YunoHost/yunohost
1
0
Fork 0
mirror of https://github.com/YunoHost/yunohost.git synced 2024-09-03 20:06:10 +02:00
Code Issues Projects Releases Packages Wiki Activity

ssh config: indent, misc readabilty improvements

Browse source
This commit is contained in:
Alexandre Aubin 2021-03-25 16:19:40 +01:00
parent f158a4da9e
commit b40f21458f
1 changed files with 12 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
data/templates/ssh/sshd_config
View file

@ -78,18 +78,17 @@ Subsystem sftp internal-sftp
# Apply following instructions to user with sftp perm only # Apply following instructions to user with sftp perm only
Match Group sftp.main,!ssh.main Match Group sftp.main,!ssh.main
ForceCommand internal-sftp ForceCommand internal-sftp
# We currently are not able to restrict /home/USER # We can't restrict to /home/%u because the chroot base must be owned by root
# So we chroot only on /home # So we chroot only on /home
# See https://serverfault.com/questions/584986/bad-ownership-or-modes-for-chroot-directory-component # See https://serverfault.com/questions/584986/bad-ownership-or-modes-for-chroot-directory-component
#ChrootDirectory /home/%u ChrootDirectory /home
ChrootDirectory /home # Forbid SFTP users from using their account SSH as a VPN (even if SSH login is disabled)
# Forbid SFTP users from using their account SSH as a VPN (even if SSH login is disabled) AllowTcpForwarding no
AllowTcpForwarding no AllowStreamLocalForwarding no
AllowStreamLocalForwarding no PermitTunnel no
PermitTunnel no # Disable .ssh/rc, which could be edited (e.g. from Nextcloud or whatever) by users to execute arbitrary commands even if SSH login is disabled
# Disable .ssh/rc, which could be edited (e.g. from Nextcloud or whatever) by users to execute arbitrary commands even if SSH login is disabled PermitUserRC no
PermitUserRC no
# root login is allowed on local networks # root login is allowed on local networks
@ -98,4 +97,4 @@ PermitUserRC no
# If the server is a VPS, it's expected that the owner of the # If the server is a VPS, it's expected that the owner of the
# server has access to a web console through which to log in. # server has access to a web console through which to log in.
Match Address 192.168.0.0/16,10.0.0.0/8,172.16.0.0/12,169.254.0.0/16,fe80::/10,fd00::/8 Match Address 192.168.0.0/16,10.0.0.0/8,172.16.0.0/12,169.254.0.0/16,fe80::/10,fd00::/8
PermitRootLogin yes PermitRootLogin yes