version 1.6, 2003/02/06 09:27:29 |
version 1.6.2.3, 2004/03/04 18:18:17 |
|
|
given after the keyword. |
given after the keyword. |
.Ql \&* |
.Ql \&* |
and |
and |
.Ql ? |
.Ql \&? |
can be used as wildcards in the |
can be used as wildcards in the |
patterns. |
patterns. |
A single |
A single |
|
|
.Ar hostname |
.Ar hostname |
argument given on the command line (i.e., the name is not converted to |
argument given on the command line (i.e., the name is not converted to |
a canonicalized host name before matching). |
a canonicalized host name before matching). |
.It Cm AFSTokenPassing |
.It Cm AddressFamily |
Specifies whether to pass AFS tokens to remote host. |
Specifies which address family to use when connecting. |
The argument to this keyword must be |
Valid arguments are |
.Dq yes |
.Dq any , |
or |
.Dq inet |
.Dq no . |
(Use IPv4 only) or |
This option applies to protocol version 1 only. |
.Dq inet6 |
|
(Use IPv6 only.) |
.It Cm BatchMode |
.It Cm BatchMode |
If set to |
If set to |
.Dq yes , |
.Dq yes , |
|
|
client for interoperability with legacy protocol 1 implementations |
client for interoperability with legacy protocol 1 implementations |
that do not support the |
that do not support the |
.Ar 3des |
.Ar 3des |
cipher. Its use is strongly discouraged due to cryptographic |
cipher. |
weaknesses. |
Its use is strongly discouraged due to cryptographic weaknesses. |
The default is |
The default is |
.Dq 3des . |
.Dq 3des . |
.It Cm Ciphers |
.It Cm Ciphers |
|
|
in order of preference. |
in order of preference. |
Multiple ciphers must be comma-separated. |
Multiple ciphers must be comma-separated. |
The default is |
The default is |
.Pp |
|
.Bd -literal |
.Bd -literal |
``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour, |
``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour, |
aes192-cbc,aes256-cbc'' |
aes192-cbc,aes256-cbc'' |
|
|
.It Cm ClearAllForwardings |
.It Cm ClearAllForwardings |
Specifies that all local, remote and dynamic port forwardings |
Specifies that all local, remote and dynamic port forwardings |
specified in the configuration files or on the command line be |
specified in the configuration files or on the command line be |
cleared. This option is primarily useful when used from the |
cleared. |
|
This option is primarily useful when used from the |
.Nm ssh |
.Nm ssh |
command line to clear port forwardings set in |
command line to clear port forwardings set in |
configuration files, and is automatically set by |
configuration files, and is automatically set by |
|
|
The argument must be an integer. |
The argument must be an integer. |
This may be useful in scripts if the connection sometimes fails. |
This may be useful in scripts if the connection sometimes fails. |
The default is 1. |
The default is 1. |
|
.It Cm ConnectTimeout |
|
Specifies the timeout (in seconds) used when connecting to the ssh |
|
server, instead of using the default system TCP timeout. |
|
This value is used only when the target is down or really unreachable, |
|
not when it refuses the connection. |
.It Cm DynamicForward |
.It Cm DynamicForward |
Specifies that a TCP/IP port on the local machine be forwarded |
Specifies that a TCP/IP port on the local machine be forwarded |
over the secure channel, and the application |
over the secure channel, and the application |
protocol is then used to determine where to connect to from the |
protocol is then used to determine where to connect to from the |
remote machine. The argument must be a port number. |
remote machine. |
Currently the SOCKS4 protocol is supported, and |
The argument must be a port number. |
|
Currently the SOCKS4 and SOCKS5 protocols are supported, and |
.Nm ssh |
.Nm ssh |
will act as a SOCKS4 server. |
will act as a SOCKS server. |
Multiple forwardings may be specified, and |
Multiple forwardings may be specified, and |
additional forwardings can be given on the command line. Only |
additional forwardings can be given on the command line. |
the superuser can forward privileged ports. |
Only the superuser can forward privileged ports. |
|
.It Cm EnableSSHKeysign |
|
Setting this option to |
|
.Dq yes |
|
in the global client configuration file |
|
.Pa /etc/ssh/ssh_config |
|
enables the use of the helper program |
|
.Xr ssh-keysign 8 |
|
during |
|
.Cm HostbasedAuthentication . |
|
The argument must be |
|
.Dq yes |
|
or |
|
.Dq no . |
|
The default is |
|
.Dq no . |
|
This option should be placed in the non-hostspecific section. |
|
See |
|
.Xr ssh-keysign 8 |
|
for more information. |
.It Cm EscapeChar |
.It Cm EscapeChar |
Sets the escape character (default: |
Sets the escape character (default: |
.Ql ~ ) . |
.Ql ~ ) . |
|
|
The default is |
The default is |
