[BACK]Return to ssh_config.5 CVS log [TXT][DIR] Up to [local] / src / usr.bin / ssh

Diff for /src/usr.bin/ssh/ssh_config.5 between version 1.20 and 1.20.2.2

version 1.20, 2003/09/02 18:50:06 version 1.20.2.2, 2004/08/19 22:37:32
Line 185 
Line 185 
 Specifies the ciphers allowed for protocol version 2  Specifies the ciphers allowed for protocol version 2
 in order of preference.  in order of preference.
 Multiple ciphers must be comma-separated.  Multiple ciphers must be comma-separated.
   The supported ciphers are
   .Dq 3des-cbc ,
   .Dq aes128-cbc ,
   .Dq aes192-cbc ,
   .Dq aes256-cbc ,
   .Dq aes128-ctr ,
   .Dq aes192-ctr ,
   .Dq aes256-ctr ,
   .Dq arcfour ,
   .Dq blowfish-cbc ,
   and
   .Dq cast128-cbc .
 The default is  The default is
 .Pp  
 .Bd -literal  .Bd -literal
   ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,    ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
     aes192-cbc,aes256-cbc''      aes192-cbc,aes256-cbc''
Line 233 
Line 244 
 server, instead of using the default system TCP timeout.  server, instead of using the default system TCP timeout.
 This value is used only when the target is down or really unreachable,  This value is used only when the target is down or really unreachable,
 not when it refuses the connection.  not when it refuses the connection.
   .It Cm ControlMaster
   Enables the sharing of multiple sessions over a single network connection.
   When set to
   .Dq yes
   .Nm ssh
   will listen for connections on a control socket specified using the
   .Cm ControlPath
   argument.
   Additional sessions can connect to this socket using the same
   .Cm ControlPath
   with
   .Cm ControlMaster
   set to
   .Dq no
   (the default).
   These sessions will reuse the master instance's network connection rather
   than initiating new ones.
   Setting this to
   .Dq ask
   will cause
   .Nm ssh
   to listen for control connections, but require confirmation using the
   .Ev SSH_ASKPASS
   program before they are accepted (see
   .Xr ssh-add 1
   for details).
   .It Cm ControlPath
   Specify the path to the control socket used for connection sharing.
   See
   .Cm ControlMaster
   above.
 .It Cm DynamicForward  .It Cm DynamicForward
 Specifies that a TCP/IP port on the local machine be forwarded  Specifies that a TCP/IP port on the local machine be forwarded
 over the secure channel, and the application  over the secure channel, and the application
Line 260 
Line 302 
 .Dq no .  .Dq no .
 The default is  The default is
 .Dq no .  .Dq no .
   This option should be placed in the non-hostspecific section.
 See  See
 .Xr ssh-keysign 8  .Xr ssh-keysign 8
 for more information.  for more information.
Line 306 
Line 349 
 .Pp  .Pp
 X11 forwarding should be enabled with caution.  X11 forwarding should be enabled with caution.
 Users with the ability to bypass file permissions on the remote host  Users with the ability to bypass file permissions on the remote host
 (for the user's X authorization database)  (for the user's X11 authorization database)
 can access the local X11 display through the forwarded connection.  can access the local X11 display through the forwarded connection.
 An attacker may then be able to perform activities such as keystroke monitoring.  An attacker may then be able to perform activities such as keystroke monitoring
   if the
   .Cm ForwardX11Trusted
   option is also enabled.
   .It Cm ForwardX11Trusted
   If this option is set to
   .Dq yes
   then remote X11 clients will have full access to the original X11 display.
   If this option is set to
   .Dq no
   then remote X11 clients will be considered untrusted and prevented
   from stealing or tampering with data belonging to trusted X11
   clients.
   .Pp
   The default is
   .Dq no .
   .Pp
   See the X11 SECURITY extension specification for full details on
   the restrictions imposed on untrusted clients.
 .It Cm GatewayPorts  .It Cm GatewayPorts
 Specifies whether remote hosts are allowed to connect to local  Specifies whether remote hosts are allowed to connect to local
 forwarded ports.  forwarded ports.
Line 332 
Line 393 
 host key database instead of  host key database instead of
 .Pa /etc/ssh/ssh_known_hosts .  .Pa /etc/ssh/ssh_known_hosts .
 .It Cm GSSAPIAuthentication  .It Cm GSSAPIAuthentication
 Specifies whether authentication based on GSSAPI may be used, either using  Specifies whether user authentication based on GSSAPI is allowed.
 the result of a successful key exchange, or using GSSAPI user  
 authentication.  
 The default is  The default is
 .Dq yes .  .Dq no .
 Note that this option applies to protocol version 2 only.  Note that this option applies to protocol version 2 only.
 .It Cm GSSAPIDelegateCredentials  .It Cm GSSAPIDelegateCredentials
 Forward (delegate) credentials to the server.  Forward (delegate) credentials to the server.
Line 390 
Line 449 
 It is possible to have  It is possible to have
 multiple identity files specified in configuration files; all these  multiple identity files specified in configuration files; all these
 identities will be tried in sequence.  identities will be tried in sequence.
 .It Cm KeepAlive  .It Cm IdentitiesOnly
 Specifies whether the system should send TCP keepalive messages to the  Specifies that
 other side.  .Nm ssh
 If they are sent, death of the connection or crash of one  should only use the authentication identity files configured in the
 of the machines will be properly noticed.  .Nm
 However, this means that  files,
 connections will die if the route is down temporarily, and some people  even if the
 find it annoying.  .Nm ssh-agent
 .Pp  offers more identities.
