aedd00
diff -up openssh-7.7p1/ssh_config.redhat openssh-7.7p1/ssh_config
aedd00
--- openssh-7.7p1/ssh_config.redhat	2018-04-02 07:38:28.000000000 +0200
aedd00
+++ openssh-7.7p1/ssh_config	2018-07-03 10:44:06.522245125 +0200
aedd00
@@ -44,3 +44,8 @@
aedd00
 #   VisualHostKey no
aedd00
 #   ProxyCommand ssh -q -W %h:%p gateway.example.com
aedd00
 #   RekeyLimit 1G 1h
aedd00
+#
aedd00
+# This system is following system-wide crypto policy.
aedd00
+# To modify the system-wide ssh configuration, create a  *.conf  file under
aedd00
+#  /etc/ssh/ssh_config.d/  which will be automatically included below
aedd00
+Include /etc/ssh/ssh_config.d/*.conf
aedd00
diff -up openssh-7.7p1/ssh_config_redhat.redhat openssh-7.7p1/ssh_config_redhat
aedd00
--- openssh-7.7p1/ssh_config_redhat.redhat	2018-07-03 10:44:06.522245125 +0200
aedd00
+++ openssh-7.7p1/ssh_config_redhat	2018-07-03 10:44:06.522245125 +0200
aedd00
@@ -0,0 +1,21 @@
aedd00
+# The options here are in the "Match final block" to be applied as the last
aedd00
+# options and could be potentially overwritten by the user configuration
aedd00
+Match final all
aedd00
+	# Follow system-wide Crypto Policy, if defined:
aedd00
+	Include /etc/crypto-policies/back-ends/openssh.config
aedd00
+
aedd00
+	GSSAPIAuthentication yes
aedd00
+
aedd00
+# If this option is set to yes then remote X11 clients will have full access
aedd00
+# to the original X11 display. As virtually no X11 client supports the untrusted
aedd00
+# mode correctly we set this to yes.
aedd00
+	ForwardX11Trusted yes
aedd00
+
aedd00
+# Send locale-related environment variables
aedd00
+	SendEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
aedd00
+	SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
aedd00
+	SendEnv LC_IDENTIFICATION LC_ALL LANGUAGE
aedd00
+	SendEnv XMODIFIERS
aedd00
+
aedd00
+# Uncomment this if you want to use .local domain
aedd00
+# Host *.local
aedd00
+#   CheckHostIP no
aedd00
diff -up openssh-7.7p1/sshd_config.0.redhat openssh-7.7p1/sshd_config.0
aedd00
--- openssh-7.7p1/sshd_config.0.redhat	2018-04-02 07:39:27.000000000 +0200
aedd00
+++ openssh-7.7p1/sshd_config.0	2018-07-03 10:44:06.523245133 +0200
aedd00
@@ -872,9 +872,9 @@ DESCRIPTION
aedd00
 
aedd00
      SyslogFacility
aedd00
              Gives the facility code that is used when logging messages from
aedd00
-             sshd(8).  The possible values are: DAEMON, USER, AUTH, LOCAL0,
aedd00
-             LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.  The
aedd00
-             default is AUTH.
aedd00
+             sshd(8).  The possible values are: DAEMON, USER, AUTH, AUTHPRIV,
aedd00
+             LOCAL0, LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
aedd00
+             The default is AUTH.
aedd00
 
aedd00
      TCPKeepAlive
aedd00
              Specifies whether the system should send TCP keepalive messages
aedd00
diff -up openssh-7.7p1/sshd_config.5.redhat openssh-7.7p1/sshd_config.5
aedd00
--- openssh-7.7p1/sshd_config.5.redhat	2018-04-02 07:38:28.000000000 +0200
aedd00
+++ openssh-7.7p1/sshd_config.5	2018-07-03 10:44:06.523245133 +0200
aedd00
@@ -1461,7 +1461,7 @@ By default no subsystems are defined.
aedd00
 .It Cm SyslogFacility
aedd00
 Gives the facility code that is used when logging messages from
aedd00
 .Xr sshd 8 .
aedd00
-The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2,
aedd00
+The possible values are: DAEMON, USER, AUTH, AUTHPRIV, LOCAL0, LOCAL1, LOCAL2,
aedd00
 LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
aedd00
 The default is AUTH.
aedd00
 .It Cm TCPKeepAlive
aedd00
diff -up openssh-7.7p1/sshd_config.redhat openssh-7.7p1/sshd_config
aedd00
--- openssh-7.7p1/sshd_config.redhat	2018-04-02 07:38:28.000000000 +0200
aedd00
+++ openssh-7.7p1/sshd_config	2018-07-03 10:45:16.950782466 +0200
aedd00
@@ -10,20 +10,31 @@
aedd00
 # possible, but leave them commented.  Uncommented options override the
aedd00
 # default value.
aedd00
 