.Dq no . |
.Dq no . |
.Pp |
.Pp |
Agent forwarding should be enabled with caution. Users with the |
Agent forwarding should be enabled with caution. |
ability to bypass file permissions on the remote host (for the agent's |
Users with the ability to bypass file permissions on the remote host |
Unix-domain socket) can access the local agent through the forwarded |
(for the agent's Unix-domain socket) |
connection. An attacker cannot obtain key material from the agent, |
can access the local agent through the forwarded connection. |
|
An attacker cannot obtain key material from the agent, |
however they can perform operations on the keys that enable them to |
however they can perform operations on the keys that enable them to |
authenticate using the identities loaded into the agent. |
authenticate using the identities loaded into the agent. |
.It Cm ForwardX11 |
.It Cm ForwardX11 |
|
|
The default is |
The default is |
.Dq no . |
.Dq no . |
.Pp |
.Pp |
X11 forwarding should be enabled with caution. Users with the ability |
X11 forwarding should be enabled with caution. |
to bypass file permissions on the remote host (for the user's X |
Users with the ability to bypass file permissions on the remote host |
authorization database) can access the local X11 display through the |
(for the user's X11 authorization database) |
forwarded connection. An attacker may then be able to perform |
can access the local X11 display through the forwarded connection. |
activities such as keystroke monitoring. |
An attacker may then be able to perform activities such as keystroke monitoring |
|
if the |
|
.Cm ForwardX11Trusted |
|
option is also enabled. |
|
.It Cm ForwardX11Trusted |
|
If the this option is set to |
|
.Dq yes |
|
then remote X11 clients will have full access to the original X11 display. |
|
If this option is set to |
|
.Dq no |
|
then remote X11 clients will be considered untrusted and prevented |
|
from stealing or tampering with data belonging to trusted X11 |
|
clients. |
|
.Pp |
|
The default is |
|
.Dq no . |
|
.Pp |
|
See the X11 SECURITY extension specification for full details on |
|
the restrictions imposed on untrusted clients. |
.It Cm GatewayPorts |
.It Cm GatewayPorts |
Specifies whether remote hosts are allowed to connect to local |
Specifies whether remote hosts are allowed to connect to local |
forwarded ports. |
forwarded ports. |
By default, |
By default, |
.Nm ssh |
.Nm ssh |
binds local port forwardings to the loopback address. This |
binds local port forwardings to the loopback address. |
prevents other remote hosts from connecting to forwarded ports. |
This prevents other remote hosts from connecting to forwarded ports. |
.Cm GatewayPorts |
.Cm GatewayPorts |
can be used to specify that |
can be used to specify that |
.Nm ssh |
.Nm ssh |
|
|
Specifies a file to use for the global |
Specifies a file to use for the global |
host key database instead of |
host key database instead of |
.Pa /etc/ssh/ssh_known_hosts . |
.Pa /etc/ssh/ssh_known_hosts . |
|
.It Cm GSSAPIAuthentication |
|
Specifies whether user authentication based on GSSAPI is allowed. |
|
The default is |
|
.Dq no . |
|
Note that this option applies to protocol version 2 only. |
|
.It Cm GSSAPIDelegateCredentials |
|
Forward (delegate) credentials to the server. |
|
The default is |
|
.Dq no . |
|
Note that this option applies to protocol version 2 only. |
.It Cm HostbasedAuthentication |
.It Cm HostbasedAuthentication |
Specifies whether to try rhosts based authentication with public key |
Specifies whether to try rhosts based authentication with public key |
authentication. |
authentication. |
|
|
specifications). |
specifications). |
.It Cm IdentityFile |
.It Cm IdentityFile |
Specifies a file from which the user's RSA or DSA authentication identity |
Specifies a file from which the user's RSA or DSA authentication identity |
is read. The default is |
is read. |
|
The default is |
.Pa $HOME/.ssh/identity |
.Pa $HOME/.ssh/identity |
for protocol version 1, and |
for protocol version 1, and |
.Pa $HOME/.ssh/id_rsa |
.Pa $HOME/.ssh/id_rsa |
|
|
It is possible to have |
It is possible to have |
multiple identity files specified in configuration files; all these |
multiple identity files specified in configuration files; all these |
identities will be tried in sequence. |
identities will be tried in sequence. |
.It Cm KeepAlive |
|
Specifies whether the system should send TCP keepalive messages to the |
|
other side. |
|
If they are sent, death of the connection or crash of one |
|
of the machines will be properly noticed. |
|
However, this means that |
|
connections will die if the route is down temporarily, and some people |
|
find it annoying. |
|
