src/usr.bin/ssh/ssh_config.5 - diff

Return to ssh_config.5 CVS log

Up to [local] / src / usr.bin / ssh

Diff for /src/usr.bin/ssh/ssh_config.5 between version 1.239 and 1.240

version 1.239, 2016/09/28 17:59:22

version 1.240, 2016/10/15 19:56:25

Line 62

For each parameter, the first obtained value

will be used.

The configuration files contain sections separated by

.Dq Host

.Cm Host

specifications, and that section is only applied for hosts that

match one of the patterns given in the specification.

The matched host name is usually the one given on the command line

(see the

.Cm CanonicalizeHostname

option for exceptions.)

option for exceptions).

.Pp

Since the first obtained value for each parameter is used, more

host-specific declarations should be given near the beginning of the

file, and general defaults at the end.

.Pp

The configuration file has the following format:

The file contains keyword-argument pairs, one per line.

.Pp

Lines starting with

Empty lines and lines starting with

.Ql #

are comments.

and empty lines are interpreted as comments.

Otherwise a line is of the format

Arguments may optionally be enclosed in double quotes

.Dq keyword arguments .

.Pq \&"

in order to represent arguments containing spaces.

Configuration options may be separated by whitespace or

optional whitespace and exactly one

.Ql = ;

Line 92

.Nm sftp

.Fl o

option.

Arguments may optionally be enclosed in double quotes

.Pq \&"

in order to represent arguments containing spaces.

.Pp

The possible

keywords and their meanings are as follows (note that

Line 117

Line 114

argument given on the command line

(see the

.Cm CanonicalizeHostname

option for exceptions.)

keyword for exceptions).

.Pp

A pattern entry may be negated by prefixing it with an exclamation mark

.Pq Sq !\& .

Line 212

Line 209

Specifies whether keys should be automatically added to a running

.Xr ssh-agent 1 .

If this option is set to

.Dq yes

.Cm yes

and a key is loaded from a file, the key and its passphrase are added to

the agent with the default lifetime, as if by

.Xr ssh-add 1 .

If this option is set to

.Dq ask ,

.Cm ask ,

.Nm ssh

.Xr ssh 1

will require confirmation using the

.Ev SSH_ASKPASS

program before adding a key (see

.Xr ssh-add 1

for details).

If this option is set to

.Dq confirm ,

.Cm confirm ,

each use of the key must be confirmed, as if the

.Fl c

option was specified to

.Xr ssh-add 1 .

If this option is set to

.Dq no ,

.Cm no ,

no keys are added to the agent.

The argument must be

.Dq yes ,

.Cm yes ,

.Dq confirm ,

.Cm confirm ,

.Dq ask ,

.Cm ask ,

.Dq no .

.Cm no

The default is

(the default).

.Dq no .

.It Cm AddressFamily

Specifies which address family to use when connecting.

Valid arguments are

.Dq any ,

.Cm any

.Dq inet

(the default),

.Cm inet

(use IPv4 only), or

.Dq inet6

.Cm inet6

(use IPv6 only).

The default is

.Dq any .

.It Cm BatchMode

If set to

.Dq yes ,

.Cm yes ,

passphrase/password querying will be disabled.

This option is useful in scripts and other batch jobs where no user

is present to supply the password.

The argument must be

.Dq yes

.Cm yes

.Dq no .

.Cm no

The default is

(the default).

.Dq no .

.It Cm BindAddress

Use the specified address on the local machine as the source address of

the connection.

Line 270

Line 264

Note that this option does not work if

.Cm UsePrivilegedPort

is set to

.Dq yes .

.Cm yes .

.It Cm CanonicalDomains

When

.Cm CanonicalizeHostname

Line 279

Line 273

.It Cm CanonicalizeFallbackLocal

Specifies whether to fail with an error when hostname canonicalization fails.

The default,

.Dq yes ,

.Cm yes ,

will attempt to look up the unqualified hostname using the system resolver's

search rules.

A value of

.Dq no

.Cm no

will cause

.Xr ssh 1

to fail instantly if

Line 294

Line 288

.It Cm CanonicalizeHostname

Controls whether explicit hostname canonicalization is performed.