aedd00
+# If you want to change the port on a SELinux system, you have to tell
aedd00
+# SELinux about this change.
aedd00
+# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
aedd00
+#
aedd00
 #Port 22
aedd00
 #AddressFamily any
aedd00
 #ListenAddress 0.0.0.0
aedd00
 #ListenAddress ::
aedd00
 
aedd00
-#HostKey /etc/ssh/ssh_host_rsa_key
aedd00
-#HostKey /etc/ssh/ssh_host_ecdsa_key
aedd00
-#HostKey /etc/ssh/ssh_host_ed25519_key
aedd00
+HostKey /etc/ssh/ssh_host_rsa_key
aedd00
+HostKey /etc/ssh/ssh_host_ecdsa_key
aedd00
+HostKey /etc/ssh/ssh_host_ed25519_key
aedd00
 
aedd00
 # Ciphers and keying
aedd00
 #RekeyLimit default none
aedd00
 
aedd00
+# This system is following system-wide crypto policy. The changes to
aedd00
+# crypto properties (Ciphers, MACs, ...) will not have any effect here.
aedd00
+# They will be overridden by command-line options passed to the server
aedd00
+# on command line.
aedd00
+# Please, check manual pages for update-crypto-policies(8) and sshd_config(5).
aedd00
+
aedd00
 # Logging
aedd00
 #SyslogFacility AUTH
aedd00
+SyslogFacility AUTHPRIV
aedd00
 #LogLevel INFO
aedd00
 
aedd00
 # Authentication:
aedd00
@@ -56,9 +70,11 @@ AuthorizedKeysFile	.ssh/authorized_keys
aedd00
 # To disable tunneled clear text passwords, change to no here!
aedd00
 #PasswordAuthentication yes
aedd00
 #PermitEmptyPasswords no
aedd00
+PasswordAuthentication yes
aedd00
 
aedd00
 # Change to no to disable s/key passwords
aedd00
 #ChallengeResponseAuthentication yes
aedd00
+ChallengeResponseAuthentication no
aedd00
 
aedd00
 # Kerberos options
aedd00
 #KerberosAuthentication no
aedd00
@@ -67,8 +83,8 @@ AuthorizedKeysFile	.ssh/authorized_keys
aedd00
 #KerberosGetAFSToken no
aedd00
 
aedd00
 # GSSAPI options
aedd00
-#GSSAPIAuthentication no
aedd00
-#GSSAPICleanupCredentials yes
aedd00
+GSSAPIAuthentication yes
aedd00
+GSSAPICleanupCredentials no
aedd00
 
aedd00
 # Set this to 'yes' to enable PAM authentication, account processing,
aedd00
 # and session processing. If this is enabled, PAM authentication will
aedd00
@@ -79,16 +95,20 @@ AuthorizedKeysFile	.ssh/authorized_keys
aedd00
 # If you just want the PAM account and session checks to run without
aedd00
 # PAM authentication, then enable this but set PasswordAuthentication
aedd00
 # and ChallengeResponseAuthentication to 'no'.
aedd00
-#UsePAM no
aedd00
+UsePAM yes
aedd00
 
aedd00
 #AllowAgentForwarding yes
aedd00
 #AllowTcpForwarding yes
aedd00
 #GatewayPorts no
aedd00
-#X11Forwarding no
aedd00
+X11Forwarding yes
aedd00
 #X11DisplayOffset 10
aedd00
 #X11UseLocalhost yes
aedd00
 #PermitTTY yes
aedd00
-#PrintMotd yes
aedd00
+
aedd00
+# It is recommended to use pam_motd in /etc/pam.d/sshd instead of PrintMotd,
aedd00
+# as it is more configurable and versatile than the built-in version.
aedd00
+PrintMotd no
aedd00
+
aedd00
 #PrintLastLog yes
aedd00
 #TCPKeepAlive yes
aedd00
 #PermitUserEnvironment no
aedd00
@@ -106,6 +126,12 @@ AuthorizedKeysFile	.ssh/authorized_keys
aedd00
 # no default banner path
aedd00
 #Banner none
aedd00
 
aedd00
+# Accept locale-related environment variables
aedd00
+AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
aedd00
+AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
aedd00
+AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
aedd00
+AcceptEnv XMODIFIERS
aedd00
+
aedd00
 # override default of no subsystems
aedd00
 Subsystem	sftp	/usr/libexec/sftp-server
aedd00