|
The settings file can be used to create an install custom to the server. See Installation Settings File for more information. Feel free to use the Default Settings File as a template to create a custom settings file.
Tip: Use the Export Settings feature to create the installation file by installing on a test server and making all configuration settings using the Local Server Configuration program.
The file is an XML file which must start with the following heading:
<?xml version="1.0" encoding="UTF-8"?>
<registry>
<product name="Pragma Fortress SSH Server"/>
and end with the closing </registry> tag.
The configuration levels are defined by a key element, <k></k>, and settings use the value, <v />, element.
Value tags are registry string values, by default. If another type of value needs to be created, then it can be defined using the type attribute.
Server Level Values
<k name="HKEY_LOCAL_MACHINE">
<k name="SOFTWARE">
<k name="PragmaSystems">
<k name="SSHD">
</k>
</k>
</k>
</k>
|
Feature
|
Setting File Value
|
Default Value
|
Allowed Values
|
|
Access Control - Allow local port forwarding
|
AllowTCPForwarding
|
yes
|
yes/ no
|
|
Access Control - Allow logon/shell access
|
AllowShellAccess
|
yes
|
yes/ no
|
|
Access Control - Allow remote port forwarding
|
AllowRemoteTCPForwarding
|
yes
|
yes/ no
|
|
Access Control - Allow scp access
|
AllowSCPSubSystems
|
yes
|
yes/ no
|
|
Access Control - Allow sftp access
|
AllowSFTPSubSystems
|
yes
|
yes/ no
|
|
Authentication - Password authentication
|
AllowPasswordAuth
|
yes
|
yes/ no
|
|
Authentication - Public key authentication
|
AllowPubKeyAuth
|
yes
|
yes/ no
|
|
Banner - Consent Banner
|
ConsentBanner
|
Default banner text
|
Any string value
|
|
Banner - Consent Banner acceptance case sensitive
|
ConsentAgreeCaseSensitive
|
no
|
yes/ no
|
|
Banner - Consent Banner acceptance exact length
|
ConsentAgreeExactLen
|
no
|
yes/ no
|
|
Banner - Consent Banner Acceptance prompt
|
ConsentPrompt
|
Do you accept the terms? (Y/ N)
|
String value
|
|
Banner - Consent Banner acceptance value
|
ConsentAccept
|
y
|
String value
|
|
Ciphers - Ciphers
|
CiphersUsed
|
3des,blowfish,3des-cbc,
blowfish-cbc,aes128-cbc,
aes192-cbc,aes256-cbc,
aes128-ctr,aes192-ctr,aes256-ctr
|
A subset of the default list separated by comma
|
|
Compression - Compression level
|
CompressionLevel
|
5
|
1-9
|
|
Compression - Enable Compression
|
AllowCompression
|
yes
|
yes/ no
|
|
General Settings - Allow ssh1 protocol
|
AllowSSH1Protocol
|
yes
|
yes/ no
|
|
General Settings - FIPS mode
|
FIPSMode
|
no
|
yes/ no
|
|
General Settings - Limit authentication attempts
|
AllowAuthLimit
|
yes
|
yes/ no
|
|
General Settings - Maximum connections
|
SessionLimit
|
1000
|
any numeric value
|
|
General Settings - Monitor Sessions
|
MonitorSessions
|
no
|
yes/ no
|
|
General Settings - Number of authentication attempts
|
AuthAttemptLimit
|
5
|
any numeric value
|
|
General Settings - Server Key Bits
|
ServerKeyBits
|
1024
|
any numeric value
|
|
General Settings - Window Size
|
SSH_Window_Size
|
2097152
|
any numeric value
|
|
Groups - Only allow configured groups access to server
|
AccessByGroupOnly
|
no
|
yes/ no
|
|
GSSAPI – GSSAPI Kerberos
|
AllowGSSkerberos
|
yes
|
yes/ no
|
|
GSSAPI – GSSAPINTLM
|
AllowGSSNTLM
|
yes
|
yes/ no
|
|
GSSAPI – token delegation
|
GSSDelegate
|
yes
|
yes/ no
|
|
Host Key - ssh1 host key
|
SSH1HostFile
|
%SystemRoot%\System32\drivers\etc\
pragma_ssh1_hostkey
|
Valid private key part of Pragma Generated rsa1 key pair, including full path
|
|
Host Key – ssh2 dsa host key
