1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138

#       $OpenBSD: sshd_config,v 1.100 2016/08/15 12:32:04 naddy Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/local/bin:/usr/bin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

# If you want to change the port on a SELinux system, you have to tell
# SELinux about this change.
# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER    <==在开启 selinux 的系统上，修改 ssh 端口的要修改 selinux 规则，用此命令修改
#
#Port 22           <==默认 ssh 端口，生产环境中建议改成五位数的端口 
#AddressFamily any   <==地址家族，any 表示同时监听 ipv4 和 ipv6 地址
#ListenAddress 0.0.0.0  <==监听本机所有 ipv4 地址
#ListenAddress ::    <==监听本机所有 ipv6 地址
HostKey /etc/ssh/ssh_host_rsa_key   <==ssh所使用的RSA私钥路径
#HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key   <==ssh所使用的ECDSA私钥路径
HostKey /etc/ssh/ssh_host_ed25519_key   <==ssh所使用的ED25519私钥路径

# Ciphers and keying
#RekeyLimit default none

# Logging
#SyslogFacility AUTH
SyslogFacility AUTHPRIV    <==设定在记录来自sshd的消息的时候，是否给出“facility code”
#LogLevel INFO    <==日志记录级别，默认为 info 

# Authentication:

#LoginGraceTime 2m    <==限定用户认证时间为 2min
#PermitRootLogin yes   <==是否允许 root 账户 ssh 登录，生产环境中建议改成 no，使用普通账户 ssh 登录
#StrictModes yes    <==设置 ssh 在接收登录请求之前是否检查用户根目录和 rhosts 文件的权限和所有权，建议开启
#MaxAuthTries 6   <==指定每个连接最大允许的认证次数。默认值是 6
#MaxSessions 10   <==最大允许保持多少个连接。默认值是 10 

#PubkeyAuthentication yes  <==是否开启公钥验证

# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
# but this is overridden so installations will only check .ssh/authorized_keys
AuthorizedKeysFile      .ssh/authorized_keys   <==公钥验证文件路径

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication   <==指定服务器在使用 ~/.shosts ~/.rhosts /etc/hosts.equiv 进行远程主机名匹配时，是否进行反向域名查询
#IgnoreUserKnownHosts no  <==是否在 RhostsRSAAuthentication 或 HostbasedAuthentication 过程中忽略用户的 ~/.ssh/known_hosts 文件
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes   <==是否在 RhostsRSAAuthentication 或 HostbasedAuthentication 过程中忽略 .rhosts 和 .shosts 文件

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no    <==是否允许空密码
PasswordAuthentication yes   <==是否允许密码验证，生产环境中建议改成no，只用密钥登录

# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes
ChallengeResponseAuthentication no   <==是否允许质疑-应答(challenge-response)认证

# Kerberos options
#KerberosAuthentication no   <==是否使用 Kerberos 认证
#KerberosOrLocalPasswd yes   <==如果 Kerberos 密码认证失败，那么该密码还将要通过其它的认证机制 (比如 /etc/passwd)
#KerberosTicketCleanup yes  <==是否在用户退出登录后自动销毁用户的 ticket
#KerberosGetAFSToken no  <==如果使用了 AFS 并且该用户有一个 Kerberos 5 TGT，那么开启该指令后，将会在访问用户的家目录前尝试获取一个 AFS token
#KerberosUseKuserok yes

# GSSAPI options
GSSAPIAuthentication yes   <==是否允许基于GSSAPI的用户认证
GSSAPICleanupCredentials no    <==是否在用户退出登录后自动销毁用户凭证缓存
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no
#GSSAPIEnablek5users no

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
# WARNING: 'UsePAM no' is not supported in Red Hat Enterprise Linux and may cause several
# problems.
UsePAM yes   <==是否通过PAM验证

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no     <==是否允许远程主机连接本地的转发端口
X11Forwarding yes    <==是否允许X11转发
#X11DisplayOffset 10  <==指定 sshd（8）X11 转发的第一个可用的显示区 (display) 数字。默认值是 10
#X11UseLocalhost yes  <==是否应当将 X11 转发服务器绑定到本地 loopback 地址
#PermitTTY yes
#PrintMotd yes     <==指定 sshd(8) 是否在每一次交互式登录时打印 /etc/motd 文件的内容
#PrintLastLog yes  <==指定 sshd(8) 是否在每一次交互式登录时打印最后一位用户的登录时间
#TCPKeepAlive yes  <==指定系统是否向客户端发送 TCP keepalive 消息
#UseLogin no   <==是否在交互式会话的登录过程中使用 login（1）
#UsePrivilegeSeparation sandbox  <==是否让 sshd(8) 通过创建非特权子进程处理接入请求的方法来进行权限分离
#PermitUserEnvironment no  <==指定是否允许 sshd(8) 处理~/.ssh/environment 以及 ~/.ssh/authorized_keys 中的 environment= 选项
#Compression delayed  <==是否对通信数据进行加密，还是延迟到认证成功之后再对通信数据加密
#ClientAliveInterval 0  <==sshd(8) 长时间没有收到客户端的任何数据，不发送"alive"消息
#ClientAliveCountMax 3   <==sshd(8) 在未收到任何客户端回应前最多允许发送多个"alive"消息，默认值是 3 
#ShowPatchLevel no
#UseDNS no      <==是否使用 dns 反向解析
#PidFile /var/run/sshd.pid   <==指定存放 SSH 守护进程的进程号的路径
#MaxStartups 10:30:100   <==最大允许保持多少个未认证的连接
#PermitTunnel no   <==是否允许 tun(4) 设备转发
#ChrootDirectory none
#VersionAddendum none

# no default banner path
#Banner none  <==将这个指令指定的文件中的内容在用户进行认证前显示给远程用户，默认什么内容也不显示，"none"表示禁用这个特性

# Accept locale-related environment variables
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS

# override default of no subsystems
Subsystem       sftp    /usr/libexec/openssh/sftp-server   <==配置一个外部子系统sftp及其路径

# Example of overriding settings on a per-user basis
#Match User anoncvs    <==引入一个条件块。块的结尾标志是另一个 Match 指令或者文件结尾    
#       X11Forwarding no
#       AllowTcpForwarding no
#       PermitTTY no
#       ForceCommand cvs server