summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorColin Watson <cjwatson@debian.org>2020-02-21 14:45:25 +0000
committerColin Watson <cjwatson@debian.org>2020-02-21 14:48:42 +0000
commitcb37f2bf1b8576863448555af5c5309a6c220785 (patch)
tree3a73125336f610265c6793cba89942eada865a2e
parent886e47e745586c34e81cfd5c5fb9b5dbc8e84d04 (diff)
parent86fe78ef4686485394b464cf9d3393ce27b33979 (diff)
Include /etc/ssh/*_config.d/*.conf
Include /etc/ssh/ssh_config.d/*.conf from /etc/ssh/ssh_config and /etc/ssh/sshd_config.d/*.conf from /etc/ssh/sshd_config. Closes: #845315
-rw-r--r--debian/.git-dpm4
-rw-r--r--debian/changelog3
-rw-r--r--debian/openssh-server.ucf-md5sum8
-rw-r--r--debian/patches/conch-old-privkey-format.patch2
-rw-r--r--debian/patches/debian-config.patch67
-rw-r--r--debian/patches/restore-authorized_keys2.patch6
-rw-r--r--debian/patches/revert-ipqos-defaults.patch10
-rw-r--r--ssh_config2
-rw-r--r--ssh_config.57
-rw-r--r--sshd_config2
-rw-r--r--sshd_config.57
11 files changed, 87 insertions, 31 deletions
diff --git a/debian/.git-dpm b/debian/.git-dpm
index 8acad4cd4..281d947f2 100644
--- a/debian/.git-dpm
+++ b/debian/.git-dpm
@@ -1,6 +1,6 @@
1# see git-dpm(1) from git-dpm package 1# see git-dpm(1) from git-dpm package
2a2dabf35ce0228c86a288d11cc847a9d9801604f 286fe78ef4686485394b464cf9d3393ce27b33979
3a2dabf35ce0228c86a288d11cc847a9d9801604f 386fe78ef4686485394b464cf9d3393ce27b33979
4f0de78bd4f29fa688c5df116f3f9cd43543a76d0 4f0de78bd4f29fa688c5df116f3f9cd43543a76d0
5f0de78bd4f29fa688c5df116f3f9cd43543a76d0 5f0de78bd4f29fa688c5df116f3f9cd43543a76d0
6openssh_8.2p1.orig.tar.gz 6openssh_8.2p1.orig.tar.gz
diff --git a/debian/changelog b/debian/changelog
index b86ad184e..160e7171a 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -101,6 +101,9 @@ openssh (1:8.2p1-1) UNRELEASED; urgency=medium
101 and 1:7.7p1-4 inclusive (closes: #951220). 101 and 1:7.7p1-4 inclusive (closes: #951220).
102 * ssh(1): Explain that -Y is equivalent to -X in the default configuration 102 * ssh(1): Explain that -Y is equivalent to -X in the default configuration
103 (closes: #951640). 103 (closes: #951640).
104 * Include /etc/ssh/ssh_config.d/*.conf from /etc/ssh/ssh_config and
105 /etc/ssh/sshd_config.d/*.conf from /etc/ssh/sshd_config (closes:
106 #845315).
104 107
105 -- Colin Watson <cjwatson@debian.org> Fri, 21 Feb 2020 12:11:52 +0000 108 -- Colin Watson <cjwatson@debian.org> Fri, 21 Feb 2020 12:11:52 +0000
106 109
diff --git a/debian/openssh-server.ucf-md5sum b/debian/openssh-server.ucf-md5sum
index 37c51978f..640943f7b 100644
--- a/debian/openssh-server.ucf-md5sum
+++ b/debian/openssh-server.ucf-md5sum
@@ -57,7 +57,7 @@ fe396d52df77f1fbf710591d4dbf3311
57# 57#
58# This obviously leaves something to be desired in terms of maintainability. 58# This obviously leaves something to be desired in terms of maintainability.
59# 59#
60# The following covers up to 1:7.7p1-4, including everything except the 60# The following covers up to 1:7.8p1-1, including everything except the
61# latest version of sshd_config. It should be extended any time sshd_config 61# latest version of sshd_config. It should be extended any time sshd_config
62# changes. 62# changes.