|
SSH2HostFile
|
%SystemRoot%\System32\drivers\etc\
pragma_ssh_hostkey
|
Valid private key part of Pragma generated dsa key pair, including full path
|
|
Host key – ssh2 rsa host key
|
SSH2RSAHostFile
|
%SystemRoot%\System32\drivers\etc\
pragma_ssh_rsa_hostkey
|
Valid private key part of Pragma Generated rsa2 key pair, including full path
|
|
Host Key – use ssh1 key
|
UseSSH1Key
|
Yes
|
Yes/ no
|
|
Host key – use ssh2 dsa key
|
UseSSH2DSAKey
|
Yes
|
Yes/ no
|
|
Host key – use ssh2 rsa key
|
UseSSH2RSAKey
|
Yes
|
Yes/ no
|
|
Host Key – use X509 key
|
UseX509Key
|
no
|
yes/ no
|
|
Host Key – X509 certificate
|
X509HostCert
|
Empty
|
Binary thumbprint of certificate
|
|
Logging - Log input from server
|
LogInputFile
|
$(PragmaInstallDir)\sshin.txt
|
any file with valid path
|
|
Logging - Log output to client
|
LogOutputFile
|
$(PragmaInstallDir)\sshout.txt
|
any file with valid path
|
|
Logging - Record logon/ logoff attempts
|
LogToSystemEventLog
|
yes
|
yes/ no
|
|
Logging - Server Operation Logging directory
|
DebugLogDir
|
$(PragmaInstallDir)\Fortress\Logfiles
|
Any valid path
|
|
Logging - User Session Logging
|
LogUserSessions
|
no
|
yes/ no
|
|
Logging - User Session logging directory
|
LogFileDirectory
|
$(PragmaInstallDir)\Fortress\Logfiles
|
Any valid path
|
|
Logging - User Session Logging in HTML
|
LogFileHTML
|
no
|
yes/ no
|
|
Logging - User session logging in text
|
LogFileText
|
no
|
yes/ no
|
|
MACS
|
MacsUsed
|
hmac-sha2-256,hmac-sha2-512,
hmac-sha1,hmac-sha1-96,
hmac-md5,hmac-md5-96
|
A subset of the default list separated by comma
|
|
Not visible - Allow ssh2 protocol
|
AllowSSH2Protocol
|
yes
|
yes/ no
|
|
Password Options - Store passwords
|
CacheWindowsCredentials
|
no
|
yes/ no
|
|
Password Options - Store passwords
|
OnlyCacheCredForCert
|
yes
|
yes/ no
|
|
Public Key Options - Automatically store keys in registry
|
AutoStoreKeys
|
no
|
yes/ no
|
|
Public Key Options Automatically store keys in file
|
AutoStoreKeysInFile
|
yes
|
yes/ no
|
|
Registration key
|
Registration
|
|
Registration key obtained from Pragma Systems
|
|
SCP Users - Only allow configured users scp access
|
AllowSCPByUser
|
no
|
yes/ no
|
|
SFTP Users - Only allow configured users sftp access
|
AllowSFTPByUser
|
no
|
yes/ no
|
|
Users - Only allow configured users access to server
|
AllowAllUsers
|
yes
|
yes/ no
|
|
X509 Authentication – against AD Certificate Mappings
|
AuthenticateAgainstADCertMap
|
yes
|
yes/ no
|
|
X509 Authentication – against AD Kerberos Name Mappings
|
AuthenticateAgainstADKerbMap
|
yes
|
yes/ no
|
|
X509 Authentication – against UPN
|
AuthenticateAgainstUPN
|
yes
|
yes/ no
|
|
X509 Authentication – revocation checking
|
CertificateValidationFlags
|
0x20000000
|
0 = Disabled
0x10000000 = check only end certificate
0x20000000 = check entire chain
0x40000000 = check entire chain except root certificate
|
|
Internal Use Only
|
LogonType
|
1
|
Do not change
|
|
Internal Use Only
|
HelpFile
|
$(PragmaInstallDir)\Help\FortressSSH.chm
|
Do not change
|
|
Internal Use Only
|
path
|
$(PragmaInstallDir)\
|
Do not change
|
|
Internal Use Only
|
Persist
|
yes
|
Do not change
|
User and Group Level Values
The user and group levels are used for the per user/group settings. They contain the same available values. The group level needs the extra value "Order" which should list the configured groups in the order they will appear in the list box in the dialog separated by comma. The order is used to determine which group configuration will be used if a user is a member of multiple groups.
