#Configuring openssh install#

The ChrootDirectory must contain the necessary files and directories to support the user's session. Is replaced by the home directory of the user being authenticated, and %u is replaced by the username of that user. The path may contain the following tokens that are expanded at runtime once the connecting user has been authenticated: %% is replaced by a literal '%', %h After the chroot, sshd(8) changes the working directory to the user's home directory. This path, and all its components, must be root-owned directories that are not writable by any other Specifies a path to chroot(2) to after authentication. via PAM or though authentication styles supported in nf(5)) The default is Specifies whether challenge-response authentication is allowed (e.g. Option is only available for protocol version 2. If the argument is ''none'' then no banner is displayed.

The contents of the specified file are sent to the remote user before authentication is allowed. After expansion, AuthorizedKeysFile is taken to be an absolute path or one The following tokens are defined: %% is replaced by a literal '%', %h is replaced by the home directory of the userīeing authenticated, and %u is replaced by the username of that user. AuthorizedKeysFile may contain tokens of the form %T whichĪre substituted during connection setup. Specifies the file that contains the public keys that can be used for user authentication. The allow/deny directives are processed in theįollowing order: DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups. If the pattern takes the form USER and HOST are separately checked, restricting logins to particular users from particular hosts. By default, login is allowed for all users.

Only user names are valid a numerical user ID is not recognized. If specified, login is allowed only for user names that match one of the This keyword can be followed by a list of user name patterns, separated by spaces.

#Configuring openssh install#

Note that disabling TCP forwarding does not improve security unless users are alsoĭenied shell access, as they can always install their own forwarders. Specifies whether TCP forwarding is permitted. See PATTERNS in ssh_config(5) for more information on patterns. The allow/deny directives are processed in the following order: DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups. Only group names are valid a numerical group ID is not recognized. Supplementary group list matches one of the patterns. If specified, login is allowed only for users whose primary group or This keyword can be followed by a list of group name patterns, separated by spaces. Note that disabling agent forwarding does not improve security unless users areĪlso denied shell access, as they can always install their own forwarders. Specifies whether ssh-agent(1) forwarding is permitted. Valid arguments are ''any'', ''inet'' (use IPv4 only), or ''inet6'' (use IPv6 only). Specifies which address family should be used by sshd(8). Theĭefault is not to accept any environment variables. For this reason, care should be taken in the use of this directive. Some environment variables could be used to bypass restricted user environments. Multiple environment variables may be separated by whitespace or spread across multiple AcceptEnv directives. Variables are specified by name, which may contain the wildcardĬharacters '*' and '?'. Note that environment passing is only supported for protocol 2. See SendEnv in ssh_config(5) for how toĬonfigure the client. The possible keywords and their meanings are as follows (note that keywords are case-insensitive and arguments are case-sensitive):ĪcceptEnv Specifies what environment variables sent by the client will be copied into the session's environ(7). Quotes (') in order to represent arguments containing spaces. Arguments may optionally be enclosed in double Lines starting with '#' and empty lines are interpreted as comments. Sshd(8) reads configuration data from /etc/ssh/sshd_config (or the file specified with -f on the command line). Sshd_config - OpenSSH SSH daemon configuration file