The default,

.Dq no ,

.Cm no ,

is not to perform any name rewriting and let the system resolver handle all

hostname lookups.

If set to

.Dq yes

.Cm yes

then, for connections that do not use a

.Cm ProxyCommand ,

.Xr ssh 1

Line 311

Line 305

.Cm CanonicalizeHostname

is set to

.Dq always ,

.Cm always ,

then canonicalization is applied to proxied connections too.

.Pp

If this option is enabled, then the configuration files are processed

Line 323

Line 317

.It Cm CanonicalizeMaxDots

Specifies the maximum number of dot characters in a hostname before

canonicalization is disabled.

The default,

The default, 1,

.Dq 1 ,

allows a single dot (i.e. hostname.subdomain).

.It Cm CanonicalizePermittedCNAMEs

Specifies rules to determine whether CNAMEs should be followed when

Line 339

Line 332

is a pattern-list of domains that they may resolve to.

.Pp

For example,

.Dq *.a.example.com:*.b.example.com,*.c.example.com

.Qq *.a.example.com:*.b.example.com,*.c.example.com

will allow hostnames matching

.Dq *.a.example.com

.Qq *.a.example.com

to be canonicalized to names in the

.Dq *.b.example.com

.Qq *.b.example.com

.Dq *.c.example.com

.Qq *.c.example.com

domains.

.It Cm CertificateFile

Specifies a file from which the user's certificate is read.

Line 378

Line 371

.It Cm ChallengeResponseAuthentication

Specifies whether to use challenge-response authentication.

The argument to this keyword must be

.Dq yes

.Cm yes

(the default)

.Dq no .

.Cm no .

The default is

.Dq yes .

.It Cm CheckHostIP

If this flag is set to

If set to

.Dq yes ,

.Cm yes

(the default),

.Xr ssh 1

will additionally check the host IP address in the

.Pa known_hosts

file.

This allows ssh to detect if a host key changed due to DNS spoofing

This allows it to detect if a host key changed due to DNS spoofing

and will add addresses of destination hosts to

.Pa ~/.ssh/known_hosts

in the process, regardless of the setting of

.Cm StrictHostKeyChecking .

If the option is set to

.Dq no ,

.Cm no ,

the check will not be executed.

The default is

.Dq yes .

.It Cm Cipher

Specifies the cipher to use for encrypting the session

in protocol version 1.

Currently,

.Dq blowfish ,

.Cm blowfish ,

.Dq 3des ,

.Cm 3des

(the default),

and

.Dq des

.Cm des

are supported.

are supported,

.Ar des

though

.Cm des

is only supported in the

.Xr ssh 1

client for interoperability with legacy protocol 1 implementations

client for interoperability with legacy protocol 1 implementations;

that do not support the

its use is strongly discouraged due to cryptographic weaknesses.

.Ar 3des

cipher.

Its use is strongly discouraged due to cryptographic weaknesses.

The default is

.Dq 3des .

.It Cm Ciphers

Specifies the ciphers allowed for protocol version 2

in order of preference.

Line 429

Line 417

instead of replacing them.

.Pp

The supported ciphers are:

.Pp

.Bd -literal -offset indent

.Bl -item -compact -offset indent

.It

3des-cbc

.It

aes128-cbc

.It

aes192-cbc

.It

aes256-cbc

.It

aes128-ctr

.It

aes192-ctr

.It

aes256-ctr

.It

aes128-gcm@openssh.com

.It

aes256-gcm@openssh.com

.It

arcfour

.It

arcfour128

.It

arcfour256

.It

blowfish-cbc

.It

cast128-cbc

.It

chacha20-poly1305@openssh.com

.El

.Ed

.Pp

The default is:

.Bd -literal -offset indent

Line 471

Line 443

aes128-cbc,aes192-cbc,aes256-cbc

.Ed

.Pp

The list of available ciphers may also be obtained using the

The list of available ciphers may also be obtained using

.Fl Q

.Qq ssh -Q cipher .

option of

.Xr ssh 1

with an argument of

.Dq cipher .

.It Cm ClearAllForwardings

Specifies that all local, remote, and dynamic port forwardings

specified in the configuration files or on the command line be

Line 489

Line 457

and

.Xr sftp 1 .

