version 1.61, 2005/07/08 12:53:10 |
version 1.61.2.2, 2006/10/06 03:19:33 |
|
|
.It Pa /etc/ssh/ssh_config |
.It Pa /etc/ssh/ssh_config |
.El |
.El |
.Sh DESCRIPTION |
.Sh DESCRIPTION |
.Nm ssh |
.Xr ssh 1 |
obtains configuration data from the following sources in |
obtains configuration data from the following sources in |
the following order: |
the following order: |
|
.Pp |
.Bl -enum -offset indent -compact |
.Bl -enum -offset indent -compact |
.It |
.It |
command-line options |
command-line options |
|
|
Empty lines and lines starting with |
Empty lines and lines starting with |
.Ql # |
.Ql # |
are comments. |
are comments. |
.Pp |
|
Otherwise a line is of the format |
Otherwise a line is of the format |
.Dq keyword arguments . |
.Dq keyword arguments . |
Configuration options may be separated by whitespace or |
Configuration options may be separated by whitespace or |
|
|
the latter format is useful to avoid the need to quote whitespace |
the latter format is useful to avoid the need to quote whitespace |
when specifying configuration options using the |
when specifying configuration options using the |
.Nm ssh , |
.Nm ssh , |
.Nm scp |
.Nm scp , |
and |
and |
.Nm sftp |
.Nm sftp |
.Fl o |
.Fl o |
option. |
option. |
|
Arguments may optionally be enclosed in double quotes |
|
.Pq \&" |
|
in order to represent arguments containing spaces. |
.Pp |
.Pp |
The possible |
The possible |
keywords and their meanings are as follows (note that |
keywords and their meanings are as follows (note that |
|
|
.Cm Host |
.Cm Host |
keyword) to be only for those hosts that match one of the patterns |
keyword) to be only for those hosts that match one of the patterns |
given after the keyword. |
given after the keyword. |
.Ql \&* |
|
and |
|
.Ql \&? |
|
can be used as wildcards in the |
|
patterns. |
|
A single |
A single |
.Ql \&* |
.Ql * |
as a pattern can be used to provide global |
as a pattern can be used to provide global |
defaults for all hosts. |
defaults for all hosts. |
The host is the |
The host is the |
.Ar hostname |
.Ar hostname |
argument given on the command line (i.e., the name is not converted to |
argument given on the command line (i.e. the name is not converted to |
a canonicalized host name before matching). |
a canonicalized host name before matching). |
|
.Pp |
|
See |
|
.Sx PATTERNS |
|
for more information on patterns. |
.It Cm AddressFamily |
.It Cm AddressFamily |
Specifies which address family to use when connecting. |
Specifies which address family to use when connecting. |
Valid arguments are |
Valid arguments are |
.Dq any , |
.Dq any , |
.Dq inet |
.Dq inet |
(use IPv4 only) or |
(use IPv4 only), or |
.Dq inet6 |
.Dq inet6 |
(use IPv6 only). |
(use IPv6 only). |
.It Cm BatchMode |
.It Cm BatchMode |
|
|
is set to |
is set to |
.Dq yes . |
.Dq yes . |
.It Cm ChallengeResponseAuthentication |
.It Cm ChallengeResponseAuthentication |
Specifies whether to use challenge response authentication. |
Specifies whether to use challenge-response authentication. |
The argument to this keyword must be |
The argument to this keyword must be |
.Dq yes |
.Dq yes |
or |
or |
|
|
.It Cm CheckHostIP |
.It Cm CheckHostIP |
If this flag is set to |
If this flag is set to |
.Dq yes , |
.Dq yes , |
ssh will additionally check the host IP address in the |
.Xr ssh 1 |
|
will additionally check the host IP address in the |
.Pa known_hosts |
.Pa known_hosts |
file. |
file. |
This allows ssh to detect if a host key changed due to DNS spoofing. |
This allows ssh to detect if a host key changed due to DNS spoofing. |
|
|
are supported. |
are supported. |
.Ar des |
.Ar des |
is only supported in the |
is only supported in the |
.Nm ssh |
.Xr ssh 1 |
client for interoperability with legacy protocol 1 implementations |
client for interoperability with legacy protocol 1 implementations |
that do not support the |
that do not support the |
.Ar 3des |
.Ar 3des |
|
|
.Dq blowfish-cbc , |
.Dq blowfish-cbc , |
and |
and |
.Dq cast128-cbc . |
.Dq cast128-cbc . |
The default is |
The default is: |
.Bd -literal |
.Bd -literal -offset 3n |
``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128, |
aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128, |
arcfour256,arcfour,aes192-cbc,aes256-cbc,aes128-ctr, |
arcfour256,arcfour,aes192-cbc,aes256-cbc,aes128-ctr, |
aes192-ctr,aes256-ctr'' |
aes192-ctr,aes256-ctr |
.Ed |
.Ed |
.It Cm ClearAllForwardings |
.It Cm ClearAllForwardings |
Specifies that all local, remote and dynamic port forwardings |
Specifies that all local, remote, and dynamic port forwardings |
specified in the configuration files or on the command line be |
specified in the configuration files or on the command line be |
cleared. |
cleared. |
This option is primarily useful when used from the |
This option is primarily useful when used from the |
.Nm ssh |
.Xr ssh 1 |
command line to clear port forwardings set in |
command line to clear port forwardings set in |
configuration files, and is automatically set by |
configuration files, and is automatically set by |
.Xr scp 1 |
.Xr scp 1 |
|
|
This may be useful in scripts if the connection sometimes fails. |
This may be useful in scripts if the connection sometimes fails. |
The default is 1. |
The default is 1. |
.It Cm ConnectTimeout |
.It Cm ConnectTimeout |
Specifies the timeout (in seconds) used when connecting to the ssh |
Specifies the timeout (in seconds) used when connecting to the |
server, instead of using the default system TCP timeout. |
SSH server, instead of using the default system TCP timeout. |
This value is used only when the target is down or really unreachable, |
This value is used only when the target is down or really unreachable, |
not when it refuses the connection. |
not when it refuses the connection. |
.It Cm ControlMaster |
.It Cm ControlMaster |
Enables the sharing of multiple sessions over a single network connection. |
Enables the sharing of multiple sessions over a single network connection. |
When set to |
When set to |
.Dq yes |
.Dq yes , |
.Nm ssh |
.Xr ssh 1 |
will listen for connections on a control socket specified using the |
will listen for connections on a control socket specified using the |
.Cm ControlPath |
.Cm ControlPath |
argument. |
argument. |
|
|
set to |
set to |
.Dq no |
.Dq no |
(the default). |
(the default). |
These sessions will reuse the master instance's network connection rather |
These sessions will try to reuse the master instance's network connection |
than initiating new ones. |
rather than initiating new ones, but will fall back to connecting normally |
|
if the control socket does not exist, or is not listening. |
|
.Pp |
Setting this to |
Setting this to |
.Dq ask |
.Dq ask |
will cause |
will cause ssh |
.Nm ssh |
|
to listen for control connections, but require confirmation using the |
to listen for control connections, but require confirmation using the |
.Ev SSH_ASKPASS |
.Ev SSH_ASKPASS |
program before they are accepted (see |
program before they are accepted (see |
|
|
for details). |
for details). |
If the |
If the |
.Cm ControlPath |
.Cm ControlPath |
can not be opened, |
cannot be opened, |
.Nm ssh |
ssh will continue without connecting to a master instance. |
will continue without connecting to a master instance. |
|
.Pp |
.Pp |
X11 and |
X11 and |
.Xr ssh-agent 1 |
.Xr ssh-agent 1 |
forwarding is supported over these multiplexed connections, however the |
forwarding is supported over these multiplexed connections, however the |
display and agent fowarded will be the one belonging to the master |
display and agent forwarded will be the one belonging to the master |
connection i.e. it is not possible to forward multiple displays or agents. |
connection i.e. it is not possible to forward multiple displays or agents. |
.Pp |
.Pp |
Two additional options allow for opportunistic multiplexing: try to use a |
Two additional options allow for opportunistic multiplexing: try to use a |
|
|
.Dq none |
.Dq none |
to disable connection sharing. |
to disable connection sharing. |
In the path, |
In the path, |
|
.Ql %l |
|
will be substituted by the local host name, |
.Ql %h |
.Ql %h |
will be substituted by the target host name, |
will be substituted by the target host name, |
.Ql %p |
.Ql %p |
the port and |
the port, and |
.Ql %r |
.Ql %r |
by the remote login username. |