|
<k name="HKEY_LOCAL_MACHINE">
<k name="SOFTWARE">
<k name="PragmaSystems">
<k name="SSHD">
<k name="Users">
<k name="UserName (or Default)">
</k>
</k>
</k>
</k>
</k>
</k>
|
<k name="HKEY_LOCAL_MACHINE">
<k name="SOFTWARE">
<k name="PragmaSystems">
<k name="SSHD">
<k name="Groups">
<k name="UserName (or Default)">
<v name="Order" value=""/>
</k>
</k>
</k>
</k>
</k>
</k>
|
Environment variables are created under the "Environment" sub-key of the User or group level. Add the key <k name="Environment"> under the user or group level then add each new variable as a string value under the key. The value name is the name of the environment variable and the value is the value of the environment variable value and the location of the variable if it exists, separated by a comma.
The location can be either end, beginning, or replace.
For example, to add a variable newvar, with a value newval, that will replace any existing variable with the same name add the following under the user or group level:
<k name="Environment">
<v name="newvar" value="newval,replace"/>
</k>
Similarly, graceful termination executables are added under the sub-key "TerminateStrings". Add the key <k name="TerminateStrings"> under the user or group level then add each new process name as a string value under the key. The value is the name of the process name with extension and the value is the string passed to the server to terminate the process. See Graceful Termination for possible string values.
The location can be either end, beginning, or replace.
For example, to add a process test.exe that needs the word exit to close, add the following under the user or group level:
<k name="TerminateStrings">
<v name="test.exe" value="e,x,i,t,ENTER"/>
</k>
|
Feature
|
Settings File Value
|
Default Value
|
Allowed Values
|
|
Console Settings – close cmd after running startup
|
CloseShell
|
no
|
yes/ no
|
|
Console Settings – Custom DEC Sequence
|
DecCustom
|
Empty
|
Any valid string value, ignored unless DecCharSet is 7
|
|
Console Settings – DEC Graphic Character set
|
DecCharSet
|
6
|
0-7:
0 = ASCII
1 = Supplemental
2 = Special
3 = Technical
4 = User Preferred
5 = ISO Latin
6 = Insert ACS
7 = Custom
|
|
Console Settings – Default Background color
|
ScreenBackGround
|
Black
|
Black/ Red/ Green/ Yellow/ Blue/ Magenta/ Cyan/ White/ Intense Black/ Intense Red/ Intense Green/ Intense Yellow/ Intense Blue/ Intense Magenta/ Intense Cyan/ Intense White
|
|
Console Settings – Default Columns
|
DefaultColumns
|
80
|
Any numeric value
|
|
Console Settings – Default foreground color
|
ScreenForeGround
|
White
|
Black/ Red/ Green/ Yellow/ Blue/ Magenta/ Cyan/ White/ Intense Black/ Intense Red/ Intense Green/ Intense Yellow/ Intense Blue/ Intense Magenta/ Intense Cyan/ Intense White
|
|
Console Settings – Default Rows
|
DefaultRows
|
25
|
Any numeric value
|
|
Console settings – Enable application wrap
|
AutoWrapApps
|
no
|
yes/ no
|
|
Console Settings – Largest packet size
|
PacketSize
|
0
|
Any numeric value
