# /etc/ssh/sshd_config
# WARNING: This is a deliberately INSECURE configuration for training purposes.
# DO NOT use this on any real system.

# Allow both legacy and modern SSH protocols
Protocol 1,2

# Allow root to log in directly via SSH
PermitRootLogin yes

# Password-based authentication enabled
PasswordAuthentication yes
PubkeyAuthentication yes

# Allow accounts with empty passwords to log in
PermitEmptyPasswords yes

# No restriction on authentication attempts
#MaxAuthTries 6

# No user or group restrictions - anyone can SSH in
#AllowUsers
#AllowGroups
#DenyUsers
#DenyGroups

# X11 forwarding enabled (potential for display hijacking)
X11Forwarding yes

# TCP forwarding enabled (can be used for tunneling)
AllowTcpForwarding yes
GatewayPorts yes

# Agent forwarding enabled (risk of key theft via compromised host)
AllowAgentForwarding yes

# Weak ciphers and MACs permitted for "compatibility"
Ciphers aes128-cbc,3des-cbc,aes256-cbc,aes128-ctr,aes256-ctr,aes256-gcm@openssh.com
MACs hmac-md5,hmac-sha1,hmac-sha2-256,hmac-sha2-512
KexAlgorithms diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256

# Banner disabled - no legal warning shown to connecting users
#Banner /etc/issue.net

# Logging set to minimal
LogLevel INFO

# Long idle timeout - sessions stay open for hours
ClientAliveInterval 0
ClientAliveCountMax 3

# Permit user environment variables (can be used to hijack LD_PRELOAD etc.)
PermitUserEnvironment yes

# SFTP enabled with no chroot
Subsystem sftp /usr/lib/openssh/sftp-server

# No login grace time limit
LoginGraceTime 0

# Listen on all interfaces
ListenAddress 0.0.0.0
ListenAddress ::

# Permit tunneling
PermitTunnel yes

# Rhosts authentication (legacy, insecure)
IgnoreRhosts no

# Host-based authentication enabled (trusts remote hostnames)
HostbasedAuthentication yes

# Do not check permissions on user files (e.g., authorized_keys can be world-writable)
StrictModes no

# DNS lookup for connecting hosts (information leak, latency)
UseDNS yes

# Accept any environment variables from the client
AcceptEnv LANG LC_* TERM PATH LD_PRELOAD LD_LIBRARY_PATH