63 63
@@ -90,3 +90,9 @@ cc873ab3ccc9cf3a3830c3c0728c0d0b
902d0b1d2719c01b15457401fd97d607ed 902d0b1d2719c01b15457401fd97d607ed
918ce930e15835a8f46285315ed0da7f4a 918ce930e15835a8f46285315ed0da7f4a
928a71a3620605f21ac3ef16fd5d23f76a 928a71a3620605f21ac3ef16fd5d23f76a
93
94# From 1:7.8p1-1:
9555570f990ec9c3b8d19c19ab4d0b8eb8
960b8a28dca5cdbace0cd85fcd7794cba8
9718df1377273c4d51d4c03c9adc31021f
9863284e767f6ccf2375ef80507c564797
diff --git a/debian/patches/conch-old-privkey-format.patch b/debian/patches/conch-old-privkey-format.patch
index b04c21060..c48220f63 100644
--- a/debian/patches/conch-old-privkey-format.patch
+++ b/debian/patches/conch-old-privkey-format.patch
@@ -1,4 +1,4 @@
1From 311da721c2a5c6d147738e0699fa49d04cd5762a Mon Sep 17 00:00:00 2001 1From 39d3bb41ec288e8ba2384c65248440603f65349c Mon Sep 17 00:00:00 2001
2From: Colin Watson <cjwatson@debian.org> 2From: Colin Watson <cjwatson@debian.org>
3Date: Thu, 30 Aug 2018 00:58:56 +0100 3Date: Thu, 30 Aug 2018 00:58:56 +0100
4Subject: Work around conch interoperability failure 4Subject: Work around conch interoperability failure
diff --git a/debian/patches/debian-config.patch b/debian/patches/debian-config.patch
index e5c690915..35c71b0e9 100644
--- a/debian/patches/debian-config.patch
+++ b/debian/patches/debian-config.patch
@@ -1,4 +1,4 @@
1From cc80ecc65d57a9e68ce84d67bcfece281ffa0e9f Mon Sep 17 00:00:00 2001 1From 8086961f9f4ad834e9c3b09b6e2c80273be1c506 Mon Sep 17 00:00:00 2001
2From: Colin Watson <cjwatson@debian.org> 2From: Colin Watson <cjwatson@debian.org>
3Date: Sun, 9 Feb 2014 16:10:18 +0000 3Date: Sun, 9 Feb 2014 16:10:18 +0000
4Subject: Various Debian-specific configuration changes 4Subject: Various Debian-specific configuration changes
@@ -13,6 +13,8 @@ worms.
13 13
14ssh: Enable GSSAPIAuthentication by default. 14ssh: Enable GSSAPIAuthentication by default.
15 15
16ssh: Include /etc/ssh/ssh_config.d/*.conf.
17
16sshd: Enable PAM, disable ChallengeResponseAuthentication, and disable 18sshd: Enable PAM, disable ChallengeResponseAuthentication, and disable
17PrintMotd. 19PrintMotd.
18 20
@@ -22,21 +24,23 @@ sshd: Set 'AcceptEnv LANG LC_*' by default.
22 24
23sshd: Change sftp subsystem path to /usr/lib/openssh/sftp-server. 25sshd: Change sftp subsystem path to /usr/lib/openssh/sftp-server.
24 26
27sshd: Include /etc/ssh/sshd_config.d/*.conf.
28
25Document all of this. 29Document all of this.
26 30
27Author: Russ Allbery <rra@debian.org> 31Author: Russ Allbery <rra@debian.org>
28Forwarded: not-needed 32Forwarded: not-needed
29Last-Update: 2020-02-19 33Last-Update: 2020-02-21
30 34
31Patch-Name: debian-config.patch 35Patch-Name: debian-config.patch
32--- 36---
33 readconf.c | 2 +- 37 readconf.c | 2 +-
34 ssh.1 | 24 ++++++++++++++++++++++++ 38 ssh.1 | 24 ++++++++++++++++++++++++
35 ssh_config | 6 +++++- 39 ssh_config | 8 +++++++-
36 ssh_config.5 | 19 ++++++++++++++++++- 40 ssh_config.5 | 26 +++++++++++++++++++++++++-
37 sshd_config | 16 ++++++++++------ 41 sshd_config | 18 ++++++++++++------
38 sshd_config.5 | 22 ++++++++++++++++++++++ 42 sshd_config.5 | 29 +++++++++++++++++++++++++++++
39 6 files changed, 80 insertions(+), 9 deletions(-) 43 6 files changed, 98 insertions(+), 9 deletions(-)
40 44
41diff --git a/readconf.c b/readconf.c 45diff --git a/readconf.c b/readconf.c
42index 7f251dd4a..e82024678 100644 46index 7f251dd4a..e82024678 100644
@@ -94,14 +98,16 @@ index b33a8049f..a8967c2f8 100644
94 Send log information using the 98 Send log information using the
95 .Xr syslog 3 99 .Xr syslog 3
96diff --git a/ssh_config b/ssh_config 100diff --git a/ssh_config b/ssh_config
97index 1ff999b68..6dd6ecf87 100644 101index 1ff999b68..8a55237b9 100644
98--- a/ssh_config 102--- a/ssh_config
99+++ b/ssh_config 103+++ b/ssh_config
100@@ -17,9 +17,10 @@ 104@@ -17,9 +17,12 @@
101 # list of available options, their meanings and defaults, please see the 105 # list of available options, their meanings and defaults, please see the
102 # ssh_config(5) man page. 106 # ssh_config(5) man page.
