diff options
Diffstat (limited to 'package/openssh/files')
| -rw-r--r-- | package/openssh/files/sshd.init | 47 | ||||
| -rw-r--r-- | package/openssh/files/sshd_config | 113 |
2 files changed, 160 insertions, 0 deletions
diff --git a/package/openssh/files/sshd.init b/package/openssh/files/sshd.init new file mode 100644 index 000000000..19774b891 --- /dev/null +++ b/package/openssh/files/sshd.init @@ -0,0 +1,47 @@ +#!/bin/sh +#FWINIT 50 +. /etc/rc.conf + +case $1 in +autostop) ;; +autostart) + [[ $openssh = NO ]] && exit 0 + grep dropbear_flags /etc/rc.conf >/dev/null 2>&1 || dropbear_flags=NO + if [[ $openssh = AUTO && $dropbear_flags != NO ]]; then + echo openssh not starting: set to AUTO and dropbear is enabled + exit 0 + fi + exec sh $0 start + ;; +start) + if [[ ! -s /etc/ssh/ssh_host_rsa_key ]]; then + mkdir -p /etc/ssh + if [[ ! -x /usr/bin/ssh-keygen ]]; then + bothlog openssh not starting: SSH private key missing + exit 0 + fi + echo "openssh: generating SSH private key (RSA)" + /usr/bin/ssh-keygen -N '' -t rsa -f /etc/ssh/ssh_host_rsa_key + rv=$? + echo openssh: key generation exited with code $rv + [[ $rv = 0 && -s /etc/ssh/ssh_host_rsa_key ]] || exit 1 + fi + mkdir -p /var/run/sshd + mkdir -p /var/empty + /usr/sbin/sshd + ;; +stop) + if [ -e /var/run/sshd.pid ]; then + kill $(cat /var/run/sshd.pid) + fi + ;; +restart) + sh $0 stop + sh $0 start + ;; +*) + echo "Usage: $0 {start | stop | restart}" + exit 1 + ;; +esac +exit $? diff --git a/package/openssh/files/sshd_config b/package/openssh/files/sshd_config new file mode 100644 index 000000000..19b87bd17 --- /dev/null +++ b/package/openssh/files/sshd_config @@ -0,0 +1,113 @@ +# $OpenBSD: sshd_config,v 1.80 2008/07/02 02:24:18 djm Exp $ + +# This is the sshd server system-wide configuration file. See +# sshd_config(5) for more information. + +# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin + +# The strategy used for options in the default sshd_config shipped with +# OpenSSH is to specify options with their default value where +# possible, but leave them commented. Uncommented options change a +# default value. + +#Port 22 +#AddressFamily any +ListenAddress 0.0.0.0 +#ListenAddress :: + +# Disable legacy (protocol version 1) support in the server for new +# installations. In future the default will change to require explicit +# activation of protocol 1 +Protocol 2 + +# HostKey for protocol version 1 +#HostKey /etc/ssh/ssh_host_key +# HostKeys for protocol version 2 +HostKey /etc/ssh/ssh_host_rsa_key +#HostKey /etc/ssh/ssh_host_dsa_key + +# Lifetime and size of ephemeral version 1 server key +#KeyRegenerationInterval 1h +#ServerKeyBits 1024 + +# Logging +# obsoletes QuietMode and FascistLogging +#SyslogFacility AUTH +#LogLevel INFO + +# Authentication: + +#LoginGraceTime 2m +PermitRootLogin without-password +#StrictModes yes +#MaxAuthTries 6 +#MaxSessions 10 + +#RSAAuthentication yes +PubkeyAuthentication yes +AuthorizedKeysFile /etc/ssh/authorized_keys + +# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts +#RhostsRSAAuthentication no +# similar for protocol version 2 +#HostbasedAuthentication no +# Change to yes if you don't trust ~/.ssh/known_hosts for +# RhostsRSAAuthentication and HostbasedAuthentication +#IgnoreUserKnownHosts no +# Don't read the user's ~/.rhosts and ~/.shosts files +#IgnoreRhosts yes + +# To disable tunneled clear text passwords, change to no here! +#PasswordAuthentication yes +#PermitEmptyPasswords no + +# Change to no to disable s/key passwords +#ChallengeResponseAuthentication yes + +# GSSAPI options for Kerberos 5 +#GSSAPIAuthentication no +#GSSAPICleanupCredentials yes + +# Set this to 'yes' to enable PAM authentication, account processing, +# and session processing. If this is enabled, PAM authentication will +# be allowed through the ChallengeResponseAuthentication and +# PasswordAuthentication. Depending on your PAM configuration, +# PAM authentication via ChallengeResponseAuthentication may bypass +# the setting of "PermitRootLogin without-password". +# If you just want the PAM account and session checks to run without +# PAM authentication, then enable this but set PasswordAuthentication +# and ChallengeResponseAuthentication to 'no'. +#UsePAM no + +#AllowAgentForwarding yes +#AllowTcpForwarding yes +#GatewayPorts no +#X11Forwarding no +#X11DisplayOffset 10 +#X11UseLocalhost yes +#PrintMotd yes +#PrintLastLog yes +#TCPKeepAlive yes +#UseLogin no +UsePrivilegeSeparation yes +#PermitUserEnvironment no +#Compression delayed +#ClientAliveInterval 0 +#ClientAliveCountMax 3 +#UseDNS yes +#PidFile /var/run/sshd.pid +#MaxStartups 10 +#PermitTunnel no +#ChrootDirectory none + +# no default banner path +#Banner none + +# override default of no subsystems +Subsystem sftp /usr/sbin/sftp-server + +# Example of overriding settings on a per-user basis +#Match User anoncvs +# X11Forwarding no +# AllowTcpForwarding no +# ForceCommand cvs server |