version 1.6, 2003/02/06 09:27:29 |
version 1.6.2.2, 2003/09/16 20:50:44 |
|
|
given after the keyword. |
given after the keyword. |
.Ql \&* |
.Ql \&* |
and |
and |
.Ql ? |
.Ql \&? |
can be used as wildcards in the |
can be used as wildcards in the |
patterns. |
patterns. |
A single |
A single |
|
|
.Ar hostname |
.Ar hostname |
argument given on the command line (i.e., the name is not converted to |
argument given on the command line (i.e., the name is not converted to |
a canonicalized host name before matching). |
a canonicalized host name before matching). |
.It Cm AFSTokenPassing |
.It Cm AddressFamily |
Specifies whether to pass AFS tokens to remote host. |
Specifies which address family to use when connecting. |
The argument to this keyword must be |
Valid arguments are |
.Dq yes |
.Dq any , |
or |
.Dq inet |
.Dq no . |
(Use IPv4 only) or |
This option applies to protocol version 1 only. |
.Dq inet6 |
|
(Use IPv6 only.) |
.It Cm BatchMode |
.It Cm BatchMode |
If set to |
If set to |
.Dq yes , |
.Dq yes , |
|
|
client for interoperability with legacy protocol 1 implementations |
client for interoperability with legacy protocol 1 implementations |
that do not support the |
that do not support the |
.Ar 3des |
.Ar 3des |
cipher. Its use is strongly discouraged due to cryptographic |
cipher. |
weaknesses. |
Its use is strongly discouraged due to cryptographic weaknesses. |
The default is |
The default is |
.Dq 3des . |
.Dq 3des . |
.It Cm Ciphers |
.It Cm Ciphers |
|
|
.It Cm ClearAllForwardings |
.It Cm ClearAllForwardings |
Specifies that all local, remote and dynamic port forwardings |
Specifies that all local, remote and dynamic port forwardings |
specified in the configuration files or on the command line be |
specified in the configuration files or on the command line be |
cleared. This option is primarily useful when used from the |
cleared. |
|
This option is primarily useful when used from the |
.Nm ssh |
.Nm ssh |
command line to clear port forwardings set in |
command line to clear port forwardings set in |
configuration files, and is automatically set by |
configuration files, and is automatically set by |
|
|
The argument must be an integer. |
The argument must be an integer. |
This may be useful in scripts if the connection sometimes fails. |
This may be useful in scripts if the connection sometimes fails. |
The default is 1. |
The default is 1. |
|
.It Cm ConnectTimeout |
|
Specifies the timeout (in seconds) used when connecting to the ssh |
|
server, instead of using the default system TCP timeout. |
|
This value is used only when the target is down or really unreachable, |
|
not when it refuses the connection. |
.It Cm DynamicForward |
.It Cm DynamicForward |
Specifies that a TCP/IP port on the local machine be forwarded |
Specifies that a TCP/IP port on the local machine be forwarded |
over the secure channel, and the application |
over the secure channel, and the application |
protocol is then used to determine where to connect to from the |
protocol is then used to determine where to connect to from the |
remote machine. The argument must be a port number. |
remote machine. |
Currently the SOCKS4 protocol is supported, and |
The argument must be a port number. |
|
Currently the SOCKS4 and SOCKS5 protocols are supported, and |
.Nm ssh |
.Nm ssh |
will act as a SOCKS4 server. |
will act as a SOCKS server. |
Multiple forwardings may be specified, and |
Multiple forwardings may be specified, and |
additional forwardings can be given on the command line. Only |
additional forwardings can be given on the command line. |
the superuser can forward privileged ports. |
Only the superuser can forward privileged ports. |
|
.It Cm EnableSSHKeysign |
|
Setting this option to |
|
.Dq yes |
|
in the global client configuration file |
|
.Pa /etc/ssh/ssh_config |
|
enables the use of the helper program |
|
.Xr ssh-keysign 8 |
|
during |
|
.Cm HostbasedAuthentication . |
|
The argument must be |
|
.Dq yes |
|
or |
|
.Dq no . |
|
The default is |
|
.Dq no . |
|
See |
|
.Xr ssh-keysign 8 |
|
for more information. |
.It Cm EscapeChar |
.It Cm EscapeChar |
Sets the escape character (default: |
Sets the escape character (default: |
.Ql ~ ) . |
.Ql ~ ) . |
|
|
The default is |
The default is |
.Dq no . |
.Dq no . |
.Pp |
.Pp |
Agent forwarding should be enabled with caution. Users with the |
Agent forwarding should be enabled with caution. |
ability to bypass file permissions on the remote host (for the agent's |
Users with the ability to bypass file permissions on the remote host |
Unix-domain socket) can access the local agent through the forwarded |
(for the agent's Unix-domain socket) |
connection. An attacker cannot obtain key material from the agent, |