103 107
104-# Host * 108-# Host *
109+Include /etc/ssh/ssh_config.d/*.conf
110+
105+Host * 111+Host *
106 # ForwardAgent no 112 # ForwardAgent no
107 # ForwardX11 no 113 # ForwardX11 no
@@ -109,7 +115,7 @@ index 1ff999b68..6dd6ecf87 100644
109 # PasswordAuthentication yes 115 # PasswordAuthentication yes
110 # HostbasedAuthentication no 116 # HostbasedAuthentication no
111 # GSSAPIAuthentication no 117 # GSSAPIAuthentication no
112@@ -45,3 +46,6 @@ 118@@ -45,3 +48,6 @@
113 # VisualHostKey no 119 # VisualHostKey no
114 # ProxyCommand ssh -q -W %h:%p gateway.example.com 120 # ProxyCommand ssh -q -W %h:%p gateway.example.com
115 # RekeyLimit 1G 1h 121 # RekeyLimit 1G 1h
@@ -117,10 +123,10 @@ index 1ff999b68..6dd6ecf87 100644
117+ HashKnownHosts yes 123+ HashKnownHosts yes
118+ GSSAPIAuthentication yes 124+ GSSAPIAuthentication yes
119diff --git a/ssh_config.5 b/ssh_config.5 125diff --git a/ssh_config.5 b/ssh_config.5
120index c6eaa63e7..5c90d3e02 100644 126index c6eaa63e7..34dc2d51b 100644
121--- a/ssh_config.5 127--- a/ssh_config.5
122+++ b/ssh_config.5 128+++ b/ssh_config.5
123@@ -71,6 +71,22 @@ Since the first obtained value for each parameter is used, more 129@@ -71,6 +71,29 @@ Since the first obtained value for each parameter is used, more
124 host-specific declarations should be given near the beginning of the 130 host-specific declarations should be given near the beginning of the
125 file, and general defaults at the end. 131 file, and general defaults at the end.
126 .Pp 132 .Pp
@@ -133,6 +139,8 @@ index c6eaa63e7..5c90d3e02 100644
133+.Pp 139+.Pp
134+.Bl -bullet -offset indent -compact 140+.Bl -bullet -offset indent -compact
135+.It 141+.It
142+.Cm Include /etc/ssh/ssh_config.d/*.conf
143+.It
136+.Cm SendEnv No LANG LC_* 144+.Cm SendEnv No LANG LC_*
137+.It 145+.It
138+.Cm HashKnownHosts No yes 146+.Cm HashKnownHosts No yes
@@ -140,10 +148,15 @@ index c6eaa63e7..5c90d3e02 100644
140+.Cm GSSAPIAuthentication No yes 148+.Cm GSSAPIAuthentication No yes
141+.El 149+.El
142+.Pp 150+.Pp
151+.Pa /etc/ssh/ssh_config.d/*.conf
152+files are included at the start of the system-wide configuration file, so
153+options set there will override those in
154+.Pa /etc/ssh/ssh_config.
155+.Pp
143 The file contains keyword-argument pairs, one per line. 156 The file contains keyword-argument pairs, one per line.
144 Lines starting with 157 Lines starting with
145 .Ql # 158 .Ql #
146@@ -729,11 +745,12 @@ elapsed. 159@@ -729,11 +752,12 @@ elapsed.
147 .It Cm ForwardX11Trusted 160 .It Cm ForwardX11Trusted
148 If this option is set to 161 If this option is set to
149 .Cm yes , 162 .Cm yes ,
@@ -158,10 +171,19 @@ index c6eaa63e7..5c90d3e02 100644
158 from stealing or tampering with data belonging to trusted X11 171 from stealing or tampering with data belonging to trusted X11
159 clients. 172 clients.