by the remote login username. |
It is recommended that any |
It is recommended that any |
.Cm ControlPath |
.Cm ControlPath |
used for opportunistic connection sharing include |
used for opportunistic connection sharing include |
all three of these escape sequences. |
at least %h, %p, and %r. |
This ensures that shared connections are uniquely identified. |
This ensures that shared connections are uniquely identified. |
.It Cm DynamicForward |
.It Cm DynamicForward |
Specifies that a TCP/IP port on the local machine be forwarded |
Specifies that a TCP port on the local machine be forwarded |
over the secure channel, and the application |
over the secure channel, and the application |
protocol is then used to determine where to connect to from the |
protocol is then used to determine where to connect to from the |
remote machine. |
remote machine. |
The argument must be a port number. |
.Pp |
|
The argument must be |
|
.Sm off |
|
.Oo Ar bind_address : Oc Ar port . |
|
.Sm on |
|
IPv6 addresses can be specified by enclosing addresses in square brackets or |
|
by using an alternative syntax: |
|
.Oo Ar bind_address Ns / Oc Ns Ar port . |
|
By default, the local port is bound in accordance with the |
|
.Cm GatewayPorts |
|
setting. |
|
However, an explicit |
|
.Ar bind_address |
|
may be used to bind the connection to a specific address. |
|
The |
|
.Ar bind_address |
|
of |
|
.Dq localhost |
|
indicates that the listening port be bound for local use only, while an |
|
empty address or |
|
.Sq * |
|
indicates that the port should be available from all interfaces. |
|
.Pp |
Currently the SOCKS4 and SOCKS5 protocols are supported, and |
Currently the SOCKS4 and SOCKS5 protocols are supported, and |
.Nm ssh |
.Xr ssh 1 |
will act as a SOCKS server. |
will act as a SOCKS server. |
Multiple forwardings may be specified, and |
Multiple forwardings may be specified, and |
additional forwardings can be given on the command line. |
additional forwardings can be given on the command line. |
|
|
to disable the escape |
to disable the escape |
character entirely (making the connection transparent for binary |
character entirely (making the connection transparent for binary |
data). |
data). |
|
.It Cm ExitOnForwardFailure |
|
Specifies whether |
|
.Xr ssh 1 |
|
should terminate the connection if it cannot set up all requested |
|
dynamic, local, and remote port forwardings. |
|
The argument must be |
|
.Dq yes |
|
or |
|
.Dq no . |
|
The default is |
|
.Dq no . |
.It Cm ForwardAgent |
.It Cm ForwardAgent |
Specifies whether the connection to the authentication agent (if any) |
Specifies whether the connection to the authentication agent (if any) |
will be forwarded to the remote machine. |
will be forwarded to the remote machine. |
|
|
option is also enabled. |
option is also enabled. |
.It Cm ForwardX11Trusted |
.It Cm ForwardX11Trusted |
If this option is set to |
If this option is set to |
.Dq yes |
.Dq yes , |
then remote X11 clients will have full access to the original X11 display. |
remote X11 clients will have full access to the original X11 display. |
.Pp |
.Pp |
If this option is set to |
If this option is set to |
.Dq no |
.Dq no , |
then remote X11 clients will be considered untrusted and prevented |
remote X11 clients will be considered untrusted and prevented |
from stealing or tampering with data belonging to trusted X11 |
from stealing or tampering with data belonging to trusted X11 |
clients. |
clients. |
Furthermore, the |
Furthermore, the |
|
|
Specifies whether remote hosts are allowed to connect to local |
Specifies whether remote hosts are allowed to connect to local |
forwarded ports. |
forwarded ports. |
By default, |
By default, |
.Nm ssh |
.Xr ssh 1 |
binds local port forwardings to the loopback address. |
binds local port forwardings to the loopback address. |
This prevents other remote hosts from connecting to forwarded ports. |
This prevents other remote hosts from connecting to forwarded ports. |
.Cm GatewayPorts |
.Cm GatewayPorts |
can be used to specify that |
can be used to specify that ssh |
.Nm ssh |
|
should bind local port forwardings to the wildcard address, |
