece3afde12bea114ea36be3186c069ed8403317b Mon Sep 17 00:00:00 2001
From: mh <mh@d66ca3ae-40d7-4aa7-90d4-87d79ca94279>
Date: Fri, 13 Jun 2008 21:01:39 +0000
Subject: merged with puzzle

git-svn-id: https://svn/ipuppet/trunk/modules/sshd@1614 d66ca3ae-40d7-4aa7-90d4-87d79ca94279
---
 templates/sshd_config/Debian_normal.erb | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

(limited to 'templates/sshd_config/Debian_normal.erb')

diff --git a/templates/sshd_config/Debian_normal.erb b/templates/sshd_config/Debian_normal.erb
index 746cc0b..c969836 100644
--- a/templates/sshd_config/Debian_normal.erb
+++ b/templates/sshd_config/Debian_normal.erb
@@ -2,7 +2,7 @@
 # See the sshd(8) manpage for defails
 
 # What ports, IPs and protocols we listen for
-Port 22
+# Port 22
 # Use these options to restrict which interfaces/protocols sshd will bind to
 #ListenAddress ::
 #ListenAddress 0.0.0.0
@@ -27,7 +27,11 @@ LogLevel INFO
 
 # Authentication:
 LoginGraceTime 600
+<%- unless real_sshd_permit_root_login.to_s.empty? then %>
+PermitRootLogin <%= real_sshd_permit_root_login %>
+<%- else %>
 PermitRootLogin without-password
+<%- end %>
 StrictModes yes
 
 RSAAuthentication yes
@@ -52,8 +56,11 @@ PermitEmptyPasswords no
 #ChallengeResponseAuthentication no
 
 # To disable tunneled clear text passwords, change to no here!
+<%- if real_sshd_password_authentication.to_s == 'yes' then %>
+PasswordAuthentication yes
+<%- else %>
 PasswordAuthentication no
-
+<%- end %>
 
 # To change Kerberos options
 #KerberosAuthentication no
@@ -64,7 +71,11 @@ PasswordAuthentication no
 # Kerberos TGT Passing does only work with the AFS kaserver
 #KerberosTgtPassing yes
 
+<%- if real_sshd_x11_forwarding.to_s == 'yes' then %>
+X11Forwarding yes
+<%- else %>
 X11Forwarding no
+<%- end %>
 X11DisplayOffset 10
 PrintMotd no
 PrintLastLog no
@@ -77,11 +88,17 @@ KeepAlive yes
 
 #Subsystem	sftp	/usr/lib/sftp-server
 
+<%- if real_sshd_use_pam.to_s == 'yes' then %>
+UsePAM yes
+<%- else %>
 UsePAM no
+<%- end %>
 
 HostbasedUsesNameFromPacketOnly yes
 AllowTcpForwarding yes
 
 ChallengeResponseAuthentication no
 
+<%- unless real_sshd_allowed_users.to_s.empty? then %>
 AllowUsers <%= real_sshd_allowed_users %>
+<%- end %>
-- 
cgit v1.2.3