160diff --git a/sshd_config b/sshd_config 173diff --git a/sshd_config b/sshd_config
161index 2c48105f8..ed8272f6d 100644 174index 2c48105f8..459c1b230 100644
162--- a/sshd_config 175--- a/sshd_config
163+++ b/sshd_config 176+++ b/sshd_config
164@@ -57,8 +57,9 @@ AuthorizedKeysFile .ssh/authorized_keys 177@@ -10,6 +10,8 @@
178 # possible, but leave them commented. Uncommented options override the
179 # default value.
180
181+Include /etc/ssh/sshd_config.d/*.conf
182+
183 #Port 22
184 #AddressFamily any
185 #ListenAddress 0.0.0.0
186@@ -57,8 +59,9 @@ AuthorizedKeysFile .ssh/authorized_keys
165 #PasswordAuthentication yes 187 #PasswordAuthentication yes
166 #PermitEmptyPasswords no 188 #PermitEmptyPasswords no
167 189
@@ -173,7 +195,7 @@ index 2c48105f8..ed8272f6d 100644
173 195
174 # Kerberos options 196 # Kerberos options
175 #KerberosAuthentication no 197 #KerberosAuthentication no
176@@ -81,16 +82,16 @@ AuthorizedKeysFile .ssh/authorized_keys 198@@ -81,16 +84,16 @@ AuthorizedKeysFile .ssh/authorized_keys
177 # If you just want the PAM account and session checks to run without 199 # If you just want the PAM account and session checks to run without
178 # PAM authentication, then enable this but set PasswordAuthentication 200 # PAM authentication, then enable this but set PasswordAuthentication
179 # and ChallengeResponseAuthentication to 'no'. 201 # and ChallengeResponseAuthentication to 'no'.
@@ -193,7 +215,7 @@ index 2c48105f8..ed8272f6d 100644
193 #PrintLastLog yes 215 #PrintLastLog yes
194 #TCPKeepAlive yes 216 #TCPKeepAlive yes
195 #PermitUserEnvironment no 217 #PermitUserEnvironment no
196@@ -107,8 +108,11 @@ AuthorizedKeysFile .ssh/authorized_keys 218@@ -107,8 +110,11 @@ AuthorizedKeysFile .ssh/authorized_keys
197 # no default banner path 219 # no default banner path
198 #Banner none 220 #Banner none
199 221
@@ -207,10 +229,10 @@ index 2c48105f8..ed8272f6d 100644
207 # Example of overriding settings on a per-user basis 229 # Example of overriding settings on a per-user basis
208 #Match User anoncvs 230 #Match User anoncvs
209diff --git a/sshd_config.5 b/sshd_config.5 231diff --git a/sshd_config.5 b/sshd_config.5
210index 25f4b8117..b8bea2ad7 100644 232index 25f4b8117..e8271be74 100644
211--- a/sshd_config.5 233--- a/sshd_config.5
212+++ b/sshd_config.5 234+++ b/sshd_config.5
213@@ -56,6 +56,28 @@ Arguments may optionally be enclosed in double quotes 235@@ -56,6 +56,35 @@ Arguments may optionally be enclosed in double quotes
214 .Pq \&" 236 .Pq \&"
215 in order to represent arguments containing spaces. 237 in order to represent arguments containing spaces.
216 .Pp 238 .Pp
@@ -223,6 +245,8 @@ index 25f4b8117..b8bea2ad7 100644
223+.Pp 245+.Pp
224+.Bl -bullet -offset indent -compact 246+.Bl -bullet -offset indent -compact
225+.It 247+.It
248+.Cm Include /etc/ssh/sshd_config.d/*.conf
249+.It
226+.Cm ChallengeResponseAuthentication No no 250+.Cm ChallengeResponseAuthentication No no
227+.It 251+.It
228+.Cm X11Forwarding No yes 252+.Cm X11Forwarding No yes
@@ -236,6 +260,11 @@ index 25f4b8117..b8bea2ad7 100644
236+.Cm UsePAM No yes 260+.Cm UsePAM No yes
237+.El 261+.El
238+.Pp 262+.Pp
263+.Pa /etc/ssh/sshd_config.d/*.conf
264+files are included at the start of the configuration file, so options set
265+there will override those in
266+.Pa /etc/ssh/sshd_config.