.Pp |
|
The default is |
|
.Dq yes |
|
(to send keepalives), and the client will notice |
|
if the network goes down or the remote host dies. |
|
This is important in scripts, and many users want it too. |
|
.Pp |
|
To disable keepalives, the value should be set to |
|
.Dq no . |
|
.It Cm KerberosAuthentication |
|
Specifies whether Kerberos authentication will be used. |
|
The argument to this keyword must be |
|
.Dq yes |
|
or |
|
.Dq no . |
|
.It Cm KerberosTgtPassing |
|
Specifies whether a Kerberos TGT will be forwarded to the server. |
|
This will only work if the Kerberos server is actually an AFS kaserver. |
|
The argument to this keyword must be |
|
.Dq yes |
|
or |
|
.Dq no . |
|
.It Cm LocalForward |
.It Cm LocalForward |
Specifies that a TCP/IP port on the local machine be forwarded over |
Specifies that a TCP/IP port on the local machine be forwarded over |
the secure channel to the specified host and port from the remote machine. |
the secure channel to the specified host and port from the remote machine. |
|
|
.Nm ssh . |
.Nm ssh . |
The possible values are: |
The possible values are: |
QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3. |
QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3. |
The default is INFO. DEBUG and DEBUG1 are equivalent. DEBUG2 |
The default is INFO. |
and DEBUG3 each specify higher levels of verbose output. |
DEBUG and DEBUG1 are equivalent. |
|
DEBUG2 and DEBUG3 each specify higher levels of verbose output. |
.It Cm MACs |
.It Cm MACs |
Specifies the MAC (message authentication code) algorithms |
Specifies the MAC (message authentication code) algorithms |
in order of preference. |
in order of preference. |
|
|
Default is 22. |
Default is 22. |
.It Cm PreferredAuthentications |
.It Cm PreferredAuthentications |
Specifies the order in which the client should try protocol 2 |
Specifies the order in which the client should try protocol 2 |
authentication methods. This allows a client to prefer one method (e.g. |
authentication methods. |
|
This allows a client to prefer one method (e.g. |
.Cm keyboard-interactive ) |
.Cm keyboard-interactive ) |
over another method (e.g. |
over another method (e.g. |
.Cm password ) |
.Cm password ) |
|
|
Host key management will be done using the |
Host key management will be done using the |
HostName of the host being connected (defaulting to the name typed by |
HostName of the host being connected (defaulting to the name typed by |
the user). |
the user). |
Setting the command to |
Setting the command to |
.Dq none |
.Dq none |
disables this option entirely. |
disables this option entirely. |
Note that |
Note that |
.Cm CheckHostIP |
.Cm CheckHostIP |
|
|
Multiple forwardings may be specified, and additional |
Multiple forwardings may be specified, and additional |
forwardings can be given on the command line. |
forwardings can be given on the command line. |
Only the superuser can forward privileged ports. |
Only the superuser can forward privileged ports. |
.It Cm RhostsAuthentication |
|
Specifies whether to try rhosts based authentication. |
|
Note that this |
|
declaration only affects the client side and has no effect whatsoever |
|
on security. |
|
Most servers do not permit RhostsAuthentication because it |
|
is not secure (see |
|
.Cm RhostsRSAAuthentication ) . |
|
The argument to this keyword must be |
|
.Dq yes |
|
or |
|
.Dq no . |
|
The default is |
|
.Dq no . |
|
This option applies to protocol version 1 only and requires |
|
.Nm ssh |
|
to be setuid root and |
|
.Cm UsePrivilegedPort |
|
to be set to |
|
.Dq yes . |
|
.It Cm RhostsRSAAuthentication |
.It Cm RhostsRSAAuthentication |
Specifies whether to try rhosts based authentication with RSA host |
Specifies whether to try rhosts based authentication with RSA host |
authentication. |
authentication. |
|
|
The default is |
The default is |
.Dq yes . |
.Dq yes . |
Note that this option applies to protocol version 1 only. |
Note that this option applies to protocol version 1 only. |
|
.It Cm ServerAliveInterval |
|
Sets a timeout interval in seconds after which if no data has been received |
|
from the server, |
|
.Nm ssh |
|
will send a message through the encrypted |
|
channel to request a response from the server. |
|
The default |
|
is 0, indicating that these messages will not be sent to the server. |
|
This option applies to protocol version 2 only. |
|
.It Cm ServerAliveCountMax |
|
Sets the number of server alive messages (see above) which may be |
|
sent without |
|
.Nm ssh |
|
receiving any messages back from the server. |
|
If this threshold is reached while server alive messages are being sent, |
|
.Nm ssh |
|
will disconnect from the server, terminating the session. |
|
