6c68d6
diff -up openssh-7.7p1/ssh_config.redhat openssh-7.7p1/ssh_config
6c68d6
--- openssh-7.7p1/ssh_config.redhat	2018-04-02 07:38:28.000000000 +0200
6c68d6
+++ openssh-7.7p1/ssh_config	2018-07-03 10:44:06.522245125 +0200
6c68d6
@@ -44,3 +44,7 @@
1144ae
 #   VisualHostKey no
1144ae
 #   ProxyCommand ssh -q -W %h:%p gateway.example.com
1144ae
 #   RekeyLimit 1G 1h
1144ae
+#
639ae2
+# To modify the system-wide ssh configuration, create a  *.conf  file under
639ae2
+#  /etc/ssh/ssh_config.d/  which will be automatically included below
645408
+Include /etc/ssh/ssh_config.d/*.conf
6c68d6
diff -up openssh-7.7p1/ssh_config_redhat.redhat openssh-7.7p1/ssh_config_redhat
6c68d6
--- openssh-7.7p1/ssh_config_redhat.redhat	2018-07-03 10:44:06.522245125 +0200
6c68d6
+++ openssh-7.7p1/ssh_config_redhat	2018-07-03 10:44:06.522245125 +0200
639ae2
@@ -0,0 +1,20 @@
3448f2
+# Follow system-wide Crypto Policy, if defined:
28ff3a
+Include /etc/crypto-policies/back-ends/openssh.config
639ae2
+
1144ae
+# Uncomment this if you want to use .local domain
1144ae
+# Host *.local
1144ae
+#   CheckHostIP no
56a647
+
Jan F. Chadima 69dd72
+Host *
Jan F. Chadima 69dd72
+	GSSAPIAuthentication yes
645408
+
Jan F. Chadima 69dd72
+# If this option is set to yes then remote X11 clients will have full access
Jan F. Chadima 69dd72
+# to the original X11 display. As virtually no X11 client supports the untrusted
Jan F. Chadima 69dd72
+# mode correctly we set this to yes.
Jan F. Chadima 69dd72
+	ForwardX11Trusted yes
645408
+
Jan F. Chadima 69dd72
+# Send locale-related environment variables
84822b
+	SendEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
84822b
+	SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
Jan F. Chadima 69dd72
+	SendEnv LC_IDENTIFICATION LC_ALL LANGUAGE
Jan F. Chadima 69dd72
+	SendEnv XMODIFIERS
6c68d6
diff -up openssh-7.7p1/sshd_config.0.redhat openssh-7.7p1/sshd_config.0
6c68d6
--- openssh-7.7p1/sshd_config.0.redhat	2018-04-02 07:39:27.000000000 +0200
6c68d6
+++ openssh-7.7p1/sshd_config.0	2018-07-03 10:44:06.523245133 +0200
6c68d6
@@ -872,9 +872,9 @@ DESCRIPTION
6cf9b8
 
6cf9b8
      SyslogFacility
6cf9b8
              Gives the facility code that is used when logging messages from
6cf9b8
-             sshd(8).  The possible values are: DAEMON, USER, AUTH, LOCAL0,
6cf9b8
-             LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.  The
6cf9b8
-             default is AUTH.
6cf9b8
+             sshd(8).  The possible values are: DAEMON, USER, AUTH, AUTHPRIV,
6cf9b8
+             LOCAL0, LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
6cf9b8
+             The default is AUTH.
6cf9b8
 
6cf9b8
      TCPKeepAlive
6cf9b8
              Specifies whether the system should send TCP keepalive messages
6c68d6
diff -up openssh-7.7p1/sshd_config.5.redhat openssh-7.7p1/sshd_config.5
6c68d6
--- openssh-7.7p1/sshd_config.5.redhat	2018-04-02 07:38:28.000000000 +0200
6c68d6
+++ openssh-7.7p1/sshd_config.5	2018-07-03 10:44:06.523245133 +0200
6c68d6
@@ -1461,7 +1461,7 @@ By default no subsystems are defined.
6cf9b8
 .It Cm SyslogFacility
6cf9b8
 Gives the facility code that is used when logging messages from
6cf9b8
 .Xr sshd 8 .
6cf9b8
-The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2,
6cf9b8
+The possible values are: DAEMON, USER, AUTH, AUTHPRIV, LOCAL0, LOCAL1, LOCAL2,
6cf9b8
 LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
6cf9b8
 The default is AUTH.
6cf9b8
 .It Cm TCPKeepAlive
6c68d6
diff -up openssh-7.7p1/sshd_config.redhat openssh-7.7p1/sshd_config
6c68d6
--- openssh-7.7p1/sshd_config.redhat	2018-04-02 07:38:28.000000000 +0200
6c68d6
+++ openssh-7.7p1/sshd_config	2018-07-03 10:45:16.950782466 +0200
3cd489
@@ -10,20 +10,34 @@
470ebd
 # possible, but leave them commented.  Uncommented options override the
470ebd
 # default value.
470ebd
 
470ebd
+# If you want to change the port on a SELinux system, you have to tell
470ebd
+# SELinux about this change.
470ebd
+# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
470ebd
+#
470ebd
 #Port 22
470ebd
 #AddressFamily any
470ebd
 #ListenAddress 0.0.0.0
6cf9b8
 #ListenAddress ::
6cf9b8
 