can access the local agent through the forwarded connection. |
|
An attacker cannot obtain key material from the agent, |
however they can perform operations on the keys that enable them to |
however they can perform operations on the keys that enable them to |
authenticate using the identities loaded into the agent. |
authenticate using the identities loaded into the agent. |
.It Cm ForwardX11 |
.It Cm ForwardX11 |
|
|
The default is |
The default is |
.Dq no . |
.Dq no . |
.Pp |
.Pp |
X11 forwarding should be enabled with caution. Users with the ability |
X11 forwarding should be enabled with caution. |
to bypass file permissions on the remote host (for the user's X |
Users with the ability to bypass file permissions on the remote host |
authorization database) can access the local X11 display through the |
(for the user's X authorization database) |
forwarded connection. An attacker may then be able to perform |
can access the local X11 display through the forwarded connection. |
activities such as keystroke monitoring. |
An attacker may then be able to perform activities such as keystroke monitoring. |
.It Cm GatewayPorts |
.It Cm GatewayPorts |
Specifies whether remote hosts are allowed to connect to local |
Specifies whether remote hosts are allowed to connect to local |
forwarded ports. |
forwarded ports. |
By default, |
By default, |
.Nm ssh |
.Nm ssh |
binds local port forwardings to the loopback address. This |
binds local port forwardings to the loopback address. |
prevents other remote hosts from connecting to forwarded ports. |
This prevents other remote hosts from connecting to forwarded ports. |
.Cm GatewayPorts |
.Cm GatewayPorts |
can be used to specify that |
can be used to specify that |
.Nm ssh |
.Nm ssh |
|
|
Specifies a file to use for the global |
Specifies a file to use for the global |
host key database instead of |
host key database instead of |
.Pa /etc/ssh/ssh_known_hosts . |
.Pa /etc/ssh/ssh_known_hosts . |
|
.It Cm GSSAPIAuthentication |
|
Specifies whether authentication based on GSSAPI may be used, either using |
|
the result of a successful key exchange, or using GSSAPI user |
|
authentication. |
|
The default is |
|
.Dq yes . |
|
Note that this option applies to protocol version 2 only. |
|
.It Cm GSSAPIDelegateCredentials |
|
Forward (delegate) credentials to the server. |
|
The default is |
|
.Dq no . |
|
Note that this option applies to protocol version 2 only. |
.It Cm HostbasedAuthentication |
.It Cm HostbasedAuthentication |
Specifies whether to try rhosts based authentication with public key |
Specifies whether to try rhosts based authentication with public key |
authentication. |
authentication. |
|
|
specifications). |
specifications). |
.It Cm IdentityFile |
.It Cm IdentityFile |
Specifies a file from which the user's RSA or DSA authentication identity |
Specifies a file from which the user's RSA or DSA authentication identity |
is read. The default is |
is read. |
|
The default is |
.Pa $HOME/.ssh/identity |
.Pa $HOME/.ssh/identity |
for protocol version 1, and |
for protocol version 1, and |
.Pa $HOME/.ssh/id_rsa |
.Pa $HOME/.ssh/id_rsa |
|
|
.Pp |
.Pp |
To disable keepalives, the value should be set to |
To disable keepalives, the value should be set to |
.Dq no . |
.Dq no . |
.It Cm KerberosAuthentication |
|
Specifies whether Kerberos authentication will be used. |
|
The argument to this keyword must be |
|
.Dq yes |
|
or |
|
.Dq no . |
|
.It Cm KerberosTgtPassing |
|
Specifies whether a Kerberos TGT will be forwarded to the server. |
|
This will only work if the Kerberos server is actually an AFS kaserver. |
|
The argument to this keyword must be |
|
.Dq yes |
|
or |
|
.Dq no . |
|
.It Cm LocalForward |
.It Cm LocalForward |
Specifies that a TCP/IP port on the local machine be forwarded over |
Specifies that a TCP/IP port on the local machine be forwarded over |
the secure channel to the specified host and port from the remote machine. |
the secure channel to the specified host and port from the remote machine. |
|
|
.Nm ssh . |
.Nm ssh . |
The possible values are: |
The possible values are: |
QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3. |
QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3. |
The default is INFO. DEBUG and DEBUG1 are equivalent. DEBUG2 |
The default is INFO. |
and DEBUG3 each specify higher levels of verbose output. |
DEBUG and DEBUG1 are equivalent. |
|
DEBUG2 and DEBUG3 each specify higher levels of verbose output. |
.It Cm MACs |
.It Cm MACs |
Specifies the MAC (message authentication code) algorithms |
Specifies the MAC (message authentication code) algorithms |
in order of preference. |
in order of preference. |
|
|
Default is 22. |
Default is 22. |
.It Cm PreferredAuthentications |
