shell-things/etc/ssh/ssh_config

64 lines
2.2 KiB
Plaintext
Raw Normal View History

# This works as a /etc/ssh/ssh_config or ~/.ssh/config like how I keep
# using it. Higher option takes priority (keep `Host *` bottom)
# User specific configs
Include ~/.ssh/config.d/*.conf
# Debian includes this
Include /etc/ssh/ssh_config.d/*.conf
2015-09-01 15:48:27 +02:00
Host *
2015-09-06 07:15:17 +02:00
# Path for the control socket.
ControlPath ~/.ssh/sockets/socket-%r@%h:%p
2015-09-01 15:48:27 +02:00
# Multiple sessions over single connection
ControlMaster yes
# Keep connection open in the background even after connection has been
# closed.
ControlPersist yes
2015-09-01 15:48:27 +02:00
# SSH Agent forwarding is behind a lot of security breaches, never do it
# Most recently https://github.com/matrix-org/matrix.org/issues/371
2015-09-01 15:48:27 +02:00
ForwardAgent no
# Never do that either https://security.stackexchange.com/a/14817/234532
2015-09-01 15:48:27 +02:00
ForwardX11 no
# Debian sets this as yes, upstream no. TODO: What is it?
#GSSAPIAuthentication yes
2015-09-01 15:48:27 +02:00
# Ensure KnownHosts are unreadable if leaked.
HashKnownHosts yes
LogLevel VERBOSE
Protocol 2
2022-10-10 22:00:16 +02:00
# Tor through openbsd netcat (Fedora: netcat)
ProxyCommand netcat -X 5 -x localhost:9050 %h %p
2015-09-06 07:15:17 +02:00
# Always try public key authentication.
2015-09-01 15:48:27 +02:00
PubkeyAuthentication yes
2015-09-12 10:42:44 +02:00
# Send needed environment variables. I don't like setting wildcards
# and LC_ALL is disabled on purpouse.
2015-09-12 10:45:42 +02:00
SendEnv EDITOR LANG LANGUAGE LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT LC_IDENTIFICATION TERM TZ
2015-09-05 22:46:00 +02:00
2015-09-06 07:15:17 +02:00
# If the server doesn't reply in three "pings", connection is dead.
2015-09-01 15:48:27 +02:00
# Defaults to 3 anyway, but I add it here for clearity and
# in case it decides to change in the future.
ServerAliveCountMax 3
# "ping" the server every minute.
ServerAliveInterval 60
2015-09-02 07:15:16 +02:00
# OpenSSH 6.8+ - ask all host keys from servers.
# I trust the server admins and ways to identify the keys (DNSSEC,
# manual).
2015-09-02 07:15:16 +02:00
UpdateHostKeys yes
# Workaround CVE-2016-0777 & CVE-0778 on OpenSSH < 7.1p2
UseRoaming no
# Verify SSHFP records. If this is yes, the question is skipped when
# DNSSEC is used, but apparently only "ask" and "no" write known_hosts
# However with "ask" you won't be told whether the zone is signed, so
# I consider "yes" to be the least evil.
VerifyHostKeyDNS yes