|
|
Console Settings – Monochrome
|
Monochrome
|
no
|
Yes/ no
|
|
Console Settings – Screen timer increment
|
OA_WaitIncr
|
200
|
Any numeric value
|
|
Console Settings – Screen timer initial
|
OA_WaitInit
|
100
|
Any numeric value
|
|
Console Settings – Screen timer max
|
OA_WaitMax
|
3000
|
Any numeric value
|
|
Console Settings – Slow network connection
|
SlowConnection
|
no
|
yes/ no
|
|
Console Settings – Startup program
|
UserShellInitializer
|
empty
|
Any string value
|
|
Console Settings – Use advanced screen scraper
|
AdvancedScreenScraper
|
yes
|
yes/ no
|
|
Console Settings - Use Largest Packet Size
|
UsePacketSize
|
no
|
yes/ no
|
|
Console Settings – User Shell
|
UserShell
|
%SystemRoot%\system32\cmd.exe
|
Any valid executable with full path
|
|
Console Settings -Default Character Map
|
CharMap
|
empty
|
Any heading listed in the charmap.ini file
|
|
General Settings - Allow system beep to pass to client
|
BeepEnabled
|
no
|
yes/ no
|
|
General Settings - Default Screen Mode
|
DefaultScreenMode
|
Advanced Console
|
Advanced Console/ Full Console/ Stream/ Full Stream
|
|
General Settings - Default Terminal Type
|
DefaultTerm
|
vtxxx
|
vtxxx/ansi/wyse 60 and above/wyse-50/ibm3151
|
|
General Settings - Enable User Session Limit
|
UseSessionLimit
|
no
|
yes/ no
|
|
General Settings - Home directory
|
HomeDir
|
|
Any valid path
|
|
General Settings - Idle Session timeout
|
IdleSessionTimeOut
|
0
|
Any numeric value
|
|
General Settings - Monitor Child Processes
|
MonitorChildProcess
|
yes
|
yes/ no
|
|
General Settings - Record terminated processes
|
LogTerminatedProcs
|
no
|
yes/ no
|
|
General Settings - Server to Client heartbeat
|
ServerHeartbeat
|
0
|
Any numeric value
|
|
General Settings - Use Idle Session Timeout
|
UseIdleSessionTimeout
|
no
|
yes/ no
|
|
General Settings - User Session Limit
|
SessionLimit
|
0
|
Any numeric value
|
|
IBM Turnaround character
|
LTAChar
|
13
|
Any numeric character less than 254
|
|
Keyboard - Allow Control C
|
ControlCKey
|
PASSIT
|
PASSIT/BLOCKIT
|
|
Keyboard - Allow Control G
|
ControlGKey
|
PASSIT
|
PASSIT/ BLOCKIT
|
|
Keyboard - Remap alt key
|
AltKey
|
1
|
Any numeric value
|
|
Logon - Ask for Character Map
|
AskForCharMap
|
no
|
yes/ no
|
|
Logon - Ask for Color Mode
|
AskForColor
|
no
|
yes/ no
|
|
Logon - Ask for Console mode
|
AskForConsoleMode
|
yes
|
yes/ no
|
|
Logon - Ask for terminal type
|
AskForTermType
|
no
|
yes/ no
|
|
Logon - Map user drives
|
MapUserDrives
|
yes
|
yes/ no
|
|
Logon - Map user drives in background
|
ThreadDriveMap
|
yes
|
yes/ no
|
|
Logon - Run Windows Logon script
|
RunNTScript
|
yes
|
yes/ no
|
|
Stream Settings – close cmd after running startup
|
CloseStreamShell
|
no
|
yes/ no
|
|
Stream Settings – convert single linefeed to CR/ LF
|
StreamPassThru
|
no
|
yes/ no
|
|
Stream settings – echo input characters
|
AdvancedStreamEcho
|
no
|
yes/ no
|
|
Stream Settings – local echo
|
LocalEcho_SMode
|
yes
|
yes/ no
|
|
Stream Settings – process input lines