.It Cm PreferredAuthentications |
Specifies the order in which the client should try protocol 2 |
Specifies the order in which the client should try protocol 2 |
authentication methods. This allows a client to prefer one method (e.g. |
authentication methods. |
|
This allows a client to prefer one method (e.g. |
.Cm keyboard-interactive ) |
.Cm keyboard-interactive ) |
over another method (e.g. |
over another method (e.g. |
.Cm password ) |
.Cm password ) |
|
|
Host key management will be done using the |
Host key management will be done using the |
HostName of the host being connected (defaulting to the name typed by |
HostName of the host being connected (defaulting to the name typed by |
the user). |
the user). |
Setting the command to |
Setting the command to |
.Dq none |
.Dq none |
disables this option entirely. |
disables this option entirely. |
Note that |
Note that |
.Cm CheckHostIP |
.Cm CheckHostIP |
|
|
Multiple forwardings may be specified, and additional |
Multiple forwardings may be specified, and additional |
forwardings can be given on the command line. |
forwardings can be given on the command line. |
Only the superuser can forward privileged ports. |
Only the superuser can forward privileged ports. |
.It Cm RhostsAuthentication |
|
Specifies whether to try rhosts based authentication. |
|
Note that this |
|
declaration only affects the client side and has no effect whatsoever |
|
on security. |
|
Most servers do not permit RhostsAuthentication because it |
|
is not secure (see |
|
.Cm RhostsRSAAuthentication ) . |
|
The argument to this keyword must be |
|
.Dq yes |
|
or |
|
.Dq no . |
|
The default is |
|
.Dq no . |
|
This option applies to protocol version 1 only and requires |
|
.Nm ssh |
|
to be setuid root and |
|
.Cm UsePrivilegedPort |
|
to be set to |
|
.Dq yes . |
|
.It Cm RhostsRSAAuthentication |
.It Cm RhostsRSAAuthentication |
Specifies whether to try rhosts based authentication with RSA host |
Specifies whether to try rhosts based authentication with RSA host |
authentication. |
authentication. |
|
|
.Dq yes . |
.Dq yes . |
Note that this option applies to protocol version 1 only. |
Note that this option applies to protocol version 1 only. |
.It Cm SmartcardDevice |
.It Cm SmartcardDevice |
Specifies which smartcard device to use. The argument to this keyword is |
Specifies which smartcard device to use. |
the device |
The argument to this keyword is the device |
.Nm ssh |
.Nm ssh |
should use to communicate with a smartcard used for storing the user's |
should use to communicate with a smartcard used for storing the user's |
private RSA key. By default, no device is specified and smartcard support |
private RSA key. |
is not activated. |
By default, no device is specified and smartcard support is not activated. |
.It Cm StrictHostKeyChecking |
.It Cm StrictHostKeyChecking |
If this flag is set to |
If this flag is set to |
.Dq yes , |
.Dq yes , |
|
|
must be setuid root. |
must be setuid root. |
Note that this option must be set to |
Note that this option must be set to |
.Dq yes |
.Dq yes |
if |
for |
.Cm RhostsAuthentication |
|
and |
|
.Cm RhostsRSAAuthentication |
.Cm RhostsRSAAuthentication |
authentications are needed with older servers. |
with older servers. |
.It Cm User |
.It Cm User |
Specifies the user to log in as. |
Specifies the user to log in as. |
This can be useful when a different user name is used on different machines. |
This can be useful when a different user name is used on different machines. |
|
|
Specifies a file to use for the user |
Specifies a file to use for the user |
host key database instead of |
host key database instead of |
.Pa $HOME/.ssh/known_hosts . |
.Pa $HOME/.ssh/known_hosts . |
|
.It Cm VerifyHostKeyDNS |
|
Specifies whether to verify the remote key using DNS and SSHFP resource |
|
records. |
|
The default is |
|
.Dq no . |
|
Note that this option applies to protocol version 2 only. |
.It Cm XAuthLocation |
.It Cm XAuthLocation |
Specifies the full pathname of the |
Specifies the full pathname of the |
.Xr xauth 1 |
.Xr xauth 1 |
|
|
for those users who do not have a configuration file. |
for those users who do not have a configuration file. |
This file must be world-readable. |
This file must be world-readable. |
.El |
.El |
|
.Sh SEE ALSO |
|
.Xr ssh 1 |
.Sh AUTHORS |
.Sh AUTHORS |
OpenSSH is a derivative of the original and free |
OpenSSH is a derivative of the original and free |
ssh 1.2.12 release by Tatu Ylonen. |
ssh 1.2.12 release by Tatu Ylonen. |
|
|
created OpenSSH. |
created OpenSSH. |
Markus Friedl contributed the support for SSH |
Markus Friedl contributed the support for SSH |
protocol versions 1.5 and 2.0. |
protocol versions 1.5 and 2.0. |
.Sh SEE ALSO |
|
.Xr ssh 1 |
|