version 1.38.2.2, 2005/06/05 02:22:39 |
version 1.38.2.3, 2005/09/02 03:45:01 |
|
|
.Nd OpenSSH SSH client configuration files |
.Nd OpenSSH SSH client configuration files |
.Sh SYNOPSIS |
.Sh SYNOPSIS |
.Bl -tag -width Ds -compact |
.Bl -tag -width Ds -compact |
.It Pa $HOME/.ssh/config |
.It Pa ~/.ssh/config |
.It Pa /etc/ssh/ssh_config |
.It Pa /etc/ssh/ssh_config |
.El |
.El |
.Sh DESCRIPTION |
.Sh DESCRIPTION |
|
|
command-line options |
command-line options |
.It |
.It |
user's configuration file |
user's configuration file |
.Pq Pa $HOME/.ssh/config |
.Pq Pa ~/.ssh/config |
.It |
.It |
system-wide configuration file |
system-wide configuration file |
.Pq Pa /etc/ssh/ssh_config |
.Pq Pa /etc/ssh/ssh_config |
|
|
The default is |
The default is |
.Dq no . |
.Dq no . |
.It Cm BindAddress |
.It Cm BindAddress |
Specify the interface to transmit from on machines with multiple |
Use the specified address on the local machine as the source address of |
interfaces or aliased addresses. |
the connection. |
|
Only useful on systems with more than one address. |
Note that this option does not work if |
Note that this option does not work if |
.Cm UsePrivilegedPort |
.Cm UsePrivilegedPort |
is set to |
is set to |
|
|
.Dq aes128-ctr , |
.Dq aes128-ctr , |
.Dq aes192-ctr , |
.Dq aes192-ctr , |
.Dq aes256-ctr , |
.Dq aes256-ctr , |
|
.Dq arcfour128 , |
|
.Dq arcfour256 , |
.Dq arcfour , |
.Dq arcfour , |
.Dq blowfish-cbc , |
.Dq blowfish-cbc , |
and |
and |
.Dq cast128-cbc . |
.Dq cast128-cbc . |
The default is |
The default is |
.Bd -literal |
.Bd -literal |
``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour, |
``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128, |
aes192-cbc,aes256-cbc'' |
arcfour256,arcfour,aes192-cbc,aes256-cbc,aes128-ctr, |
|
aes192-ctr,aes256-ctr'' |
.Ed |
.Ed |
.It Cm ClearAllForwardings |
.It Cm ClearAllForwardings |
Specifies that all local, remote and dynamic port forwardings |
Specifies that all local, remote and dynamic port forwardings |
|
|
program before they are accepted (see |
program before they are accepted (see |
.Xr ssh-add 1 |
.Xr ssh-add 1 |
for details). |
for details). |
|
If the |
|
.Cm ControlPath |
|
can not be opened, |
|
.Nm ssh |
|
will continue without connecting to a master instance. |
|
.Pp |
|
X11 and |
|
.Xr ssh-agent 1 |
|
forwarding is supported over these multiplexed connections, however the |
|
display and agent fowarded will be the one belonging to the master |
|
connection i.e. it is not possible to forward multiple displays or agents. |
|
.Pp |
|
Two additional options allow for opportunistic multiplexing: try to use a |
|
master connection but fall back to creating a new one if one does not already |
|
exist. |
|
These options are: |
|
.Dq auto |
|
and |
|
.Dq autoask . |
|
The latter requires confirmation like the |
|
.Dq ask |
|
option. |
.It Cm ControlPath |
.It Cm ControlPath |
Specify the path to the control socket used for connection sharing. |
Specify the path to the control socket used for connection sharing as described |
See |
in the |
.Cm ControlMaster |
.Cm ControlMaster |
above. |
section above or the string |
|
.Dq none |
|
to disable connection sharing. |
|
In the path, |
|
.Ql %h |
|
will be substituted by the target host name, |
|
.Ql %p |
|
the port and |
|
.Ql %r |
|
by the remote login username. |
|
It is recommended that any |
|
.Cm ControlPath |
|
used for opportunistic connection sharing include |
|
all three of these escape sequences. |
|
This ensures that shared connections are uniquely identified. |
.It Cm DynamicForward |
.It Cm DynamicForward |
Specifies that a TCP/IP port on the local machine be forwarded |
Specifies that a TCP/IP port on the local machine be forwarded |
over the secure channel, and the application |
over the secure channel, and the application |
|
|
Indicates that |
Indicates that |
.Nm ssh |
.Nm ssh |
should hash host names and addresses when they are added to |
should hash host names and addresses when they are added to |
.Pa $HOME/.ssh/known_hosts . |
.Pa ~/.ssh/known_hosts . |
These hashed names may be used normally by |
These hashed names may be used normally by |
.Nm ssh |
.Nm ssh |
and |
and |
|
|
Specifies a file from which the user's RSA or DSA authentication identity |
Specifies a file from which the user's RSA or DSA authentication identity |
is read. |
is read. |
The default is |
The default is |
.Pa $HOME/.ssh/identity |
.Pa ~/.ssh/identity |
for protocol version 1, and |
for protocol version 1, and |
.Pa $HOME/.ssh/id_rsa |
.Pa ~/.ssh/id_rsa |
and |
and |
.Pa $HOME/.ssh/id_dsa |
.Pa ~/.ssh/id_dsa |
for protocol version 2. |
for protocol version 2. |
Additionally, any identities represented by the authentication agent |
Additionally, any identities represented by the authentication agent |
will be used for authentication. |
will be used for authentication. |
|
|
.Cm CheckHostIP |
.Cm CheckHostIP |
is not available for connects with a proxy command. |
is not available for connects with a proxy command. |
.Pp |
.Pp |
|
This directive is useful in conjunction with |
|
.Xr nc 1 |
|
and its proxy support. |
|
For example, the following directive would connect via an HTTP proxy at |
|
192.0.2.0: |
|
.Bd -literal -offset 3n |
|
ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p |
|
.Ed |
.It Cm PubkeyAuthentication |
.It Cm PubkeyAuthentication |
Specifies whether to try public key authentication. |
Specifies whether to try public key authentication. |
The argument to this keyword must be |
The argument to this keyword must be |
|
|
.Dq yes , |
.Dq yes , |
.Nm ssh |
.Nm ssh |
will never automatically add host keys to the |
will never automatically add host keys to the |
.Pa $HOME/.ssh/known_hosts |
.Pa ~/.ssh/known_hosts |
file, and refuses to connect to hosts whose host key has changed. |
file, and refuses to connect to hosts whose host key has changed. |
This provides maximum protection against trojan horse attacks, |
This provides maximum protection against trojan horse attacks, |
however, can be annoying when the |
however, can be annoying when the |
|
|
.It Cm UserKnownHostsFile |
.It Cm UserKnownHostsFile |
Specifies a file to use for the user |
Specifies a file to use for the user |
host key database instead of |
host key database instead of |
.Pa $HOME/.ssh/known_hosts . |
.Pa ~/.ssh/known_hosts . |
.It Cm VerifyHostKeyDNS |
.It Cm VerifyHostKeyDNS |
Specifies whether to verify the remote key using DNS and SSHFP resource |
Specifies whether to verify the remote key using DNS and SSHFP resource |
records. |
records. |
|
|
.El |
.El |
.Sh FILES |
.Sh FILES |
.Bl -tag -width Ds |
.Bl -tag -width Ds |
.It Pa $HOME/.ssh/config |
.It Pa ~/.ssh/config |
This is the per-user configuration file. |
This is the per-user configuration file. |
The format of this file is described above. |
The format of this file is described above. |
This file is used by the |
This file is used by the |