|
ProcessLine_SMode
|
yes
|
yes/ no
|
|
Stream Settings – Startup program
|
UserShellInitializerStream
|
|
String value
|
|
Stream Settings – User Shell
|
UserShell_SMode
|
%SystemRoot%\system32\cmd.exe / Q
|
Any valid executable with full path
|
Printer Level Values
<k name="HKEY_LOCAL_MACHINE">
<k name="SOFTWARE">
<k name="PragmaSystems">
<k name="SSHD">
<k name="PrinterInfo">
</k>
</k>
</k>
</k>
</k>
|
Feature
|
Settings File Value
|
Default Value
|
Allowed Values
|
|
Printing - Enable Print Monitoring
|
EnablePrintMonitor
|
no
|
yes/ no
|
|
Printing – spool directory
|
SpoolDir
|
$(PragmaInstallDir)\Fortress\SpoolDir
|
Any valid path
|
|
Printing directory for saved jobs
|
SaveDir
|
$(PragmaInstallDir)\Fortress\SaveDir
|
Any valid path
|
|
Printing Record print jobs to event log
|
RecordPrintJobs
|
no
|
yes/ no
|
|
Printing save print jobs
|
SaveJobs
|
no
|
yes/ no
|
|
Internal use
|
PreviousPrintMonitor
|
|
Do not alter
|
|
Internal use
|
HelpFile
|
$(PragmaInstallDir)\Help\FortressSSH.chm
|
Do not alter
|
SFTP Level Values
<k name="HKEY_LOCAL_MACHINE">
<k name="SOFTWARE">
<k name="PragmaSystems">
<k name="SFTP">
</k>
</k>
</k>
</k>
|
Feature
|
Settings File Value
|
Default Value
|
Allowed Values
|
|
SFTP Logging – directory
|
LogDirectory
|
$(PragmaInstallDir)\Fortress\sftp_logfiles
|
Any valid path
|
|
SFTP Logging Level
|
LoggingLevel
|
0
|
0-3
0 = off
1 = transfers
2 = detailed
3 = status
|
|
Internal use
|
Persist
|
yes
|
Do not alter
|
SFTP User Level Values
<k name="HKEY_LOCAL_MACHINE">
<k name="SOFTWARE">
<k name="PragmaSystems">
<k name="SFTP">
<k name="Users">
<k name="UserName (or Default)">
</k>
</k>
</k>
</k>
</k>
</k>
|
Features
|
Settings File Value
|
Default Value
|
Allowed Values
|
|
SFTP User – home directory
|
StartDir
|
%USERPROFILE%
|
Any valid path, should include some user unique variable
|
|
SFTP User – home directory functionality
|
ClientRootMode
|
admin
|
admin/ vroot/ mroot
admin – allow users to traverse
mroot – restrict users to home directory
vroot – virtual directories
|
|
SFTP User – map user drives
|
MapUserDrives
|
No
|
Yes/ no
|
|
SFTP User – map user drives in background
|
ThreadDriveMap
|
no
|
Yes/ no
|
|
SFTP User – show hidden files
|
ShowHiddenFiles
|
No
|
yes/ no
|
|
SFTP User – virtual directories
|
vroots
|
|
Multi string value following format “virtual directory/ physical path”
|
SCP Level Values
There are no configuration settings at the SCP level at this time.
SCP User Level Values
<k name="HKEY_LOCAL_MACHINE">
<k name="SOFTWARE">
<k name="PragmaSystems">
<k name="SCP">
<k name="Users">
<k name="UserName (or Default)">
</k>
</k>
</k>
</k>
</k>
</k>
|
Feature
|
Settings File Value
|
Default Value
|
Allowed Values
|
|
Scp user – home directory
|
SCPStartDir
|
%USERPROFILE%
|
Any valid path, should include some user unique variable
|
|
SCP User - home directory functionality
|
SCPClientRootMode
|
admin
|
admin/ mroot
admin – allow users to traverse
mroot – restrict users to home directory
|
|