Re: [gentoo-user] ssh configuration guide

[David Rioja <rams@englobe-tec.com>]

Andrey Falko escribió:
> On Thu, Oct 9, 2008 at 1:06 AM, David Rioja <rams@englobe-tec.com> wrote:
>   
>> This is my very first post to the list, so hello you all :)
>>
>> I've been editing /etc/ssh/sshd_config in order to configure SSH as told in
>> the guide at gentoo.org. The options you have to set for a quick start
>> configuration are:
>>
>> Port 22
>> Protocol 2
>> ServerKeyBits 2048
>> SyslogFacility AUTH
>> LogLevel INFO
>> LoginGraceTime 60
>> PermitRootLogin no
>> RSAAuthentication no
>> PubkeyAuthentication yes
>> PasswordAuthentication no
>> PermitEmptyPasswords no
>> PAMAuthenticationViaKbdInt no
>> Compression yes
>> KeepAlive yes
>> ClientAliveInterval 30
>> ClientAliveCountMax 4
>>
>>
>> I have encountered two issues in that:
>>
>> 1.- When restarting the sshd service you are told PMAAuthenticationViaKbdInt
>> is deprecated.
>>
>> 2.- KeepAlive is not commented in the default configuration file, there is
>> TCPKeepAlive instead. I suppose same options are the same. Could anyone
>> confim that?
>>
>> Thanks!
>>
>>
>>     
>
> If you want are truely quick start configuration, you should use the
> defaults that get installed after you install ssh. Basically, thost
> default will give you a working ssh that is secure and that is more
> than likely to work out of box.
>
> I'm not sure which Gentoo quickstart guide you are following, but it
> is an out of date guide. I recommend emerge -1 openssh, then running
> etc-update and applying the default configuration. Your goal is to get
> a basic working ssh daemon, right?
>
>
>
>   
Yes, I wanted only make it work over the lan. Default options seemed not 
to work when I tried, perhaps I forgot to start the service... who 
knows? :-/

By the way, besides unabling ssh access for root, I is not a good idea 
enabling KeepAlive? So won't be great problems if anyone go away leaving 
his session active. Am I mistaken?