rh124_ssh

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision		 Previous revision
rh124_ssh [2026/10/23 13:26] – [/etc/ssh/ system-wide SSH configuration] rpjdayrh124_ssh [2026/10/30 08:42] (current) – [The SSH host keys] rpjday
Line 109: Line 109:
 </code> </code>
  
 +Both higher-level packages depend on ''openssh'':
 +
 +<code>
 +$ rpm -qR openssh-server
 +$ rpm -qR openssh-clients
 +</code>
 ===== /etc/ssh/ system-wide SSH configuration ===== ===== /etc/ssh/ system-wide SSH configuration =====
  
Line 163: Line 169:
 -rw-r--r--. 1 root root  554 Oct 17 12:19 ssh_host_rsa_key.pub -rw-r--r--. 1 root root  554 Oct 17 12:19 ssh_host_rsa_key.pub
 $ $
 +</code>
 +
 +Every SSH server has a static, unique cryptographic key pair consisting of a private host key (kept strictly secret on the server) and a public host key (shared with clients).
 +
 +===== sshd_config file =====
 +
 +<code>
 +# This is the sshd server system-wide configuration file.  See
 +# sshd_config(5) for more information.
 +
 +# This sshd was compiled with PATH=/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin
 +
 +# The strategy used for options in the default sshd_config shipped with
 +# OpenSSH is to specify options with their default value where
 +# possible, but leave them commented.  Uncommented options override the
 +# default value.
 +
 +# To modify the system-wide sshd configuration, create a  *.conf  file under
 +#  /etc/ssh/sshd_config.d/  which will be automatically included below
 +Include /etc/ssh/sshd_config.d/*.conf
 +
 +# If you want to change the port on a SELinux system, you have to tell
 +# SELinux about this change.
 +# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
 +#
 +#Port 22
 +#AddressFamily any
 +#ListenAddress 0.0.0.0
 +#ListenAddress ::
 +
 +#HostKey /etc/ssh/ssh_host_rsa_key
 +#HostKey /etc/ssh/ssh_host_ecdsa_key
 +#HostKey /etc/ssh/ssh_host_ed25519_key
 +
 +# Ciphers and keying
 +#RekeyLimit default none
 +
 +# Logging
 +#SyslogFacility AUTH
 +#LogLevel INFO
 +
 +# Authentication:
 +
 +#LoginGraceTime 2m
 +#PermitRootLogin prohibit-password
 +#StrictModes yes
 +#MaxAuthTries 6
 +#MaxSessions 10
 +
 +#PubkeyAuthentication yes
 +
 +# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
 +# but this is overridden so installations will only check .ssh/authorized_keys
 +AuthorizedKeysFile      .ssh/authorized_keys
 +
 +#AuthorizedPrincipalsFile none
 +
 +#AuthorizedKeysCommand none
 +#AuthorizedKeysCommandUser nobody
 +
 +# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
 +#HostbasedAuthentication no
 +# Change to yes if you don't trust ~/.ssh/known_hosts for
 +# HostbasedAuthentication
 +#IgnoreUserKnownHosts no
 +# Don't read the user's ~/.rhosts and ~/.shosts files
 +#IgnoreRhosts yes
 +
 +# To disable tunneled clear text passwords, change to no here!
 +#PasswordAuthentication yes
 +#PermitEmptyPasswords no
 +
 +# Change to no to disable s/key passwords
 +#KbdInteractiveAuthentication yes
 +
 +# Kerberos options
 +#KerberosAuthentication no
 +#KerberosOrLocalPasswd yes
 +#KerberosTicketCleanup yes
 +#KerberosGetAFSToken no
 +#KerberosUseKuserok yes
 +
 +# GSSAPI options
 +#GSSAPIAuthentication no
 +#GSSAPICleanupCredentials yes
 +#GSSAPIStrictAcceptorCheck yes
 +#GSSAPIKeyExchange no
 +#GSSAPIEnablek5users no
 +
 +# Set this to 'yes' to enable PAM authentication, account processing,
 +# and session processing. If this is enabled, PAM authentication will
 +# be allowed through the KbdInteractiveAuthentication and
 +# PasswordAuthentication.  Depending on your PAM configuration,
 +# PAM authentication via KbdInteractiveAuthentication may bypass
 +# the setting of "PermitRootLogin prohibit-password".
 +# If you just want the PAM account and session checks to run without
 +# PAM authentication, then enable this but set PasswordAuthentication
 +# and KbdInteractiveAuthentication to 'no'.
 +# WARNING: 'UsePAM no' is not supported in this build and may cause several
 +# problems.
 +#UsePAM no
 +
 +#AllowAgentForwarding yes
 +#AllowTcpForwarding yes
 +#GatewayPorts no
 +#X11Forwarding no
 +#X11DisplayOffset 10
 +#X11UseLocalhost yes
 +#PermitTTY yes
 +#PrintMotd yes
 +#PrintLastLog yes
 +#TCPKeepAlive yes
 +#PermitUserEnvironment no
 +#Compression delayed
 +#ClientAliveInterval 0
 +#ClientAliveCountMax 3
 +#UseDNS no
 +#PidFile /var/run/sshd.pid
 +#MaxStartups 10:30:100
 +#PermitTunnel no
 +#ChrootDirectory none
 +#VersionAddendum none
 +
 +# no default banner path
 +#Banner none
 +
 +# override default of no subsystems
 +Subsystem       sftp    /usr/libexec/openssh/sftp-server
 +
 +# Example of overriding settings on a per-user basis
 +#Match User anoncvs
 +#       X11Forwarding no
 +#       AllowTcpForwarding no
 +#       PermitTTY no
 +#       ForceCommand cvs server
 </code> </code>
  
  
  • rh124_ssh.1792761995.txt.gz
  • Last modified: 2026/10/23 13:26
  • by rpjday