should bind local port forwardings to the wildcard address, |
thus allowing remote hosts to connect to forwarded ports. |
thus allowing remote hosts to connect to forwarded ports. |
The argument must be |
The argument must be |
|
|
Note that this option applies to protocol version 2 only. |
Note that this option applies to protocol version 2 only. |
.It Cm HashKnownHosts |
.It Cm HashKnownHosts |
Indicates that |
Indicates that |
.Nm ssh |
.Xr ssh 1 |
should hash host names and addresses when they are added to |
should hash host names and addresses when they are added to |
.Pa ~/.ssh/known_hosts . |
.Pa ~/.ssh/known_hosts . |
These hashed names may be used normally by |
These hashed names may be used normally by |
.Nm ssh |
.Xr ssh 1 |
and |
and |
.Nm sshd , |
.Xr sshd 8 , |
but they do not reveal identifying information should the file's contents |
but they do not reveal identifying information should the file's contents |
be disclosed. |
be disclosed. |
The default is |
The default is |
.Dq no . |
.Dq no . |
Note that hashing of names and addresses will not be retrospectively applied |
Note that existing names and addresses in known hosts files |
to existing known hosts files, but these may be manually hashed using |
will not be converted automatically, |
|
but may be manually hashed using |
.Xr ssh-keygen 1 . |
.Xr ssh-keygen 1 . |
.It Cm HostbasedAuthentication |
.It Cm HostbasedAuthentication |
Specifies whether to try rhosts based authentication with public key |
Specifies whether to try rhosts based authentication with public key |
|
|
Specifies an alias that should be used instead of the |
Specifies an alias that should be used instead of the |
real host name when looking up or saving the host key |
real host name when looking up or saving the host key |
in the host key database files. |
in the host key database files. |
This option is useful for tunneling ssh connections |
This option is useful for tunneling SSH connections |
or for multiple servers running on a single host. |
or for multiple servers running on a single host. |
.It Cm HostName |
.It Cm HostName |
Specifies the real host name to log into. |
Specifies the real host name to log into. |
This can be used to specify nicknames or abbreviations for hosts. |
This can be used to specify nicknames or abbreviations for hosts. |
Default is the name given on the command line. |
The default is the name given on the command line. |
Numeric IP addresses are also permitted (both on the command line and in |
Numeric IP addresses are also permitted (both on the command line and in |
.Cm HostName |
.Cm HostName |
specifications). |
specifications). |
|
.It Cm IdentitiesOnly |
|
Specifies that |
|
.Xr ssh 1 |
|
should only use the authentication identity files configured in the |
|
.Nm |
|
files, |
|
even if |
|
.Xr ssh-agent 1 |
|
offers more identities. |
|
The argument to this keyword must be |
|
.Dq yes |
|
or |
|
.Dq no . |
|
This option is intended for situations where ssh-agent |
|
offers many different identities. |
|
The default is |
|
.Dq no . |
.It Cm IdentityFile |
.It Cm IdentityFile |
Specifies a file from which the user's RSA or DSA authentication identity |
Specifies a file from which the user's RSA or DSA authentication identity |
is read. |
is read. |
|
|
for protocol version 2. |
for protocol version 2. |
Additionally, any identities represented by the authentication agent |
Additionally, any identities represented by the authentication agent |
will be used for authentication. |
will be used for authentication. |
|
.Pp |
The file name may use the tilde |
The file name may use the tilde |
syntax to refer to a user's home directory. |
syntax to refer to a user's home directory or one of the following |
|
escape characters: |
|
.Ql %d |
|
(local user's home directory), |
|
.Ql %u |
|
(local user name), |
|
.Ql %l |
|
(local host name), |
|
.Ql %h |
|
(remote host name) or |
|
.Ql %r |
|
(remote user name). |
|
.Pp |
It is possible to have |
It is possible to have |
multiple identity files specified in configuration files; all these |
multiple identity files specified in configuration files; all these |