The argument must be

.Dq yes

.Cm yes

.Dq no .

.Cm no

The default is

(the default).

.Dq no .

.It Cm Compression

Specifies whether to use compression.

The argument must be

.Dq yes

.Cm yes

.Dq no .

.Cm no

The default is

(the default).

.Dq no .

.It Cm CompressionLevel

Specifies the compression level to use if compression is enabled.

The argument must be an integer from 1 (fast) to 9 (slow, best).

Line 522

Line 488

.It Cm ControlMaster

Enables the sharing of multiple sessions over a single network connection.

When set to

.Dq yes ,

.Cm yes ,

.Xr ssh 1

will listen for connections on a control socket specified using the

.Cm ControlPath

Line 532

Line 498

with

.Cm ControlMaster

set to

.Dq no

.Cm no

(the default).

These sessions will try to reuse the master instance's network connection

rather than initiating new ones, but will fall back to connecting normally

if the control socket does not exist, or is not listening.

.Pp

Setting this to

.Dq ask

.Cm ask

will cause ssh

will cause

.Xr ssh 1

to listen for control connections, but require confirmation using

.Xr ssh-askpass 1 .

If the

.Cm ControlPath

cannot be opened,

ssh will continue without connecting to a master instance.

.Xr ssh 1

will continue without connecting to a master instance.

.Pp

X11 and

.Xr ssh-agent 1

Line 558

Line 526

master connection but fall back to creating a new one if one does not already

exist.

These options are:

.Dq auto

.Cm auto

and

.Dq autoask .

.Cm autoask .

The latter requires confirmation like the

.Dq ask

.Cm ask

option.

.It Cm ControlPath

Specify the path to the control socket used for connection sharing as described

in the

.Cm ControlMaster

section above or the string

.Dq none

.Cm none

to disable connection sharing.

Arguments to

.Cm ControlPath

Line 590

Line 558

in the background (waiting for future client connections)

after the initial client connection has been closed.

If set to

.Dq no ,

.Cm no ,

then the master connection will not be placed into the background,

and will close as soon as the initial client connection is closed.

If set to

.Dq yes

.Cm yes

or 0,

.Dq 0 ,

then the master connection will remain in the background indefinitely

(until killed or closed via a mechanism such as the

.Xr ssh 1

.Qq ssh -O exit ) .

.Dq Fl O No exit

option).

If set to a time in seconds, or a time in any of the formats documented in

.Xr sshd_config 5 ,

then the backgrounded master connection will automatically terminate

Line 627

Line 592

The

.Ar bind_address

.Dq localhost

.Cm localhost

indicates that the listening port be bound for local use only, while an

empty address or

.Sq *

Line 641

Line 606

Only the superuser can forward privileged ports.

.It Cm EnableSSHKeysign

Setting this option to

.Dq yes

.Cm yes

in the global client configuration file

.Pa /etc/ssh/ssh_config

enables the use of the helper program

Line 649

Line 614

during

.Cm HostbasedAuthentication .

The argument must be

.Dq yes

.Cm yes

.Dq no .

.Cm no

The default is

(the default).

.Dq no .

This option should be placed in the non-hostspecific section.

See

.Xr ssh-keysign 8

Line 666

Line 630

The argument should be a single character,

.Ql ^

followed by a letter, or

.Dq none

.Cm none

to disable the escape

character entirely (making the connection transparent for binary

data).

Line 683

Line 647

.Xr ssh 1

to exit if TCP connections to the ultimate forwarding destination fail.

The argument must be

.Dq yes

.Cm yes

.Dq no .

.Cm no

The default is

(the default).

.Dq no .

.It Cm FingerprintHash

Specifies the hash algorithm used when displaying key fingerprints.

Valid options are:

.Dq md5

.Cm md5

and

.Dq sha256 .

.Cm sha256

The default is

(the default).

.Dq sha256 .

.It Cm ForwardAgent

Specifies whether the connection to the authentication agent (if any)

will be forwarded to the remote machine.

The argument must be

.Dq yes

.Cm yes

.Dq no .

.Cm no

The default is

(the default).

.Dq no .

.Pp

Agent forwarding should be enabled with caution.

Users with the ability to bypass file permissions on the remote host

Line 719

Line 680

.Ev DISPLAY

set.

