blob: 65beeb1da361525a331e56a82696abbf4e4afd5c (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
|
# NO ROOT
PermitRootLogin no
# git user has access to all repos. no login allowed
DenyUsers git
# no login shell
PermitTTY no
# Force run script that checks for permissions and runs sudo
ForceCommand /usr/local/bin/git-run "$SSH_ORIGINAL_COMMAND"
# Only public key login is allowed
# no password brute force
PubkeyAuthentication yes
PasswordAuthentication no
AuthenticationMethods publickey
KbdInteractiveAuthentication no
ChallengeResponseAuthentication no
# no forwarding and tunneling
AllowTcpForwarding no
AllowAgentForwarding no
X11Forwarding no
# Limit authentication tries to 1 per connection
MaxAuthTries 1
# Do not wait too long for authentication
LoginGraceTime 10
# Point keys to shared data dir to avoid regenerating them each time
HostKey /var/ssh/etc/ssh/ssh_host_rsa_key
HostKey /var/ssh/etc/ssh/ssh_host_ecdsa_key
HostKey /var/ssh/etc/ssh/ssh_host_ed25519_key
# Logging
SyslogFacility AUTH
LogLevel INFO
|