 The default is  The argument to this keyword must be
 .Dq yes  .Dq yes
 (to send keepalives), and the client will notice  or
 if the network goes down or the remote host dies.  
 This is important in scripts, and many users want it too.  
 .Pp  
 To disable keepalives, the value should be set to  
 .Dq no .  .Dq no .
   This option is intented for situations where
   .Nm ssh-agent
   offers many different identities.
   The default is
   .Dq no .
 .It Cm LocalForward  .It Cm LocalForward
 Specifies that a TCP/IP port on the local machine be forwarded over  Specifies that a TCP/IP port on the local machine be forwarded over
 the secure channel to the specified host and port from the remote machine.  the secure channel to the specified host and port from the remote machine.
Line 553 
Line 613 
 The default is  The default is
 .Dq yes .  .Dq yes .
 Note that this option applies to protocol version 1 only.  Note that this option applies to protocol version 1 only.
   .It Cm SendEnv
   Specifies what variables from the local
   .Xr environ 7
   should be sent to the server.
   Note that environment passing is only supported for protocol 2, the
   server must also support it, and the server must be configured to
   accept these environment variables.
   Refer to
   .Cm AcceptEnv
   in
   .Xr sshd_config 5
   for how to configure the server.
   Variables are specified by name, which may contain the wildcard characters
   .Ql \&*
   and
   .Ql \&? .
   Multiple environment variables may be separated by whitespace or spread
   across multiple
   .Cm SendEnv
   directives.
   The default is not to send any environment variables.
   .It Cm ServerAliveInterval
   Sets a timeout interval in seconds after which if no data has been received
   from the server,
   .Nm ssh
   will send a message through the encrypted
   channel to request a response from the server.
   The default
   is 0, indicating that these messages will not be sent to the server.
   This option applies to protocol version 2 only.
   .It Cm ServerAliveCountMax
   Sets the number of server alive messages (see above) which may be
   sent without
   .Nm ssh
   receiving any messages back from the server.
   If this threshold is reached while server alive messages are being sent,
   .Nm ssh
   will disconnect from the server, terminating the session.
   It is important to note that the use of server alive messages is very
   different from
   .Cm TCPKeepAlive
   (below).
   The server alive messages are sent through the encrypted channel
   and therefore will not be spoofable.
   The TCP keepalive option enabled by
   .Cm TCPKeepAlive
   is spoofable.
   The server alive mechanism is valuable when the client or
   server depend on knowing when a connection has become inactive.
   .Pp
   The default value is 3.
   If, for example,
   .Cm ServerAliveInterval
   (above) is set to 15, and
   .Cm ServerAliveCountMax
   is left at the default, if the server becomes unresponsive ssh
   will disconnect after approximately 45 seconds.
 .It Cm SmartcardDevice  .It Cm SmartcardDevice
 Specifies which smartcard device to use.  Specifies which smartcard device to use.
 The argument to this keyword is the device  The argument to this keyword is the device
Line 595 
Line 712 
 .Dq ask .  .Dq ask .
 The default is  The default is
 .Dq ask .  .Dq ask .
   .It Cm TCPKeepAlive
   Specifies whether the system should send TCP keepalive messages to the
   other side.
   If they are sent, death of the connection or crash of one
   of the machines will be properly noticed.
   However, this means that
   connections will die if the route is down temporarily, and some people
   find it annoying.
   .Pp
   The default is
   .Dq yes
   (to send TCP keepalive messages), and the client will notice
   if the network goes down or the remote host dies.
   This is important in scripts, and many users want it too.
   .Pp
   To disable TCP keepalive messages, the value should be set to
   .Dq no .
 .It Cm UsePrivilegedPort  .It Cm UsePrivilegedPort
 Specifies whether to use a privileged port for outgoing connections.  Specifies whether to use a privileged port for outgoing connections.
 The argument must be  The argument must be
Line 624 
Line 758 
 .It Cm VerifyHostKeyDNS  .It Cm VerifyHostKeyDNS
 Specifies whether to verify the remote key using DNS and SSHFP resource  Specifies whether to verify the remote key using DNS and SSHFP resource
 records.  records.
   If this option is set to
   .Dq yes ,
   the client will implicitly trust keys that match a secure fingerprint
   from DNS.
   Insecure fingerprints will be handled as if this option was set to
   .Dq ask .
   If this option is set to
   .Dq ask ,
   information on fingerprint match will be displayed, but the user will still
   need to confirm new host keys according to the
   .Cm StrictHostKeyChecking
   option.
   The argument must be
   .Dq yes ,
   .Dq no
   or
   .Dq ask .
 The default is  The default is
 .Dq no .  .Dq no .
 Note that this option applies to protocol version 2 only.  Note that this option applies to protocol version 2 only.
Line 642 
Line 793 
 This file is used by the  This file is used by the
 .Nm ssh  .Nm ssh
 client.  client.
 This file does not usually contain any sensitive information,  Because of the potential for abuse, this file must have strict permissions:
 but the recommended permissions are read/write for the user, and not  read/write for the user, and not accessible by others.
 accessible by others.  
 .It Pa /etc/ssh/ssh_config  .It Pa /etc/ssh/ssh_config
 Systemwide configuration file.  Systemwide configuration file.
 This file provides defaults for those  This file provides defaults for those
Legend:
Removed from v.1.20  
changed lines
  Added in v.1.20.2.2