24 lines
866 B
Text
24 lines
866 B
Text
# Purpose: Harden field-device SSH to key-only maintenance access.
|
|
# Scope: Applies to the blueforce user; root and password logins stay disabled.
|
|
# Safety: Drop-in for sshd_config.d; validate with sshd -t before reload.
|
|
# Ref: docs/06-USERS-SSH-AND-PERMISSIONS.md, K-13.
|
|
|
|
# No direct root login; privilege is gained only via audited sudo.
|
|
PermitRootLogin no
|
|
|
|
# Key-only auth: passwords and interactive challenges are disabled.
|
|
PasswordAuthentication no
|
|
ChallengeResponseAuthentication no
|
|
KbdInteractiveAuthentication no
|
|
PubkeyAuthentication yes
|
|
|
|
# Only the maintenance user may open SSH sessions.
|
|
# Identity-specific SSH policy is generated by installer module 07-ssh as
|
|
# /etc/ssh/sshd_config.d/99-bf-<dealer-id>.conf.
|
|
|
|
# Reduce idle-session and brute-force exposure.
|
|
X11Forwarding no
|
|
MaxAuthTries 3
|
|
LoginGraceTime 60
|
|
ClientAliveInterval 300
|
|
ClientAliveCountMax 2
|