267+.Pp
239 The possible 268 The possible
240 keywords and their meanings are as follows (note that 269 keywords and their meanings are as follows (note that
241 keywords are case-insensitive and arguments are case-sensitive): 270 keywords are case-insensitive and arguments are case-sensitive):
diff --git a/debian/patches/restore-authorized_keys2.patch b/debian/patches/restore-authorized_keys2.patch
index 7281395ae..aa6f4cc31 100644
--- a/debian/patches/restore-authorized_keys2.patch
+++ b/debian/patches/restore-authorized_keys2.patch
@@ -1,4 +1,4 @@
1From 2fe72c4e855be0fc87dbdc296632394b6cfe957a Mon Sep 17 00:00:00 2001 1From 58390cbd5e07df92729b794beb491f7352b26993 Mon Sep 17 00:00:00 2001
2From: Colin Watson <cjwatson@debian.org> 2From: Colin Watson <cjwatson@debian.org>
3Date: Sun, 5 Mar 2017 02:02:11 +0000 3Date: Sun, 5 Mar 2017 02:02:11 +0000
4Subject: Restore reading authorized_keys2 by default 4Subject: Restore reading authorized_keys2 by default
@@ -18,10 +18,10 @@ Patch-Name: restore-authorized_keys2.patch
18 1 file changed, 2 insertions(+), 3 deletions(-) 18 1 file changed, 2 insertions(+), 3 deletions(-)
19 19
20diff --git a/sshd_config b/sshd_config 20diff --git a/sshd_config b/sshd_config
21index ed8272f6d..ee9629102 100644 21index 459c1b230..dc0db5706 100644
22--- a/sshd_config 22--- a/sshd_config
23+++ b/sshd_config 23+++ b/sshd_config
24@@ -36,9 +36,8 @@ 24@@ -38,9 +38,8 @@ Include /etc/ssh/sshd_config.d/*.conf
25 25
26 #PubkeyAuthentication yes 26 #PubkeyAuthentication yes
27 27
diff --git a/debian/patches/revert-ipqos-defaults.patch b/debian/patches/revert-ipqos-defaults.patch
index 02c505531..13192e380 100644
--- a/debian/patches/revert-ipqos-defaults.patch
+++ b/debian/patches/revert-ipqos-defaults.patch
@@ -1,4 +1,4 @@
1From a2dabf35ce0228c86a288d11cc847a9d9801604f Mon Sep 17 00:00:00 2001 1From 86fe78ef4686485394b464cf9d3393ce27b33979 Mon Sep 17 00:00:00 2001
2From: Colin Watson <cjwatson@debian.org> 2From: Colin Watson <cjwatson@debian.org>
3Date: Mon, 8 Apr 2019 10:46:29 +0100 3Date: Mon, 8 Apr 2019 10:46:29 +0100
4Subject: Revert "upstream: Update default IPQoS in ssh(1), sshd(8) to DSCP 4Subject: Revert "upstream: Update default IPQoS in ssh(1), sshd(8) to DSCP
@@ -56,10 +56,10 @@ index 7bbc25c2e..470ad3619 100644
56 options->version_addendum = xstrdup(""); 56 options->version_addendum = xstrdup("");
57 if (options->fwd_opts.streamlocal_bind_mask == (mode_t)-1) 57 if (options->fwd_opts.streamlocal_bind_mask == (mode_t)-1)
58diff --git a/ssh_config.5 b/ssh_config.5 58diff --git a/ssh_config.5 b/ssh_config.5
59index 5c90d3e02..6b4e4f43b 100644 59index 34dc2d51b..91beb6f50 100644
60--- a/ssh_config.5 60--- a/ssh_config.5
61+++ b/ssh_config.5 61+++ b/ssh_config.5
62@@ -1133,11 +1133,9 @@ If one argument is specified, it is used as the packet class unconditionally. 62@@ -1140,11 +1140,9 @@ If one argument is specified, it is used as the packet class unconditionally.
63 If two values are specified, the first is automatically selected for 63 If two values are specified, the first is automatically selected for
64 interactive sessions and the second for non-interactive sessions. 64 interactive sessions and the second for non-interactive sessions.
65 The default is 65 The default is
@@ -74,10 +74,10 @@ index 5c90d3e02..6b4e4f43b 100644
74 .It Cm KbdInteractiveAuthentication 74 .It Cm KbdInteractiveAuthentication
75 Specifies whether to use keyboard-interactive authentication. 75 Specifies whether to use keyboard-interactive authentication.