The argument must be

.Dq yes

.Cm yes

.Dq no .

.Cm no

The default is

(the default).

.Dq no .

.Pp

X11 forwarding should be enabled with caution.

Users with the ability to bypass file permissions on the remote host

Line 736

Line 696

.It Cm ForwardX11Timeout

Specify a timeout for untrusted X11 forwarding

using the format described in the

TIME FORMATS section of

.Sx TIME FORMATS

section of

.Xr sshd_config 5 .

X11 connections received by

.Xr ssh 1

Line 745

Line 706

elapsed.

.It Cm ForwardX11Trusted

If this option is set to

.Dq yes ,

.Cm yes ,

remote X11 clients will have full access to the original X11 display.

.Pp

If this option is set to

.Dq no ,

.Cm no

(the default),

remote X11 clients will be considered untrusted and prevented

from stealing or tampering with data belonging to trusted X11

clients.

Line 758

Line 720

token used for the session will be set to expire after 20 minutes.

Remote clients will be refused access after this time.

.Pp

The default is

.Dq no .

.Pp

See the X11 SECURITY extension specification for full details on

the restrictions imposed on untrusted clients.

.It Cm GatewayPorts

Line 775

Line 734

should bind local port forwardings to the wildcard address,

thus allowing remote hosts to connect to forwarded ports.

The argument must be

.Dq yes

.Cm yes

.Dq no .

.Cm no

The default is

(the default).

.Dq no .

.It Cm GlobalKnownHostsFile

Specifies one or more files to use for the global

host key database, separated by whitespace.

Line 789

Line 747

.It Cm GSSAPIAuthentication

Specifies whether user authentication based on GSSAPI is allowed.

The default is

.Dq no .

.Cm no .

.It Cm GSSAPIDelegateCredentials

Forward (delegate) credentials to the server.

The default is

.Dq no .

.Cm no .

.It Cm HashKnownHosts

Indicates that

.Xr ssh 1

Line 806

Line 764

but they do not reveal identifying information should the file's contents

be disclosed.

The default is

.Dq no .

.Cm no .

Note that existing names and addresses in known hosts files

will not be converted automatically,

but may be manually hashed using

Line 815

Line 773

Specifies whether to try rhosts based authentication with public key

authentication.

The argument must be

.Dq yes

.Cm yes

.Dq no .

.Cm no

The default is

(the default).

.Dq no .

.It Cm HostbasedKeyTypes

Specifies the key types that will be used for hostbased authentication

as a comma-separated pattern list.

Line 864

Line 821

If hostkeys are known for the destination host then this default is modified

to prefer their algorithms.

.Pp

The list of available key types may also be obtained using the

The list of available key types may also be obtained using

.Fl Q

.Qq ssh -Q key .

option of

.Xr ssh 1

with an argument of

.Dq key .

.It Cm HostKeyAlias

Specifies an alias that should be used instead of the

real host name when looking up or saving the host key

Line 904

Line 857

.Cm PKCS11Provider

offers more identities.

The argument to this keyword must be

.Dq yes

.Cm yes

.Dq no .

.Cm no

(the default).

This option is intended for situations where ssh-agent

offers many different identities.

The default is

.Dq no .

.It Cm IdentityAgent

Specifies the

.Ux Ns -domain

socket used to communicate with the authentication agent.

.Pp

This option overrides the

.Dq SSH_AUTH_SOCK

.Ev SSH_AUTH_SOCK

environment variable and can be used to select a specific agent.

Setting the socket name to

.Dq none

.Cm none

disables the use of an authentication agent.

If the string

.Dq SSH_AUTH_SOCK

.Qq SSH_AUTH_SOCK

is specified, the location of the socket will be read from the

.Ev SSH_AUTH_SOCK

environment variable.

Line 999

Line 951

Multiple pathnames may be specified and each pathname may contain

.Xr glob 3

wildcards and, for user configurations, shell-like

.Dq ~

.Sq ~

references to user home directories.

Files without absolute paths are assumed to be in

.Pa ~/.ssh

Line 1016

Line 968

.It Cm IPQoS

Specifies the IPv4 type-of-service or DSCP class for connections.

