kentpeacock / rpms / openssh

Forked from rpms/openssh 2 years ago
Clone
b58e57
diff -up openssh-7.4p1/ssh_config.redhat openssh-7.4p1/ssh_config
b58e57
--- openssh-7.4p1/ssh_config.redhat	2017-02-08 15:22:30.811307915 +0100
b58e57
+++ openssh-7.4p1/ssh_config	2017-02-08 15:22:30.812307915 +0100
b58e57
@@ -52,3 +52,15 @@
b58e57
 # Uncomment this if you want to use .local domain
b58e57
 # Host *.local
b58e57
 #   CheckHostIP no
b58e57
+
b58e57
+Host *
b58e57
+	GSSAPIAuthentication yes
b58e57
+# If this option is set to yes then remote X11 clients will have full access
b58e57
+# to the original X11 display. As virtually no X11 client supports the untrusted
b58e57
+# mode correctly we set this to yes.
b58e57
+	ForwardX11Trusted yes
b58e57
+# Send locale-related environment variables
b58e57
+	SendEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
b58e57
+	SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
b58e57
+	SendEnv LC_IDENTIFICATION LC_ALL LANGUAGE
b58e57
+	SendEnv XMODIFIERS
b58e57
diff -up openssh-7.4p1/sshd_config.0.redhat openssh-7.4p1/sshd_config.0
b58e57
--- openssh-7.4p1/sshd_config.0.redhat	2016-12-19 06:21:22.000000000 +0100
b58e57
+++ openssh-7.4p1/sshd_config.0	2017-02-08 15:22:30.813307914 +0100
b58e57
@@ -837,9 +837,9 @@ DESCRIPTION
b58e57
 
b58e57
      SyslogFacility
b58e57
              Gives the facility code that is used when logging messages from
b58e57
-             sshd(8).  The possible values are: DAEMON, USER, AUTH, LOCAL0,
b58e57
-             LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.  The
b58e57
-             default is AUTH.
b58e57
+             sshd(8).  The possible values are: DAEMON, USER, AUTH, AUTHPRIV,
b58e57
+             LOCAL0, LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
b58e57
+             The default is AUTH.
b58e57
 
b58e57
      TCPKeepAlive
b58e57
              Specifies whether the system should send TCP keepalive messages
b58e57
diff -up openssh-7.4p1/sshd_config.5.redhat openssh-7.4p1/sshd_config.5
b58e57
--- openssh-7.4p1/sshd_config.5.redhat	2016-12-19 05:59:41.000000000 +0100
b58e57
+++ openssh-7.4p1/sshd_config.5	2017-02-08 15:22:30.813307914 +0100
b58e57
@@ -1393,7 +1393,7 @@ By default no subsystems are defined.
b58e57
 .It Cm SyslogFacility
b58e57
 Gives the facility code that is used when logging messages from
b58e57
 .Xr sshd 8 .
b58e57
-The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2,
b58e57
+The possible values are: DAEMON, USER, AUTH, AUTHPRIV, LOCAL0, LOCAL1, LOCAL2,
b58e57
 LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
b58e57
 The default is AUTH.
b58e57
 .It Cm TCPKeepAlive
b58e57
diff -up openssh-7.4p1/sshd_config.redhat openssh-7.4p1/sshd_config
b58e57
--- openssh-7.4p1/sshd_config.redhat	2016-12-19 05:59:41.000000000 +0100
b58e57
+++ openssh-7.4p1/sshd_config	2017-02-08 15:33:24.705736576 +0100
b58e57
@@ -10,21 +10,26 @@
b58e57
 # possible, but leave them commented.  Uncommented options override the
b58e57
 # default value.
b58e57
 
b58e57
+# If you want to change the port on a SELinux system, you have to tell
b58e57
+# SELinux about this change.
b58e57
+# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
b58e57
+#
b58e57
 #Port 22
b58e57
 #AddressFamily any
b58e57
 #ListenAddress 0.0.0.0
b58e57
 #ListenAddress ::
b58e57
 
b58e57
-#HostKey /etc/ssh/ssh_host_rsa_key
b58e57
+HostKey /etc/ssh/ssh_host_rsa_key
b58e57
 #HostKey /etc/ssh/ssh_host_dsa_key
b58e57
-#HostKey /etc/ssh/ssh_host_ecdsa_key
b58e57
-#HostKey /etc/ssh/ssh_host_ed25519_key
b58e57
+HostKey /etc/ssh/ssh_host_ecdsa_key
b58e57
+HostKey /etc/ssh/ssh_host_ed25519_key
b58e57
 
b58e57
 # Ciphers and keying
b58e57
 #RekeyLimit default none
b58e57
 
b58e57
 # Logging
b58e57
 #SyslogFacility AUTH
b58e57
+SyslogFacility AUTHPRIV
b58e57
 #LogLevel INFO
b58e57
 
b58e57
 # Authentication:
b58e57
@@ -57,9 +62,11 @@ AuthorizedKeysFile	.ssh/authorized_keys
b58e57
 # To disable tunneled clear text passwords, change to no here!
b58e57
 #PasswordAuthentication yes
b58e57
 #PermitEmptyPasswords no
b58e57
+PasswordAuthentication yes
b58e57
 
b58e57
 # Change to no to disable s/key passwords
b58e57
 #ChallengeResponseAuthentication yes
b58e57
+ChallengeResponseAuthentication no
b58e57
 
b58e57
 # Kerberos options
b58e57
 #KerberosAuthentication no
b58e57
@@ -68,8 +75,8 @@ AuthorizedKeysFile	.ssh/authorized_keys
b58e57
 #KerberosGetAFSToken no
b58e57
 
b58e57
 # GSSAPI options
b58e57
-#GSSAPIAuthentication no
b58e57
-#GSSAPICleanupCredentials yes
b58e57
+GSSAPIAuthentication yes
b58e57
+GSSAPICleanupCredentials no
b58e57
 
b58e57
 # Set this to 'yes' to enable PAM authentication, account processing,
b58e57
 # and session processing. If this is enabled, PAM authentication will
b58e57
@@ -80,12 +87,12 @@ AuthorizedKeysFile	.ssh/authorized_keys
b58e57
 # If you just want the PAM account and session checks to run without
b58e57
 # PAM authentication, then enable this but set PasswordAuthentication
b58e57
 # and ChallengeResponseAuthentication to 'no'.
b58e57
-#UsePAM no
b58e57
+UsePAM yes
b58e57
 
b58e57
 #AllowAgentForwarding yes
b58e57
 #AllowTcpForwarding yes
b58e57
 #GatewayPorts no
b58e57
-#X11Forwarding no
b58e57
+X11Forwarding yes
b58e57
 #X11DisplayOffset 10
b58e57
 #X11UseLocalhost yes
b58e57
 #PermitTTY yes
b58e57
@@ -108,6 +115,12 @@ AuthorizedKeysFile	.ssh/authorized_keys
b58e57
 # no default banner path
b58e57
 #Banner none
b58e57
 
b58e57
+# Accept locale-related environment variables
b58e57
+AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
b58e57
+AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
b58e57
+AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
b58e57
+AcceptEnv XMODIFIERS
b58e57
+
b58e57
 # override default of no subsystems
b58e57
 Subsystem	sftp	/usr/libexec/sftp-server
b58e57