f5835d
diff -up openssh-7.7p1/ssh_config.redhat openssh-7.7p1/ssh_config
f5835d
--- openssh-7.7p1/ssh_config.redhat	2018-04-02 07:38:28.000000000 +0200
f5835d
+++ openssh-7.7p1/ssh_config	2018-07-03 10:44:06.522245125 +0200
0d83e7
@@ -44,3 +44,8 @@
f5835d
 #   VisualHostKey no
f5835d
 #   ProxyCommand ssh -q -W %h:%p gateway.example.com
f5835d
 #   RekeyLimit 1G 1h
f5835d
+#
0d83e7
+# This system is following system-wide crypto policy.
f5835d
+# To modify the system-wide ssh configuration, create a  *.conf  file under
f5835d
+#  /etc/ssh/ssh_config.d/  which will be automatically included below
f5835d
+Include /etc/ssh/ssh_config.d/*.conf
f5835d
diff -up openssh-7.7p1/ssh_config_redhat.redhat openssh-7.7p1/ssh_config_redhat
f5835d
--- openssh-7.7p1/ssh_config_redhat.redhat	2018-07-03 10:44:06.522245125 +0200
f5835d
+++ openssh-7.7p1/ssh_config_redhat	2018-07-03 10:44:06.522245125 +0200
4369a3
@@ -0,0 +1,21 @@
4369a3
+# The options here are in the "Match final block" to be applied as the last
4369a3
+# options and could be potentially overwritten by the user configuration
4369a3
+Match final all
4369a3
+	# Follow system-wide Crypto Policy, if defined:
4369a3
+	Include /etc/crypto-policies/back-ends/openssh.config
f5835d
+
f5835d
+	GSSAPIAuthentication yes
f5835d
+
f5835d
+# If this option is set to yes then remote X11 clients will have full access
f5835d
+# to the original X11 display. As virtually no X11 client supports the untrusted
f5835d
+# mode correctly we set this to yes.
f5835d
+	ForwardX11Trusted yes
f5835d
+
f5835d
+# Send locale-related environment variables
f5835d
+	SendEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
f5835d
+	SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
f5835d
+	SendEnv LC_IDENTIFICATION LC_ALL LANGUAGE
f5835d
+	SendEnv XMODIFIERS
4369a3
+
4369a3
+# Uncomment this if you want to use .local domain
4369a3
+# Host *.local
4369a3
+#   CheckHostIP no
f5835d
diff -up openssh-7.7p1/sshd_config.0.redhat openssh-7.7p1/sshd_config.0
f5835d
--- openssh-7.7p1/sshd_config.0.redhat	2018-04-02 07:39:27.000000000 +0200
f5835d
+++ openssh-7.7p1/sshd_config.0	2018-07-03 10:44:06.523245133 +0200
f5835d
@@ -872,9 +872,9 @@ DESCRIPTION
f5835d
 
f5835d
      SyslogFacility
f5835d
              Gives the facility code that is used when logging messages from
f5835d
-             sshd(8).  The possible values are: DAEMON, USER, AUTH, LOCAL0,
f5835d
-             LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.  The
f5835d
-             default is AUTH.
f5835d
+             sshd(8).  The possible values are: DAEMON, USER, AUTH, AUTHPRIV,
f5835d
+             LOCAL0, LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
f5835d
+             The default is AUTH.
f5835d
 
f5835d
      TCPKeepAlive
f5835d
              Specifies whether the system should send TCP keepalive messages
f5835d
diff -up openssh-7.7p1/sshd_config.5.redhat openssh-7.7p1/sshd_config.5
f5835d
--- openssh-7.7p1/sshd_config.5.redhat	2018-04-02 07:38:28.000000000 +0200
f5835d
+++ openssh-7.7p1/sshd_config.5	2018-07-03 10:44:06.523245133 +0200
f5835d
@@ -1461,7 +1461,7 @@ By default no subsystems are defined.
f5835d
 .It Cm SyslogFacility
f5835d
 Gives the facility code that is used when logging messages from
f5835d
 .Xr sshd 8 .
f5835d
-The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2,
f5835d
+The possible values are: DAEMON, USER, AUTH, AUTHPRIV, LOCAL0, LOCAL1, LOCAL2,
f5835d
 LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
f5835d
 The default is AUTH.
f5835d
 .It Cm TCPKeepAlive
f5835d
diff -up openssh-7.7p1/sshd_config.redhat openssh-7.7p1/sshd_config
f5835d
--- openssh-7.7p1/sshd_config.redhat	2018-04-02 07:38:28.000000000 +0200
f5835d
+++ openssh-7.7p1/sshd_config	2018-07-03 10:45:16.950782466 +0200
0d83e7
@@ -10,20 +10,31 @@
f5835d
 # possible, but leave them commented.  Uncommented options override the
f5835d
 # default value.
f5835d
 
