From 3a6fa3088f13d17303ec9b88029a129b7654f42f Mon Sep 17 00:00:00 2001
From: Levente Polyak <anthraxx@archlinux.org>
Date: Wed, 8 Dec 2021 22:17:01 +0100
Subject: [PATCH] ssh: sync sshd_config template with latest package version
---
roles/sshd/templates/sshd_config.j2 | 14 ++++++--------
1 file changed, 6 insertions(+), 8 deletions(-)
diff --git a/roles/sshd/templates/sshd_config.j2 b/roles/sshd/templates/sshd_config.j2
index 111dbcba4..1a96ddd8b 100644
--- a/roles/sshd/templates/sshd_config.j2
+++ b/roles/sshd/templates/sshd_config.j2
@@ -1,9 +1,9 @@
-# $OpenBSD: sshd_config,v 1.101 2017/03/14 07:19:07 djm Exp $
+# $OpenBSD: sshd_config,v 1.104 2021/07/02 05:11:21 dtucker Exp $
# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.
-# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
+# This sshd was compiled with PATH=/usr/local/sbin:/usr/local/bin:/usr/bin
# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
@@ -16,7 +16,6 @@
#ListenAddress ::
#HostKey /etc/ssh/ssh_host_rsa_key
-#HostKey /etc/ssh/ssh_host_dsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
#HostKey /etc/ssh/ssh_host_ed25519_key
@@ -59,7 +58,7 @@ PasswordAuthentication no
#PermitEmptyPasswords no
# Change to no to disable s/key passwords
-ChallengeResponseAuthentication no
+KbdInteractiveAuthentication no
# Kerberos options
#KerberosAuthentication no
@@ -73,13 +72,13 @@ ChallengeResponseAuthentication no
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
-# be allowed through the ChallengeResponseAuthentication and
+# be allowed through the KbdInteractiveAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
-# PAM authentication via ChallengeResponseAuthentication may bypass
+# PAM authentication via KbdInteractiveAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
-# and ChallengeResponseAuthentication to 'no'.
+# and KbdInteractiveAuthentication to 'no'.
UsePAM yes
{% if 'buildservers' in group_names %}
@@ -97,7 +96,6 @@ AllowTcpForwarding no
PrintMotd no # pam does that
#PrintLastLog yes
#TCPKeepAlive yes
-#UseLogin no
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
--
GitLab