saltstack-formulas/openssh-formula
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

rebase based on latest update

Browse Source
This commit is contained in:
ek9 2017-02-07 19:45:59 +01:00
parent 2db9253c45
commit d6e48f2b43
1 changed files with 22 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
pillar.example
View File

@ -13,7 +13,7 @@ sshd_config:
- /etc/ssh/ssh_host_ed25519_key - /etc/ssh/ssh_host_ed25519_key
UsePrivilegeSeparation: 'yes' UsePrivilegeSeparation: 'yes'
KeyRegenerationInterval: 3600 KeyRegenerationInterval: 3600
ServerKeyBits: 768 ServerKeyBits: 1024
SyslogFacility: AUTH SyslogFacility: AUTH
LogLevel: INFO LogLevel: INFO
ClientAliveInterval: 0 ClientAliveInterval: 0
@ -35,9 +35,9 @@ sshd_config:
ChallengeResponseAuthentication: 'no' ChallengeResponseAuthentication: 'no'
AuthenticationMethods: 'publickey,keyboard-interactive' AuthenticationMethods: 'publickey,keyboard-interactive'
AuthorizedKeysFile: '%h/.ssh/authorized_keys' AuthorizedKeysFile: '%h/.ssh/authorized_keys'
X11Forwarding: 'yes' X11Forwarding: 'no'
X11DisplayOffset: 10 X11DisplayOffset: 10
PrintMotd: 'no' PrintMotd: 'yes'
PrintLastLog: 'yes' PrintLastLog: 'yes'
TCPKeepAlive: 'yes' TCPKeepAlive: 'yes'
AcceptEnv: "LANG LC_*" AcceptEnv: "LANG LC_*"
@ -58,14 +58,26 @@ sshd_config:
AllowTcpForwarding: no AllowTcpForwarding: no
ForceCommand: internal-sftp ForceCommand: internal-sftp
# Check `man sshd_config` for supported KexAlgorithms, Ciphers and MACs first. # Check `man sshd_config` for supported KexAlgorithms, Ciphers and MACs first.
# For these three keywords, the options may be specified as a list... # You can specify KexAlgorithms, Ciphers and MACs as both key or a list.
# The configuration given in the example below is based on:
# https://stribika.github.io/2015/01/04/secure-secure-shell.html
#KexAlgorithms: 'curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1'
#Ciphers: 'chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr'
#MACs: 'hmac-sha1'
KexAlgorithms: KexAlgorithms:
- diffie-hellman-group14-sha1 - 'curve25519-sha256@libssh.org'
- diffie-hellman-group1-sha1 - 'diffie-hellman-group-exchange-sha256'
# ... or a single string. - 'diffie-hellman-group-exchange-sha1'
Ciphers: 'aes128-ctr,aes256-ctr' - 'diffie-hellman-group14-sha1'
MACs: 'hmac-sha1' Ciphers:
# Similar situation for ssh_config - 'chacha20-poly1305@openssh.com'
- 'aes256-gcm@openssh.com'
- 'aes128-gcm@openssh.com'
- 'aes256-ctr'
- 'aes192-ctr'
- 'aes128-ctr'
MACs:
- 'hmac-sha1'
ssh_config: ssh_config:
StrictHostKeyChecking: no StrictHostKeyChecking: no