Port 22
Protocol 2
HostKey /etc/ssh/ssh_host_rsa_key

AuthorizedKeysFile  /etc/ssh/authorized_keys/%u

AllowGroups ssh

SyslogFacility AUTH
LogLevel VERBOSE
LoginGraceTime 120
StrictModes yes
IgnoreRhosts yes

UseDNS no

HostbasedAuthentication no
PermitRootLogin no
PermitEmptyPasswords no
X11Forwarding no
X11DisplayOffset 10
ChallengeResponseAuthentication no
KbdInteractiveAuthentication no
GSSAPIAuthentication no
KerberosAuthentication no
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
AcceptEnv LANG LC_*
Subsystem sftp internal-sftp
UsePAM yes

PubkeyAuthentication no
PasswordAuthentication no

Ciphers [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr
KexAlgorithms [email protected],ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
MACs [email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,[email protected]

UsePrivilegeSeparation sandbox



# ACL here




#SFTP-only group creation, cause, don't want this in the user-config!
Match Group sftponly
  ChrootDirectory %h
  ForceCommand internal-sftp
  AllowTcpForwarding no
  PermitTunnel no
  X11Forwarding no

#RSSH chrooting. Which provides a minimal shell for sftp, rsync, etc.
Match Group rsshonly
  ChrootDirectory %h
  X11Forwarding no
  PermitTunnel no
  AllowTcpForwarding no
  X11Forwarding no