76diff --git a/sshd_config.5 b/sshd_config.5 76diff --git a/sshd_config.5 b/sshd_config.5
77index b8bea2ad7..fd205e418 100644 77index e8271be74..d25b2f3d5 100644
78--- a/sshd_config.5 78--- a/sshd_config.5
79+++ b/sshd_config.5 79+++ b/sshd_config.5
80@@ -907,11 +907,9 @@ If one argument is specified, it is used as the packet class unconditionally. 80@@ -914,11 +914,9 @@ If one argument is specified, it is used as the packet class unconditionally.
81 If two values are specified, the first is automatically selected for 81 If two values are specified, the first is automatically selected for
82 interactive sessions and the second for non-interactive sessions. 82 interactive sessions and the second for non-interactive sessions.
83 The default is 83 The default is
diff --git a/ssh_config b/ssh_config
index 6dd6ecf87..8a55237b9 100644
--- a/ssh_config
+++ b/ssh_config
@@ -17,6 +17,8 @@
17# list of available options, their meanings and defaults, please see the 17# list of available options, their meanings and defaults, please see the
18# ssh_config(5) man page. 18# ssh_config(5) man page.
19 19
20Include /etc/ssh/ssh_config.d/*.conf
21
20Host * 22Host *
21# ForwardAgent no 23# ForwardAgent no
22# ForwardX11 no 24# ForwardX11 no
diff --git a/ssh_config.5 b/ssh_config.5
index 6b4e4f43b..91beb6f50 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -80,6 +80,8 @@ which are not the default in
80.Pp 80.Pp
81.Bl -bullet -offset indent -compact 81.Bl -bullet -offset indent -compact
82.It 82.It
83.Cm Include /etc/ssh/ssh_config.d/*.conf
84.It
83.Cm SendEnv No LANG LC_* 85.Cm SendEnv No LANG LC_*
84.It 86.It
85.Cm HashKnownHosts No yes 87.Cm HashKnownHosts No yes
@@ -87,6 +89,11 @@ which are not the default in
87.Cm GSSAPIAuthentication No yes 89.Cm GSSAPIAuthentication No yes
88.El 90.El
89.Pp 91.Pp
92.Pa /etc/ssh/ssh_config.d/*.conf
93files are included at the start of the system-wide configuration file, so
94options set there will override those in
95.Pa /etc/ssh/ssh_config.
96.Pp
90The file contains keyword-argument pairs, one per line. 97The file contains keyword-argument pairs, one per line.
91Lines starting with 98Lines starting with
92.Ql # 99.Ql #
diff --git a/sshd_config b/sshd_config
index ee9629102..dc0db5706 100644
--- a/sshd_config
+++ b/sshd_config
@@ -10,6 +10,8 @@
10# possible, but leave them commented. Uncommented options override the 10# possible, but leave them commented. Uncommented options override the
11# default value. 11# default value.
12 12
13Include /etc/ssh/sshd_config.d/*.conf
14
13#Port 22 15#Port 22
14#AddressFamily any 16#AddressFamily any
15#ListenAddress 0.0.0.0 17#ListenAddress 0.0.0.0
diff --git a/sshd_config.5 b/sshd_config.5
index fd205e418..d25b2f3d5 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -65,6 +65,8 @@ which are not the default in
65.Pp 65.Pp
66.Bl -bullet -offset indent -compact 66.Bl -bullet -offset indent -compact
67.It 67.It
68.Cm Include /etc/ssh/sshd_config.d/*.conf
69.It
68.Cm ChallengeResponseAuthentication No no 70.Cm ChallengeResponseAuthentication No no
69.It 71.It
70.Cm X11Forwarding No yes 72.Cm X11Forwarding No yes
@@ -78,6 +80,11 @@ which are not the default in
78.Cm UsePAM No yes 80.Cm UsePAM No yes
79.El 81.El
80.Pp 82.Pp
83.Pa /etc/ssh/sshd_config.d/*.conf
84files are included at the start of the configuration file, so options set
85there will override those in
86.Pa /etc/ssh/sshd_config.
87.Pp
81The possible 88The possible
82keywords and their meanings are as follows (note that 89keywords and their meanings are as follows (note that
83keywords are case-insensitive and arguments are case-sensitive): 90keywords are case-insensitive and arguments are case-sensitive):