Accepted values are

.Dq af11 ,

.Cm af11 ,

.Dq af12 ,

.Cm af12 ,

.Dq af13 ,

.Cm af13 ,

.Dq af21 ,

.Cm af21 ,

.Dq af22 ,

.Cm af22 ,

.Dq af23 ,

.Cm af23 ,

.Dq af31 ,

.Cm af31 ,

.Dq af32 ,

.Cm af32 ,

.Dq af33 ,

.Cm af33 ,

.Dq af41 ,

.Cm af41 ,

.Dq af42 ,

.Cm af42 ,

.Dq af43 ,

.Cm af43 ,

.Dq cs0 ,

.Cm cs0 ,

.Dq cs1 ,

.Cm cs1 ,

.Dq cs2 ,

.Cm cs2 ,

.Dq cs3 ,

.Cm cs3 ,

.Dq cs4 ,

.Cm cs4 ,

.Dq cs5 ,

.Cm cs5 ,

.Dq cs6 ,

.Cm cs6 ,

.Dq cs7 ,

.Cm cs7 ,

.Dq ef ,

.Cm ef ,

.Dq lowdelay ,

.Cm lowdelay ,

.Dq throughput ,

.Cm throughput ,

.Dq reliability ,

.Cm reliability ,

or a numeric value.

This option may take one or two arguments, separated by whitespace.

If one argument is specified, it is used as the packet class unconditionally.

If two values are specified, the first is automatically selected for

interactive sessions and the second for non-interactive sessions.

The default is

.Dq lowdelay

.Cm lowdelay

for interactive sessions and

.Dq throughput

.Cm throughput

for non-interactive sessions.

.It Cm KbdInteractiveAuthentication

Specifies whether to use keyboard-interactive authentication.

The argument to this keyword must be

.Dq yes

.Cm yes

(the default)

.Dq no .

.Cm no .

The default is

.Dq yes .

.It Cm KbdInteractiveDevices

Specifies the list of methods to use in keyboard-interactive authentication.

Multiple method names must be comma-separated.

Line 1065

Line 1016

The methods available vary depending on what the server supports.

For an OpenSSH server,

it may be zero or more of:

.Dq bsdauth ,

.Cm bsdauth ,

.Dq pam ,

.Cm pam ,

and

.Dq skey .

.Cm skey .

.It Cm KexAlgorithms

Specifies the available KEX (Key Exchange) algorithms.

Multiple algorithms must be comma-separated.

Line 1085

Line 1036

diffie-hellman-group14-sha1

.Ed

.Pp

The list of available key exchange algorithms may also be obtained using the

The list of available key exchange algorithms may also be obtained using

.Fl Q

.Qq ssh -Q kex .

option of

.Xr ssh 1

with an argument of

.Dq kex .

.It Cm LocalCommand

Specifies a command to execute on the local machine after successfully

connecting to the server.

Line 1133

Line 1080

The

.Ar bind_address

.Dq localhost

.Cm localhost

indicates that the listening port be bound for local use only, while an

empty address or

.Sq *

Line 1157

Line 1104

instead of replacing them.

.Pp

The algorithms that contain

.Dq -etm

.Qq -etm

calculate the MAC after encryption (encrypt-then-mac).

These are considered safer and their use recommended.

.Pp

Line 1170

Line 1117

hmac-sha2-256,hmac-sha2-512,hmac-sha1

.Ed

.Pp

The list of available MAC algorithms may also be obtained using the

The list of available MAC algorithms may also be obtained using

.Fl Q

.Qq ssh -Q mac .

option of

.Xr ssh 1

with an argument of

.Dq mac .

.It Cm NoHostAuthenticationForLocalhost

This option can be used if the home directory is shared across machines.

In this case localhost will refer to a different machine on each of

the machines and the user will get many warnings about changed host keys.

However, this option disables host authentication for localhost.

The argument to this keyword must be

.Dq yes

.Cm yes

.Dq no .

.Cm no .

The default is to check the host key for localhost.

(the default).

.It Cm NumberOfPasswordPrompts

Specifies the number of password prompts before giving up.

The argument to this keyword must be an integer.

Line 1193

Line 1136

.It Cm PasswordAuthentication

Specifies whether to use password authentication.

