From: Matthew Dillon <dillon@apollo.backplane.com>
Date: Sun, 15 Nov 2009 18:33:06 +0000 (-0800)
Subject: SSHD - Change default security
X-Git-Tag: v2.7.1~378
X-Git-Url: https://gitweb.dragonflybsd.org/dragonfly.git/commitdiff_plain/85088528028b88399264dd4c006aeff001bbeb6b

SSHD - Change default security

This only effects fresh installs.

* Allow root logins via public key only (previously: root logins not allowed
  at all via ssh).  I've done this for years, it allows an authorized_keys
  file in ~root/.ssh to work without having to adjust /etc/ssh/sshd_config
  on every install.

* Do not allow any login, root or otherwise, via tunneled plaintext password
  (previously: non-root logins were allowed via plaintext password).

  Often people want plaintext passwords on e.g. workstations for xdm or
  console logins, but do not want to allow their use over networked
  connections.  Since tunneled plaintext passwords are not considered very
  secure and alternatives exist (aka public key logins) we now disallow
  them by default.
---

diff --git a/crypto/openssh/sshd_config b/crypto/openssh/sshd_config
index df3e627ee0..bb04d5d850 100644
--- a/crypto/openssh/sshd_config
+++ b/crypto/openssh/sshd_config
@@ -44,7 +44,8 @@ Protocol 2
 # Authentication:
 
 #LoginGraceTime 2m
-#PermitRootLogin no
+# only allow root logins via public key pair
+PermitRootLogin without-password
 #StrictModes yes
 #MaxAuthTries 6
 #MaxSessions 10
@@ -65,7 +66,8 @@ Protocol 2
 #IgnoreRhosts yes
 
 # To disable tunneled clear text passwords, change to no here!
-#PasswordAuthentication yes
+# We disable cleartext passwords by default
+PasswordAuthentication no
 #PermitEmptyPasswords no
 
 # Change to no to disable PAM authentication