src/usr.bin/ssh/ssh_config.5 - diff

Return to ssh_config.5 CVS log

Up to [local] / src / usr.bin / ssh

Diff for /src/usr.bin/ssh/ssh_config.5 between version 1.38 and 1.38.2.3

version 1.38, 2004/06/26 09:11:14

version 1.38.2.3, 2005/09/02 03:45:01

Line 43

.Nd OpenSSH SSH client configuration files

.Sh SYNOPSIS

.Bl -tag -width Ds -compact

.It Pa $HOME/.ssh/config

.It Pa ~/.ssh/config

.It Pa /etc/ssh/ssh_config

.El

.Sh DESCRIPTION

Line 55

command-line options

.It

user's configuration file

.Pq Pa $HOME/.ssh/config

.Pq Pa ~/.ssh/config

.It

system-wide configuration file

.Pq Pa /etc/ssh/ssh_config

Line 63

.Pp

For each parameter, the first obtained value

will be used.

The configuration files contain sections bracketed by

The configuration files contain sections separated by

.Dq Host

specifications, and that section is only applied for hosts that

match one of the patterns given in the specification.

Line 120

Valid arguments are

.Dq any ,

.Dq inet

(Use IPv4 only) or

(use IPv4 only) or

.Dq inet6

(Use IPv6 only.)

(use IPv6 only).

.It Cm BatchMode

If set to

.Dq yes ,

Line 136

The default is

.Dq no .

.It Cm BindAddress

Specify the interface to transmit from on machines with multiple

Use the specified address on the local machine as the source address of

interfaces or aliased addresses.

the connection.

Only useful on systems with more than one address.

Note that this option does not work if

.Cm UsePrivilegedPort

is set to

Line 193

Line 194

.Dq aes128-ctr ,

.Dq aes192-ctr ,

.Dq aes256-ctr ,

.Dq arcfour128 ,

.Dq arcfour256 ,

.Dq arcfour ,

.Dq blowfish-cbc ,

and

.Dq cast128-cbc .

The default is

.Bd -literal

``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,

``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,

aes192-cbc,aes256-cbc''

arcfour256,arcfour,aes192-cbc,aes256-cbc,aes128-ctr,

aes192-ctr,aes256-ctr''

.Ed

.It Cm ClearAllForwardings

Specifies that all local, remote and dynamic port forwardings

Line 270

Line 274

program before they are accepted (see

.Xr ssh-add 1

for details).

If the

.Cm ControlPath

can not be opened,

.Nm ssh

will continue without connecting to a master instance.

.Pp

X11 and

.Xr ssh-agent 1

forwarding is supported over these multiplexed connections, however the

display and agent fowarded will be the one belonging to the master

connection i.e. it is not possible to forward multiple displays or agents.

.Pp

Two additional options allow for opportunistic multiplexing: try to use a

master connection but fall back to creating a new one if one does not already

exist.

These options are:

.Dq auto

and

.Dq autoask .

The latter requires confirmation like the

.Dq ask

option.

.It Cm ControlPath

Specify the path to the control socket used for connection sharing.

Specify the path to the control socket used for connection sharing as described

See

in the

.Cm ControlMaster

above.

section above or the string

.Dq none

to disable connection sharing.

In the path,

.Ql %h

will be substituted by the target host name,

.Ql %p

the port and

.Ql %r

by the remote login username.

It is recommended that any

.Cm ControlPath

used for opportunistic connection sharing include

all three of these escape sequences.

This ensures that shared connections are uniquely identified.

.It Cm DynamicForward

Specifies that a TCP/IP port on the local machine be forwarded

over the secure channel, and the application

Line 359

Line 399

If this option is set to

.Dq yes

then remote X11 clients will have full access to the original X11 display.

.Pp

If this option is set to

.Dq no

then remote X11 clients will be considered untrusted and prevented

from stealing or tampering with data belonging to trusted X11

clients.

Furthermore, the

.Xr xauth 1

token used for the session will be set to expire after 20 minutes.

Remote clients will be refused access after this time.

.Pp

The default is

.Dq no .

Line 402

Line 447

The default is

.Dq no .

Note that this option applies to protocol version 2 only.

.It Cm HashKnownHosts

Indicates that

.Nm ssh

should hash host names and addresses when they are added to

.Pa ~/.ssh/known_hosts .

These hashed names may be used normally by

.Nm ssh

and

.Nm sshd ,

but they do not reveal identifying information should the file's contents

be disclosed.

The default is

.Dq no .

Note that hashing of names and addresses will not be retrospectively applied

to existing known hosts files, but these may be manually hashed using

.Xr ssh-keygen 1 .

.It Cm HostbasedAuthentication

Specifies whether to try rhosts based authentication with public key

authentication.

Line 436

Line 497

Specifies a file from which the user's RSA or DSA authentication identity

is read.