The argument to this keyword must be

.Dq yes

.Cm yes

(the default)

.Dq no .

.Cm no .

The default is

.Dq yes .

.It Cm PermitLocalCommand

Allow local command execution via the

.Ic LocalCommand

Line 1206

Line 1148

escape sequence in

.Xr ssh 1 .

The argument must be

.Dq yes

.Cm yes

.Dq no .

.Cm no

The default is

(the default).

.Dq no .

.It Cm PKCS11Provider

Specifies which PKCS#11 provider to use.

The argument to this keyword is the PKCS#11 shared library

Line 1235

Line 1176

Specifies the protocol versions

.Xr ssh 1

should support in order of preference.

The possible values are

The possible values are 1 and 2.

.Sq 1

and

.Sq 2 .

Multiple versions must be comma-separated.

When this option is set to

.Dq 2,1

.Cm 2,1

.Nm ssh

will try version 2 and fall back to version 1

if version 2 is not available.

The default is

The default is version 2.

.Sq 2 .

Protocol 1 suffers from a number of cryptographic weaknesses and should

not be used.

It is only offered to support legacy devices.

Line 1274

Line 1211

HostName of the host being connected (defaulting to the name typed by

the user).

Setting the command to

.Dq none

.Cm none

disables this option entirely.

Note that

.Cm CheckHostIP

Line 1319

Line 1256

.Xr ssh 1

instead of continuing to execute and pass data.

The default is

.Dq no .

.Cm no .

.It Cm PubkeyAcceptedKeyTypes

Specifies the key types that will be used for public key authentication

as a comma-separated pattern list.

Line 1338

Line 1275

ssh-ed25519,ssh-rsa

.Ed

.Pp

The

The list of available key types may also be obtained using

.Fl Q

.Qq ssh -Q key .

option of

.Xr ssh 1

may be used to list supported key types.

.It Cm PubkeyAuthentication

Specifies whether to try public key authentication.

The argument to this keyword must be

.Dq yes

.Cm yes

(the default)

.Dq no .

.Cm no .

The default is

.Dq yes .

.It Cm RekeyLimit

Specifies the maximum amount of data that may be transmitted before the

session key is renegotiated, optionally followed a maximum amount of

Line 1368

Line 1301

depending on the cipher.

The optional second value is specified in seconds and may use any of the

units documented in the

TIME FORMATS section of

.Sx TIME FORMATS

section of

.Xr sshd_config 5 .

The default value for

.Cm RekeyLimit

.Dq default none ,

.Cm default none ,

which means that rekeying is performed after the cipher's default amount

of data has been sent or received and no time based rekeying is done.

.It Cm RemoteForward

Line 1393

Line 1327

.Pp

If the

.Ar port

argument is

argument is 0,

.Ql 0 ,

the listen port will be dynamically allocated on the server and reported

to the client at run time.

.Pp

Line 1416

Line 1349

.It Cm RequestTTY

Specifies whether to request a pseudo-tty for the session.

The argument may be one of:

.Dq no

.Cm no

(never request a TTY),

.Dq yes

.Cm yes

(always request a TTY when standard input is a TTY),

.Dq force

.Cm force

(always request a TTY) or

.Dq auto

.Cm auto

(request a TTY when opening a login session).

This option mirrors the

.Fl t

Line 1444

Line 1377

Specifies whether to try rhosts based authentication with RSA host

authentication.

The argument must be

.Dq yes

.Cm yes

.Dq no .

.Cm no

The default is

(the default).

.Dq no .

This option applies to protocol version 1 only and requires

.Xr ssh 1

to be setuid root.

.It Cm RSAAuthentication

Specifies whether to try RSA authentication.

The argument to this keyword must be

.Dq yes

.Cm yes

(the default)

.Dq no .

.Cm no .

RSA authentication will only be

attempted if the identity file exists, or an authentication agent is

running.

The default is

.Dq yes .

Note that this option applies to protocol version 1 only.

.It Cm SendEnv

Specifies what variables from the local

Line 1545

Line 1476

This option is only used for port forwarding to a Unix-domain socket file.

.Pp

The argument must be

.Dq yes

.Cm yes

.Dq no .

.Cm no

The default is

(the default).

.Dq no .