2b2955
-#HostKey /etc/ssh/ssh_host_rsa_key
2b2955
-#HostKey /etc/ssh/ssh_host_ecdsa_key
94c6f8
-#HostKey /etc/ssh/ssh_host_ed25519_key
6c68d6
+HostKey /etc/ssh/ssh_host_rsa_key
2b2955
+HostKey /etc/ssh/ssh_host_ecdsa_key
94c6f8
+HostKey /etc/ssh/ssh_host_ed25519_key
2b2955
 
6cf9b8
 # Ciphers and keying
6cf9b8
 #RekeyLimit default none
5878eb
 
0ce6c7
+# System-wide Crypto policy:
6c68d6
+# This system is following system-wide crypto policy. The changes to
0ce6c7
+# Ciphers, MACs, KexAlgoritms and GSSAPIKexAlgorithsm will not have any
0ce6c7
+# effect here. They will be overridden by command-line options passed on
0ce6c7
+# the server start up.
0ce6c7
+# To opt out, uncomment a line with redefinition of  CRYPTO_POLICY=
0ce6c7
+# variable in  /etc/sysconfig/sshd  to overwrite the policy.
0ce6c7
+# For more information, see manual page for update-crypto-policies(8).
0ce6c7
+
Jan F. Chadima 69dd72
 # Logging
Jan F. Chadima 69dd72
 #SyslogFacility AUTH
Jan F. Chadima 69dd72
+SyslogFacility AUTHPRIV
Jan F. Chadima 69dd72
 #LogLevel INFO
Jan F. Chadima 69dd72
 
Jan F. Chadima 69dd72
 # Authentication:
6c68d6
@@ -56,9 +70,11 @@ AuthorizedKeysFile	.ssh/authorized_keys
Jan F. Chadima 69dd72
 # To disable tunneled clear text passwords, change to no here!
Jan F. Chadima 69dd72
 #PasswordAuthentication yes
Jan F. Chadima 69dd72
 #PermitEmptyPasswords no
Jan F. Chadima 69dd72
+PasswordAuthentication yes
Jan F. Chadima 69dd72
 
Jan F. Chadima 69dd72
 # Change to no to disable s/key passwords
Jan F. Chadima 69dd72
 #ChallengeResponseAuthentication yes
Jan F. Chadima 69dd72
+ChallengeResponseAuthentication no
Jan F. Chadima 69dd72
 
Jan F. Chadima 69dd72
 # Kerberos options
Jan F. Chadima 69dd72
 #KerberosAuthentication no
6c68d6
@@ -67,8 +83,8 @@ AuthorizedKeysFile	.ssh/authorized_keys
94c6f8
 #KerberosGetAFSToken no
Jan F. Chadima 69dd72
 
Jan F. Chadima 69dd72
 # GSSAPI options
94c6f8
-#GSSAPIAuthentication no
94c6f8
-#GSSAPICleanupCredentials yes
Jan F. Chadima 69dd72
+GSSAPIAuthentication yes
f3b39b
+GSSAPICleanupCredentials no
Jan F. Chadima 69dd72
 
94c6f8
 # Set this to 'yes' to enable PAM authentication, account processing,
94c6f8
 # and session processing. If this is enabled, PAM authentication will
6c68d6
@@ -79,16 +95,20 @@ AuthorizedKeysFile	.ssh/authorized_keys
94c6f8
 # If you just want the PAM account and session checks to run without
Jan F. Chadima 69dd72
 # PAM authentication, then enable this but set PasswordAuthentication
Jan F. Chadima 69dd72
 # and ChallengeResponseAuthentication to 'no'.
94c6f8
-#UsePAM no
Jan F. Chadima 69dd72
+UsePAM yes
Jan F. Chadima 69dd72
 
d9e618
 #AllowAgentForwarding yes
Jan F. Chadima 69dd72
 #AllowTcpForwarding yes
Jan F. Chadima 69dd72
 #GatewayPorts no
94c6f8
-#X11Forwarding no
Jan F. Chadima 69dd72
+X11Forwarding yes
Jan F. Chadima 69dd72
 #X11DisplayOffset 10
Jan F. Chadima 69dd72
 #X11UseLocalhost yes
94c6f8
 #PermitTTY yes
6c68d6
-#PrintMotd yes
6c68d6
+
6c68d6
+# It is recommended to use pam_motd in /etc/pam.d/ssh instead of PrintMotd,
6c68d6
+# as it is more configurable and versatile than the built-in version.
6c68d6
+PrintMotd no
6c68d6
+
6c68d6
 #PrintLastLog yes
6c68d6
 #TCPKeepAlive yes
bbf61d
 #PermitUserEnvironment no
6c68d6
@@ -106,6 +126,12 @@ AuthorizedKeysFile	.ssh/authorized_keys
Jan F. Chadima 69dd72
 # no default banner path
Jan F. Chadima 69dd72
 #Banner none
Jan F. Chadima 69dd72
 
Jan F. Chadima 69dd72
+# Accept locale-related environment variables
Jan F. Chadima 69dd72
+AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
Jan F. Chadima 69dd72
+AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
Jan F. Chadima 69dd72
+AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
Jan F. Chadima 69dd72
+AcceptEnv XMODIFIERS
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
 # override default of no subsystems
Jan F. Chadima 69dd72
 Subsystem	sftp	/usr/libexec/sftp-server
Jan F. Chadima 69dd72