# sshd custom configuration for pf-phonehome-2020-prod

# Managed by Ansible   ---   Do not modify manually!
#
# the custom template for pf-phonehome-2020-prod is:
# roles/phonehome_deploy/templates/sshd_config/90-custom.conf

# do not trust ~/.ssh/known_hosts for HostbasedAuthentication
IgnoreUserKnownHosts yes

# disable sftp
#Subsystem       sftp    /bin/none

# no X11
X11Forwarding no

# Allow user only: perfact, pfremote and group perfact-employees
#AllowUsers perfact pfremote
#Match group perfact-employees
#  AllowUsers *
#Match All
AllowGroups perfact pfremote perfact_employees root

# ALLOW ssh from pf-backup (BackupPC) and phonehome-user pfremote
Match host 192.168.42.100
  PermitRootLogin without-password
  AllowUsers root pfremote
Match All

# Allow to forward LAN-ports (digtwin)
#Match host 192.168.43.51 # restricting this to Match host does not work
GatewayPorts clientspecified
#Match All

# T226504: allows up to 20 simultaneous authentications
# MaxStartups start:rate:full
# 1. Number of unauthenticated connections before we start dropping
# 2. Percentage chance of dropping once we reach 10 (increases linearly for more than 10)
# 3. Maximum number of connections at which we start dropping everything
MaxStartups 40:10:200
