Arch Linux

As long as svn can remember, the openssh PKGBUILD contains within the following code that alters the default upstream config files:

#adjust our config files
sed -i \
-e 's|^#ListenAddress 0.0.0.0|ListenAddress 0.0.0.0|g' \
-e 's|^#UsePAM no|UsePAM yes|g' \
-e 's|^#ChallengeResponseAuthentication yes|ChallengeResponseAuthentication no|g' \
$startdir/pkg/etc/ssh/sshd_config
sed -i -e 's|^# Host \*|Host *|g' $startdir/pkg/etc/ssh/ssh_config
echo "HashKnownHosts yes" >> $startdir/pkg/etc/ssh/ssh_config
echo "StrictHostKeyChecking ask" >> $startdir/pkg/etc/ssh/ssh_config

#ssh_config
sed -i \
-e 's|^# Host \*|Host *|g' \
${pkgdir}/etc/ssh/ssh_config

Of these, two are no-ops (ListenAddress and StrictHostKeyChecking), one is a duplicated no-op (Host), and one could argue---which I would---that the others should be left at their defaults and the onus put on the user to configure them correctly. Though I could see that UsePAM and ChallengeResponseAuthentication could be considered sufficiently widely-used to modify them as above, but HashKnownHosts, at least, is not something that is closing a huge security hole. Plus, it screws up my bash-completion.

I have attached a dreadfully complicated patch for those who wish to avoid typing 15dd. (You're on your own if you're using that... other editor.)