[BACK]Return to ssh_config.5 CVS log [TXT][DIR] Up to [local] / src / usr.bin / ssh

Diff for /src/usr.bin/ssh/ssh_config.5 between version 1.20 and 1.20.2.1

version 1.20, 2003/09/02 18:50:06 version 1.20.2.1, 2004/02/28 03:51:34
Line 186 
Line 186 
 in order of preference.  in order of preference.
 Multiple ciphers must be comma-separated.  Multiple ciphers must be comma-separated.
 The default is  The default is
 .Pp  
 .Bd -literal  .Bd -literal
   ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,    ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
     aes192-cbc,aes256-cbc''      aes192-cbc,aes256-cbc''
Line 260 
Line 259 
 .Dq no .  .Dq no .
 The default is  The default is
 .Dq no .  .Dq no .
   This option should be placed in the non-hostspecific section.
 See  See
 .Xr ssh-keysign 8  .Xr ssh-keysign 8
 for more information.  for more information.
Line 306 
Line 306 
 .Pp  .Pp
 X11 forwarding should be enabled with caution.  X11 forwarding should be enabled with caution.
 Users with the ability to bypass file permissions on the remote host  Users with the ability to bypass file permissions on the remote host
 (for the user's X authorization database)  (for the user's X11 authorization database)
 can access the local X11 display through the forwarded connection.  can access the local X11 display through the forwarded connection.
 An attacker may then be able to perform activities such as keystroke monitoring.  An attacker may then be able to perform activities such as keystroke monitoring
   if the
   .Cm ForwardX11Trusted
   option is also enabled.
   .It Cm ForwardX11Trusted
   If the this option is set to
   .Dq yes
   then remote X11 clients will have full access to the original X11 display.
   If this option is set to
   .Dq no
   then remote X11 clients will be considered untrusted and prevented
   from stealing or tampering with data belonging to trusted X11
   clients.
   .Pp
   The default is
   .Dq no .
   .Pp
   See the X11 SECURITY extension specification for full details on
   the restrictions imposed on untrusted clients.
 .It Cm GatewayPorts  .It Cm GatewayPorts
 Specifies whether remote hosts are allowed to connect to local  Specifies whether remote hosts are allowed to connect to local
 forwarded ports.  forwarded ports.
Line 332 
Line 350 
 host key database instead of  host key database instead of
 .Pa /etc/ssh/ssh_known_hosts .  .Pa /etc/ssh/ssh_known_hosts .
 .It Cm GSSAPIAuthentication  .It Cm GSSAPIAuthentication
 Specifies whether authentication based on GSSAPI may be used, either using  Specifies whether user authentication based on GSSAPI is allowed.
 the result of a successful key exchange, or using GSSAPI user  
 authentication.  
 The default is  The default is
 .Dq yes .  .Dq no .
 Note that this option applies to protocol version 2 only.  Note that this option applies to protocol version 2 only.
 .It Cm GSSAPIDelegateCredentials  .It Cm GSSAPIDelegateCredentials
 Forward (delegate) credentials to the server.  Forward (delegate) credentials to the server.
Line 390 
Line 406 
 It is possible to have  It is possible to have
 multiple identity files specified in configuration files; all these  multiple identity files specified in configuration files; all these
 identities will be tried in sequence.  identities will be tried in sequence.
 .It Cm KeepAlive  
 Specifies whether the system should send TCP keepalive messages to the  
 other side.  
 If they are sent, death of the connection or crash of one  
 of the machines will be properly noticed.  
 However, this means that  
 connections will die if the route is down temporarily, and some people  
 find it annoying.  
 .Pp  
 The default is  
 .Dq yes  
 (to send keepalives), and the client will notice  
 if the network goes down or the remote host dies.  
 This is important in scripts, and many users want it too.  
 .Pp  
 To disable keepalives, the value should be set to  
 .Dq no .  
 .It Cm LocalForward  .It Cm LocalForward
 Specifies that a TCP/IP port on the local machine be forwarded over  Specifies that a TCP/IP port on the local machine be forwarded over
 the secure channel to the specified host and port from the remote machine.  the secure channel to the specified host and port from the remote machine.
Line 553 
Line 552 
 The default is  The default is
 .Dq yes .  .Dq yes .
 Note that this option applies to protocol version 1 only.  Note that this option applies to protocol version 1 only.
   .It Cm ServerAliveInterval
   Sets a timeout interval in seconds after which if no data has been received
   from the server,
   .Nm ssh
   will send a message through the encrypted
   channel to request a response from the server.
   The default
   is 0, indicating that these messages will not be sent to the server.
   This option applies to protocol version 2 only.
   .It Cm ServerAliveCountMax
   Sets the number of server alive messages (see above) which may be
   sent without
   .Nm ssh
   receiving any messages back from the server.
   If this threshold is reached while server alive messages are being sent,
   .Nm ssh
   will disconnect from the server, terminating the session.
   It is important to note that the use of server alive messages is very
   different from
   .Cm TCPKeepAlive
   (below).
   The server alive messages are sent through the encrypted channel
   and therefore will not be spoofable.
   The TCP keepalive option enabled by
   .Cm TCPKeepAlive
   is spoofable.
   The server alive mechanism is valuable when the client or
   server depend on knowing when a connection has become inactive.
   .Pp
   The default value is 3.
   If, for example,
   .Cm ServerAliveInterval
   (above) is set to 15, and
   .Cm ServerAliveCountMax
   is left at the default, if the server becomes unresponsive ssh
   will disconnect after approximately 45 seconds.
 .It Cm SmartcardDevice  .It Cm SmartcardDevice
 Specifies which smartcard device to use.  Specifies which smartcard device to use.
 The argument to this keyword is the device  The argument to this keyword is the device
Line 595 
Line 630 
 .Dq ask .  .Dq ask .
 The default is  The default is
 .Dq ask .  .Dq ask .
   .It Cm TCPKeepAlive
   Specifies whether the system should send TCP keepalive messages to the
   other side.
   If they are sent, death of the connection or crash of one
   of the machines will be properly noticed.
   However, this means that
   connections will die if the route is down temporarily, and some people
   find it annoying.
   .Pp
   The default is
   .Dq yes
   (to send TCP keepalive messages), and the client will notice
   if the network goes down or the remote host dies.
   This is important in scripts, and many users want it too.
   .Pp
   To disable TCP keepalive messages, the value should be set to
   .Dq no .
 .It Cm UsePrivilegedPort  .It Cm UsePrivilegedPort
 Specifies whether to use a privileged port for outgoing connections.  Specifies whether to use a privileged port for outgoing connections.
 The argument must be  The argument must be
Line 624 
Line 676 
 .It Cm VerifyHostKeyDNS  .It Cm VerifyHostKeyDNS
 Specifies whether to verify the remote key using DNS and SSHFP resource  Specifies whether to verify the remote key using DNS and SSHFP resource
 records.  records.
   If this option is set to
   .Dq yes ,
   the client will implicitly trust keys that match a secure fingerprint
   from DNS.
   Insecure fingerprints will be handled as if this option was set to
   .Dq ask .
   If this option is set to
   .Dq ask ,
   information on fingerprint match will be displayed, but the user will still
   need to confirm new host keys according to the
   .Cm StrictHostKeyChecking
   option.
   The argument must be
   .Dq yes ,
   .Dq no
   or
   .Dq ask .
 The default is  The default is
 .Dq no .  .Dq no .
 Note that this option applies to protocol version 2 only.  Note that this option applies to protocol version 2 only.
Legend:
Removed from v.1.20  
changed lines
  Added in v.1.20.2.1