The default is

.Pa $HOME/.ssh/identity

.Pa ~/.ssh/identity

for protocol version 1, and

.Pa $HOME/.ssh/id_rsa

.Pa ~/.ssh/id_rsa

and

.Pa $HOME/.ssh/id_dsa

.Pa ~/.ssh/id_dsa

for protocol version 2.

Additionally, any identities represented by the authentication agent

will be used for authentication.

Line 467

Line 528

offers many different identities.

The default is

.Dq no .

.It Cm KbdInteractiveDevices

Specifies the list of methods to use in keyboard-interactive authentication.

Multiple method names must be comma-separated.

The default is to use the server specified list.

.It Cm LocalForward

Specifies that a TCP/IP port on the local machine be forwarded over

the secure channel to the specified host and port from the remote machine.

The first argument must be a port number, and the second must be

The first argument must be

.Ar host:port .

.Sm off

IPv6 addresses can be specified with an alternative syntax:

.Oo Ar bind_address : Oc Ar port

.Ar host/port .

.Sm on

Multiple forwardings may be specified, and additional

and the second argument must be

forwardings can be given on the command line.

.Ar host : Ns Ar hostport .

IPv6 addresses can be specified by enclosing addresses in square brackets or

by using an alternative syntax:

.Oo Ar bind_address Ns / Oc Ns Ar port

and

.Ar host Ns / Ns Ar hostport .

Multiple forwardings may be specified, and additional forwardings can be

given on the command line.

Only the superuser can forward privileged ports.

By default, the local port is bound in accordance with the

.Cm GatewayPorts

setting.

However, an explicit

.Ar bind_address

may be used to bind the connection to a specific address.

The

.Ar bind_address

.Dq localhost

indicates that the listening port be bound for local use only, while an

empty address or

.Sq *

indicates that the port should be available from all interfaces.

.It Cm LogLevel

Gives the verbosity level that is used when logging messages from

.Nm ssh .

Line 521

Line 607

.It Cm PreferredAuthentications

Specifies the order in which the client should try protocol 2

authentication methods.

This allows a client to prefer one method (e.g.

This allows a client to prefer one method (e.g.\&

.Cm keyboard-interactive )

over another method (e.g.

over another method (e.g.\&

.Cm password )

The default for this option is:

.Dq hostbased,publickey,keyboard-interactive,password .

Line 570

Line 656

.Cm CheckHostIP

is not available for connects with a proxy command.

.Pp

This directive is useful in conjunction with

.Xr nc 1

and its proxy support.

For example, the following directive would connect via an HTTP proxy at

192.0.2.0:

.Bd -literal -offset 3n

ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p

.Ed

.It Cm PubkeyAuthentication

Specifies whether to try public key authentication.

The argument to this keyword must be

Line 582

Line 676

.It Cm RemoteForward

Specifies that a TCP/IP port on the remote machine be forwarded over

the secure channel to the specified host and port from the local machine.

The first argument must be a port number, and the second must be

The first argument must be

.Ar host:port .

.Sm off

IPv6 addresses can be specified with an alternative syntax:

.Oo Ar bind_address : Oc Ar port

.Ar host/port .

.Sm on

and the second argument must be

.Ar host : Ns Ar hostport .

IPv6 addresses can be specified by enclosing addresses in square brackets

or by using an alternative syntax:

.Oo Ar bind_address Ns / Oc Ns Ar port

and

.Ar host Ns / Ns Ar hostport .

Multiple forwardings may be specified, and additional

forwardings can be given on the command line.

Only the superuser can forward privileged ports.

.Pp

If the

.Ar bind_address

is not specified, the default is to only bind to loopback addresses.

If the

.Ar bind_address

.Ql *

or an empty string, then the forwarding is requested to listen on all

interfaces.

Specifying a remote

.Ar bind_address

will only succeed if the server's

.Cm GatewayPorts

option is enabled (see

.Xr sshd_config 5 ) .

.It Cm RhostsRSAAuthentication

Specifies whether to try rhosts based authentication with RSA host

authentication.

Line 682

Line 799

.Dq yes ,

.Nm ssh

will never automatically add host keys to the

.Pa $HOME/.ssh/known_hosts

.Pa ~/.ssh/known_hosts

file, and refuses to connect to hosts whose host key has changed.

This provides maximum protection against trojan horse attacks,

however, can be annoying when the

Line 754

Line 871

.It Cm UserKnownHostsFile

Specifies a file to use for the user

host key database instead of

.Pa $HOME/.ssh/known_hosts .

.Pa ~/.ssh/known_hosts .

.It Cm VerifyHostKeyDNS

Specifies whether to verify the remote key using DNS and SSHFP resource

records.

Line 787

Line 904

.El

.Sh FILES

.Bl -tag -width Ds

.It Pa $HOME/.ssh/config

.It Pa ~/.ssh/config

This is the per-user configuration file.

The format of this file is described above.

This file is used by the