.It Cm StrictHostKeyChecking

If this flag is set to

.Dq yes ,

.Cm yes ,

.Xr ssh 1

will never automatically add host keys to the

.Pa ~/.ssh/known_hosts

Line 1565

Line 1495

This option forces the user to manually

add all new hosts.

If this flag is set to

.Dq no ,

.Cm no ,

ssh will automatically add new host keys to the

user known hosts files.

If this flag is set to

.Dq ask ,

.Cm ask

(the default),

new host keys

will be added to the user known host files only after the user

has confirmed that is what they really want to do, and

ssh will refuse to connect to hosts whose host key has changed.

The host keys of

known hosts will be verified automatically in all cases.

The argument must be

.Dq yes ,

.Dq no ,

.Dq ask .

The default is

.Dq ask .

.It Cm TCPKeepAlive

Specifies whether the system should send TCP keepalive messages to the

other side.

Line 1593

Line 1517

find it annoying.

.Pp

The default is

.Dq yes

.Cm yes

(to send TCP keepalive messages), and the client will notice

if the network goes down or the remote host dies.

This is important in scripts, and many users want it too.

.Pp

To disable TCP keepalive messages, the value should be set to

.Dq no .

.Cm no .

.It Cm Tunnel

Request

.Xr tun 4

device forwarding between the client and the server.

The argument must be

.Dq yes ,

.Cm yes ,

.Dq point-to-point

.Cm point-to-point

(layer 3),

.Dq ethernet

.Cm ethernet

(layer 2),

.Dq no .

.Cm no

(the default).

Specifying

.Dq yes

.Cm yes

requests the default tunnel mode, which is

.Dq point-to-point .

.Cm point-to-point .

The default is

.Dq no .

.It Cm TunnelDevice

Specifies the

.Xr tun 4

Line 1631

Line 1554

.Ar local_tun Op : Ar remote_tun .

.Sm on

The devices may be specified by numerical ID or the keyword

.Dq any ,

.Cm any ,

which uses the next available tunnel device.

.Ar remote_tun

is not specified, it defaults to

.Dq any .

.Cm any .

The default is

.Dq any:any .

.Cm any:any .

.It Cm UpdateHostKeys

Specifies whether

.Xr ssh 1

Line 1646

Line 1569

after authentication has completed and add them to

.Cm UserKnownHostsFile .

The argument must be

.Dq yes ,

.Cm yes ,

.Dq no

.Cm no

(the default) or

.Dq ask .

.Cm ask .

Enabling this option allows learning alternate hostkeys for a server

and supports graceful key rotation by allowing a server to send replacement

public keys before old ones are removed.

Line 1658

Line 1581

.Cm UpdateHostKeys

is set to

.Dq ask ,

.Cm ask ,

then the user is asked to confirm the modifications to the known_hosts file.

Confirmation is currently incompatible with

.Cm ControlPersist ,

Line 1667

Line 1590

Presently, only

.Xr sshd 8

from OpenSSH 6.8 and greater support the

.Dq hostkeys@openssh.com

.Qq hostkeys@openssh.com

protocol extension used to inform the client of all the server's hostkeys.

.It Cm UsePrivilegedPort

Specifies whether to use a privileged port for outgoing connections.

The argument must be

.Dq yes

.Cm yes

.Dq no .

.Cm no

The default is

(the default).

.Dq no .

If set to

.Dq yes ,

.Cm yes ,

.Xr ssh 1

must be setuid root.

Note that this option must be set to

.Dq yes

.Cm yes

for

.Cm RhostsRSAAuthentication

with older servers.

Line 1701

Line 1623

Specifies whether to verify the remote key using DNS and SSHFP resource

records.

If this option is set to

.Dq yes ,

.Cm yes ,

the client will implicitly trust keys that match a secure fingerprint

from DNS.

Insecure fingerprints will be handled as if this option was set to

.Dq ask .

.Cm ask .

If this option is set to

.Dq ask ,

.Cm ask ,

information on fingerprint match will be displayed, but the user will still

need to confirm new host keys according to the

.Cm StrictHostKeyChecking

option.

The argument must be

.Dq yes ,

.Dq no ,

.Dq ask .

The default is

.Dq no .

.Cm no .

.Pp