9c12812735
Some major changes: * the charm has been rebased (from a Python perspective) to be rooted in the charm directory. This is a single root. * Imports have been changed so that the don't add lots of imports to the namespace of the module doing the import. * The code that used to run at module import time has been made lazy such that it only has to run if the relevant functions are called. This includes restart_on_change parameters, the harden function and the parameters to the guard_map. Appropriate changes will be submitted to charm-helpers. * Several tests had to be re-written as (incorrect) mocking meant that text fixtures didn't actually match what the code was doing. Thus, the tests were meaningless. * This has had a net positive impact on the unit tests wrt to importing modules and mocking. Change-Id: Id07d9d1caaa9b29453a63c2e49ba831071e9457f
160 lines
4.4 KiB
Plaintext
160 lines
4.4 KiB
Plaintext
###############################################################################
|
|
# WARNING: This configuration file is maintained by Juju. Local changes may
|
|
# be overwritten.
|
|
###############################################################################
|
|
# Package generated configuration file
|
|
# See the sshd_config(5) manpage for details
|
|
|
|
# What ports, IPs and protocols we listen for
|
|
{% for port in ports -%}
|
|
Port {{ port }}
|
|
{% endfor -%}
|
|
AddressFamily {{ addr_family }}
|
|
# Use these options to restrict which interfaces/protocols sshd will bind to
|
|
{% if ssh_ip -%}
|
|
{% for ip in ssh_ip -%}
|
|
ListenAddress {{ ip }}
|
|
{% endfor %}
|
|
{%- else -%}
|
|
ListenAddress ::
|
|
ListenAddress 0.0.0.0
|
|
{% endif -%}
|
|
Protocol 2
|
|
{% if ciphers -%}
|
|
Ciphers {{ ciphers }}
|
|
{% endif -%}
|
|
{% if macs -%}
|
|
MACs {{ macs }}
|
|
{% endif -%}
|
|
{% if kexs -%}
|
|
KexAlgorithms {{ kexs }}
|
|
{% endif -%}
|
|
# HostKeys for protocol version 2
|
|
{% for keyfile in host_key_files -%}
|
|
HostKey {{ keyfile }}
|
|
{% endfor -%}
|
|
|
|
# Privilege Separation is turned on for security
|
|
{% if use_priv_sep -%}
|
|
UsePrivilegeSeparation {{ use_priv_sep }}
|
|
{% endif -%}
|
|
|
|
# Lifetime and size of ephemeral version 1 server key
|
|
KeyRegenerationInterval 3600
|
|
ServerKeyBits 1024
|
|
|
|
# Logging
|
|
SyslogFacility AUTH
|
|
LogLevel VERBOSE
|
|
|
|
# Authentication:
|
|
LoginGraceTime 30s
|
|
{% if allow_root_with_key -%}
|
|
PermitRootLogin without-password
|
|
{% else -%}
|
|
PermitRootLogin no
|
|
{% endif %}
|
|
PermitTunnel no
|
|
PermitUserEnvironment no
|
|
StrictModes yes
|
|
|
|
RSAAuthentication yes
|
|
PubkeyAuthentication yes
|
|
AuthorizedKeysFile %h/.ssh/authorized_keys
|
|
|
|
# Don't read the user's ~/.rhosts and ~/.shosts files
|
|
IgnoreRhosts yes
|
|
# For this to work you will also need host keys in /etc/ssh_known_hosts
|
|
RhostsRSAAuthentication no
|
|
# similar for protocol version 2
|
|
HostbasedAuthentication no
|
|
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
|
|
IgnoreUserKnownHosts yes
|
|
|
|
# To enable empty passwords, change to yes (NOT RECOMMENDED)
|
|
PermitEmptyPasswords no
|
|
|
|
# Change to yes to enable challenge-response passwords (beware issues with
|
|
# some PAM modules and threads)
|
|
ChallengeResponseAuthentication no
|
|
|
|
# Change to no to disable tunnelled clear text passwords
|
|
PasswordAuthentication {{ password_authentication }}
|
|
|
|
# Kerberos options
|
|
KerberosAuthentication no
|
|
KerberosGetAFSToken no
|
|
KerberosOrLocalPasswd no
|
|
KerberosTicketCleanup yes
|
|
|
|
# GSSAPI options
|
|
GSSAPIAuthentication no
|
|
GSSAPICleanupCredentials yes
|
|
|
|
X11Forwarding {{ allow_x11_forwarding }}
|
|
X11DisplayOffset 10
|
|
X11UseLocalhost yes
|
|
GatewayPorts no
|
|
PrintMotd {{ print_motd }}
|
|
PrintLastLog {{ print_last_log }}
|
|
TCPKeepAlive no
|
|
UseLogin no
|
|
|
|
ClientAliveInterval {{ client_alive_interval }}
|
|
ClientAliveCountMax {{ client_alive_count }}
|
|
AllowTcpForwarding {{ allow_tcp_forwarding }}
|
|
AllowAgentForwarding {{ allow_agent_forwarding }}
|
|
|
|
MaxStartups 10:30:100
|
|
#Banner /etc/issue.net
|
|
|
|
# Allow client to pass locale environment variables
|
|
AcceptEnv LANG LC_*
|
|
|
|
# Set this to 'yes' to enable PAM authentication, account processing,
|
|
# and session processing. If this is enabled, PAM authentication will
|
|
# be allowed through the ChallengeResponseAuthentication and
|
|
# PasswordAuthentication. Depending on your PAM configuration,
|
|
# PAM authentication via ChallengeResponseAuthentication may bypass
|
|
# the setting of "PermitRootLogin without-password".
|
|
# If you just want the PAM account and session checks to run without
|
|
# PAM authentication, then enable this but set PasswordAuthentication
|
|
# and ChallengeResponseAuthentication to 'no'.
|
|
UsePAM {{ use_pam }}
|
|
|
|
{% if deny_users -%}
|
|
DenyUsers {{ deny_users }}
|
|
{% endif -%}
|
|
{% if allow_users -%}
|
|
AllowUsers {{ allow_users }}
|
|
{% endif -%}
|
|
{% if deny_groups -%}
|
|
DenyGroups {{ deny_groups }}
|
|
{% endif -%}
|
|
{% if allow_groups -%}
|
|
AllowGroups allow_groups
|
|
{% endif -%}
|
|
UseDNS {{ use_dns }}
|
|
MaxAuthTries {{ max_auth_tries }}
|
|
MaxSessions {{ max_sessions }}
|
|
|
|
{% if sftp_enable -%}
|
|
# Configuration, in case SFTP is used
|
|
## override default of no subsystems
|
|
## Subsystem sftp /opt/app/openssh5/libexec/sftp-server
|
|
Subsystem sftp internal-sftp -l VERBOSE
|
|
|
|
## These lines must appear at the *end* of sshd_config
|
|
Match Group {{ sftp_group }}
|
|
ForceCommand internal-sftp -l VERBOSE
|
|
ChrootDirectory {{ sftp_chroot }}
|
|
{% else -%}
|
|
# Configuration, in case SFTP is used
|
|
## override default of no subsystems
|
|
## Subsystem sftp /opt/app/openssh5/libexec/sftp-server
|
|
## These lines must appear at the *end* of sshd_config
|
|
Match Group sftponly
|
|
ForceCommand internal-sftp -l VERBOSE
|
|
ChrootDirectory /sftpchroot/home/%u
|
|
{% endif %}
|