It is important to note that the use of server alive messages is very |
|
different from |
|
.Cm TCPKeepAlive |
|
(below). |
|
The server alive messages are sent through the encrypted channel |
|
and therefore will not be spoofable. |
|
The TCP keepalive option enabled by |
|
.Cm TCPKeepAlive |
|
is spoofable. |
|
The server alive mechanism is valuable when the client or |
|
server depend on knowing when a connection has become inactive. |
|
.Pp |
|
The default value is 3. |
|
If, for example, |
|
.Cm ServerAliveInterval |
|
(above) is set to 15, and |
|
.Cm ServerAliveCountMax |
|
is left at the default, if the server becomes unresponsive ssh |
|
will disconnect after approximately 45 seconds. |
.It Cm SmartcardDevice |
.It Cm SmartcardDevice |
Specifies which smartcard device to use. The argument to this keyword is |
Specifies which smartcard device to use. |
the device |
The argument to this keyword is the device |
.Nm ssh |
.Nm ssh |
should use to communicate with a smartcard used for storing the user's |
should use to communicate with a smartcard used for storing the user's |
private RSA key. By default, no device is specified and smartcard support |
private RSA key. |
is not activated. |
By default, no device is specified and smartcard support is not activated. |
.It Cm StrictHostKeyChecking |
.It Cm StrictHostKeyChecking |
If this flag is set to |
If this flag is set to |
.Dq yes , |
.Dq yes , |
|
|
.Dq ask . |
.Dq ask . |
The default is |
The default is |
.Dq ask . |
.Dq ask . |
|
.It Cm TCPKeepAlive |
|
Specifies whether the system should send TCP keepalive messages to the |
|
other side. |
|
If they are sent, death of the connection or crash of one |
|
of the machines will be properly noticed. |
|
However, this means that |
|
connections will die if the route is down temporarily, and some people |
|
find it annoying. |
|
.Pp |
|
The default is |
|
.Dq yes |
|
(to send TCP keepalive messages), and the client will notice |
|
if the network goes down or the remote host dies. |
|
This is important in scripts, and many users want it too. |
|
.Pp |
|
To disable TCP keepalive messages, the value should be set to |
|
.Dq no . |
.It Cm UsePrivilegedPort |
.It Cm UsePrivilegedPort |
Specifies whether to use a privileged port for outgoing connections. |
Specifies whether to use a privileged port for outgoing connections. |
The argument must be |
The argument must be |
|
|
must be setuid root. |
must be setuid root. |
Note that this option must be set to |
Note that this option must be set to |
.Dq yes |
.Dq yes |
if |
for |
.Cm RhostsAuthentication |
|
and |
|
.Cm RhostsRSAAuthentication |
.Cm RhostsRSAAuthentication |
authentications are needed with older servers. |
with older servers. |
.It Cm User |
.It Cm User |
Specifies the user to log in as. |
Specifies the user to log in as. |
This can be useful when a different user name is used on different machines. |
This can be useful when a different user name is used on different machines. |
|
|
Specifies a file to use for the user |
Specifies a file to use for the user |
host key database instead of |
host key database instead of |
.Pa $HOME/.ssh/known_hosts . |
.Pa $HOME/.ssh/known_hosts . |
|
.It Cm VerifyHostKeyDNS |
|
Specifies whether to verify the remote key using DNS and SSHFP resource |
|
records. |
|
If this option is set to |
|
.Dq yes , |
|
the client will implicitly trust keys that match a secure fingerprint |
|
from DNS. |
|
Insecure fingerprints will be handled as if this option was set to |
|
.Dq ask . |
|
If this option is set to |
|
.Dq ask , |
|
information on fingerprint match will be displayed, but the user will still |
|
need to confirm new host keys according to the |
|
.Cm StrictHostKeyChecking |
|
option. |
|
The argument must be |
|
.Dq yes , |
|
.Dq no |
|
or |
|
.Dq ask . |
|
The default is |
|
.Dq no . |
|
Note that this option applies to protocol version 2 only. |
.It Cm XAuthLocation |
.It Cm XAuthLocation |
Specifies the full pathname of the |
Specifies the full pathname of the |
.Xr xauth 1 |
.Xr xauth 1 |
|
|
for those users who do not have a configuration file. |
for those users who do not have a configuration file. |
This file must be world-readable. |
This file must be world-readable. |
.El |
.El |
|
.Sh SEE ALSO |
|
.Xr ssh 1 |
.Sh AUTHORS |
.Sh AUTHORS |
OpenSSH is a derivative of the original and free |
OpenSSH is a derivative of the original and free |
ssh 1.2.12 release by Tatu Ylonen. |
ssh 1.2.12 release by Tatu Ylonen. |
|
|
created OpenSSH. |
created OpenSSH. |
Markus Friedl contributed the support for SSH |
Markus Friedl contributed the support for SSH |
protocol versions 1.5 and 2.0. |
protocol versions 1.5 and 2.0. |
.Sh SEE ALSO |
|
.Xr ssh 1 |
|