f5835d
+# If you want to change the port on a SELinux system, you have to tell
f5835d
+# SELinux about this change.
f5835d
+# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
f5835d
+#
f5835d
 #Port 22
f5835d
 #AddressFamily any
f5835d
 #ListenAddress 0.0.0.0
f5835d
 #ListenAddress ::
f5835d
 
f5835d
-#HostKey /etc/ssh/ssh_host_rsa_key
f5835d
-#HostKey /etc/ssh/ssh_host_ecdsa_key
f5835d
-#HostKey /etc/ssh/ssh_host_ed25519_key
f5835d
+HostKey /etc/ssh/ssh_host_rsa_key
f5835d
+HostKey /etc/ssh/ssh_host_ecdsa_key
f5835d
+HostKey /etc/ssh/ssh_host_ed25519_key
f5835d
 
f5835d
 # Ciphers and keying
f5835d
 #RekeyLimit default none
f5835d
 
f5835d
+# This system is following system-wide crypto policy. The changes to
0d83e7
+# crypto properties (Ciphers, MACs, ...) will not have any effect here.
0d83e7
+# They will be overridden by command-line options passed to the server
0d83e7
+# on command line.
0d83e7
+# Please, check manual pages for update-crypto-policies(8) and sshd_config(5).
f5835d
+
f5835d
 # Logging
f5835d
 #SyslogFacility AUTH
f5835d
+SyslogFacility AUTHPRIV
f5835d
 #LogLevel INFO
f5835d
 
f5835d
 # Authentication:
f5835d
@@ -56,9 +70,11 @@ AuthorizedKeysFile	.ssh/authorized_keys
f5835d
 # To disable tunneled clear text passwords, change to no here!
f5835d
 #PasswordAuthentication yes
f5835d
 #PermitEmptyPasswords no
f5835d
+PasswordAuthentication yes
f5835d
 
f5835d
 # Change to no to disable s/key passwords
f5835d
 #ChallengeResponseAuthentication yes
f5835d
+ChallengeResponseAuthentication no
f5835d
 
f5835d
 # Kerberos options
f5835d
 #KerberosAuthentication no
f5835d
@@ -67,8 +83,8 @@ AuthorizedKeysFile	.ssh/authorized_keys
f5835d
 #KerberosGetAFSToken no
f5835d
 
f5835d
 # GSSAPI options
f5835d
-#GSSAPIAuthentication no
f5835d
-#GSSAPICleanupCredentials yes
f5835d
+GSSAPIAuthentication yes
f5835d
+GSSAPICleanupCredentials no
f5835d
 
f5835d
 # Set this to 'yes' to enable PAM authentication, account processing,
f5835d
 # and session processing. If this is enabled, PAM authentication will
f5835d
@@ -79,16 +95,20 @@ AuthorizedKeysFile	.ssh/authorized_keys
f5835d
 # If you just want the PAM account and session checks to run without
f5835d
 # PAM authentication, then enable this but set PasswordAuthentication
f5835d
 # and ChallengeResponseAuthentication to 'no'.
f5835d
-#UsePAM no
f5835d
+UsePAM yes
f5835d
 
f5835d
 #AllowAgentForwarding yes
f5835d
 #AllowTcpForwarding yes
f5835d
 #GatewayPorts no
f5835d
-#X11Forwarding no
f5835d
+X11Forwarding yes
f5835d
 #X11DisplayOffset 10
f5835d
 #X11UseLocalhost yes
f5835d
 #PermitTTY yes
f5835d
-#PrintMotd yes
f5835d
+
f5835d
+# It is recommended to use pam_motd in /etc/pam.d/sshd instead of PrintMotd,
f5835d
+# as it is more configurable and versatile than the built-in version.
f5835d
+PrintMotd no
f5835d
+
f5835d
 #PrintLastLog yes
f5835d
 #TCPKeepAlive yes
f5835d
 #PermitUserEnvironment no
f5835d
@@ -106,6 +126,12 @@ AuthorizedKeysFile	.ssh/authorized_keys
f5835d
 # no default banner path
f5835d
 #Banner none
f5835d
 
f5835d
+# Accept locale-related environment variables
f5835d
+AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
f5835d
+AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
f5835d
+AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
f5835d
+AcceptEnv XMODIFIERS
f5835d
+
f5835d
 # override default of no subsystems
f5835d
 Subsystem	sftp	/usr/libexec/sftp-server
f5835d