# diff /tmp/ssh_config.bak /etc/ssh/ssh_config
0a1,4
> # This file is being maintained by Puppet.
> # DO NOT EDIT
>
> # $OpenBSD: ssh_config,v 1.21 2005/12/06 22:38:27 reyk Exp $
19c23
< Host *
---
> # Host *
22d25
< #   ForwardX11Trusted yes
25c28,29
< #   PasswordAuthentication yes
---
>    PasswordAuthentication yes
>    PubkeyAuthentication yes
27,30d30
< #   GSSAPIAuthentication no
< #   GSSAPIDelegateCredentials no
< #   GSSAPIKeyExchange no
< #   GSSAPITrustDNS no
37,40c37,38
< #   IdentityFile ~/.ssh/id_rsa
< #   IdentityFile ~/.ssh/id_dsa
< #   IdentityFile ~/.ssh/id_ecdsa
< #   IdentityFile ~/.ssh/id_ed25519
---
>    IdentityFile ~/.ssh/id_rsa
>    IdentityFile ~/.ssh/id_dsa
42c40
< #   Protocol 2
---
>    Protocol 2
44,45c42
< #   Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc
< #   MACs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160
---
> #   Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
50,56c47,61
< #   VisualHostKey no
< #   ProxyCommand ssh -q -W %h:%p gateway.example.com
< #   RekeyLimit 1G 1h
<     SendEnv LANG LC_*
<     HashKnownHosts yes
<     GSSAPIAuthentication yes
<     GSSAPIDelegateCredentials no
---
> #   HashKnownHosts no
>    HashKnownHosts yes
>    GlobalKnownHostsFile /etc/ssh/ssh_known_hosts
> Host *
> #  GSSAPIAuthentication yes
>   GSSAPIAuthentication yes
> # If this option is set to yes then remote X11 clients will have full access
> # to the original X11 display. As virtually no X11 client supports the untrusted
> # mode correctly we set this to yes.
>   ForwardX11Trusted yes
>   UseRoaming no
> # Send locale-related environment variables
>   SendEnv LANG LANGUAGE LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
>   SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
>   SendEnv LC_IDENTIFICATION LC_ALL