Port 22
ListenAddress ::
ListenAddress 0.0.0.0
Protocol 2

Banner /etc/banner

HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
<% if @osfamily == 'Debian' %>
HostKey /etc/ssh/ssh_host_ecdsa_key
<% end %>
UsePrivilegeSeparation yes

KeyRegenerationInterval 3600
ServerKeyBits 768

SyslogFacility AUTH
LogLevel INFO

LoginGraceTime 120
PermitRootLogin without-password
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes

IgnoreRhosts yes
RhostsRSAAuthentication no
HostbasedAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no
PasswordAuthentication <%= @external_host ? 'no' : 'yes' %>

X11Forwarding yes
X11DisplayOffset 10
PermitTunnel yes
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
UseDNS no

AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

UsePAM yes
<% if @osfamily == 'Debian' %>
AuthorizedKeysFile /etc/ssh/keys/%u .ssh/authorized_keys
<% else %>
AuthorizedKeysFile %h/.ssh/authorized_keys
<% end -%>

Match Group <%= @sftp_group %>
    AllowTCPForwarding no
    X11Forwarding no
    ForceCommand /usr/lib/openssh/sftp-server

Port 22
ListenAddress ::
ListenAddress 0.0.0.0
Protocol 2

Banner /etc/banner

HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
<% if @osfamily == 'Debian' %>
HostKey /etc/ssh/ssh_host_ecdsa_key
<% end %>
UsePrivilegeSeparation yes

KeyRegenerationInterval 3600
ServerKeyBits 768

SyslogFacility AUTH
LogLevel INFO

LoginGraceTime 120
PermitRootLogin without-password
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes

IgnoreRhosts yes
RhostsRSAAuthentication no
HostbasedAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no
PasswordAuthentication <%= @external_host ? 'no' : 'yes' %>

X11Forwarding yes
X11DisplayOffset 10
PermitTunnel yes
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
UseDNS no

AcceptEnv LANG LC_*

Subsystem sftp internal-sftp

UsePAM yes
<% if @osfamily == 'Debian' %>
AuthorizedKeysFile /etc/ssh/keys/%u .ssh/authorized_keys
<% else %>
AuthorizedKeysFile %h/.ssh/authorized_keys
<% end -%>

<% if @sftp_group != '' -%>
Match Group <%= @sftp_group %>
    AllowTCPForwarding no
    X11Forwarding no
    ForceCommand internal-sftp
<% end -%>

Switch sftp service from external to internal
Switch sftp service from external to internal

1) We replace /usr/libexec/sftp-server with internal-sftp
* An in-process sftp server requires no support files when used with ChrootDirectory
* With internal-sftp the login shell is no longer involved

2) Do not configure sftp if user provides empty sftp group

Change-Id: I59389203e12e3fb9304033f8e61a910441386851