identities will be tried in sequence. |
identities will be tried in sequence. |
.It Cm IdentitiesOnly |
|
Specifies that |
|
.Nm ssh |
|
should only use the authentication identity files configured in the |
|
.Nm |
|
files, |
|
even if the |
|
.Nm ssh-agent |
|
offers more identities. |
|
The argument to this keyword must be |
|
.Dq yes |
|
or |
|
.Dq no . |
|
This option is intented for situations where |
|
.Nm ssh-agent |
|
offers many different identities. |
|
The default is |
|
.Dq no . |
|
.It Cm KbdInteractiveDevices |
.It Cm KbdInteractiveDevices |
Specifies the list of methods to use in keyboard-interactive authentication. |
Specifies the list of methods to use in keyboard-interactive authentication. |
Multiple method names must be comma-separated. |
Multiple method names must be comma-separated. |
The default is to use the server specified list. |
The default is to use the server specified list. |
|
The methods available vary depending on what the server supports. |
|
For an OpenSSH server, |
|
it may be zero or more of: |
|
.Dq bsdauth , |
|
.Dq pam , |
|
and |
|
.Dq skey . |
|
.It Cm LocalCommand |
|
Specifies a command to execute on the local machine after successfully |
|
connecting to the server. |
|
The command string extends to the end of the line, and is executed with |
|
.Pa /bin/sh . |
|
This directive is ignored unless |
|
.Cm PermitLocalCommand |
|
has been enabled. |
.It Cm LocalForward |
.It Cm LocalForward |
Specifies that a TCP/IP port on the local machine be forwarded over |
Specifies that a TCP port on the local machine be forwarded over |
the secure channel to the specified host and port from the remote machine. |
the secure channel to the specified host and port from the remote machine. |
The first argument must be |
The first argument must be |
.Sm off |
.Sm off |
|
|
indicates that the port should be available from all interfaces. |
indicates that the port should be available from all interfaces. |
.It Cm LogLevel |
.It Cm LogLevel |
Gives the verbosity level that is used when logging messages from |
Gives the verbosity level that is used when logging messages from |
.Nm ssh . |
.Xr ssh 1 . |
The possible values are: |
The possible values are: |
QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3. |
QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. |
The default is INFO. |
The default is INFO. |
DEBUG and DEBUG1 are equivalent. |
DEBUG and DEBUG1 are equivalent. |
DEBUG2 and DEBUG3 each specify higher levels of verbose output. |
DEBUG2 and DEBUG3 each specify higher levels of verbose output. |
|
|
The MAC algorithm is used in protocol version 2 |
The MAC algorithm is used in protocol version 2 |
for data integrity protection. |
for data integrity protection. |
Multiple algorithms must be comma-separated. |
Multiple algorithms must be comma-separated. |
The default is |
The default is: |
.Dq hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96 . |
.Dq hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96 . |
.It Cm NoHostAuthenticationForLocalhost |
.It Cm NoHostAuthenticationForLocalhost |
This option can be used if the home directory is shared across machines. |
This option can be used if the home directory is shared across machines. |
|
|
.It Cm NumberOfPasswordPrompts |
.It Cm NumberOfPasswordPrompts |
Specifies the number of password prompts before giving up. |
Specifies the number of password prompts before giving up. |
The argument to this keyword must be an integer. |
The argument to this keyword must be an integer. |
Default is 3. |
The default is 3. |
.It Cm PasswordAuthentication |
.It Cm PasswordAuthentication |
Specifies whether to use password authentication. |
Specifies whether to use password authentication. |
The argument to this keyword must be |
The argument to this keyword must be |
|
|
.Dq no . |
.Dq no . |
The default is |
The default is |
.Dq yes . |
.Dq yes . |
|
.It Cm PermitLocalCommand |
|
Allow local command execution via the |
|
.Ic LocalCommand |
|
option or using the |
|
.Ic !\& Ns Ar command |
|
escape sequence in |
|
.Xr ssh 1 . |
|
The argument must be |
|
.Dq yes |
|
or |
|
.Dq no . |
|
The default is |
|
.Dq no . |
.It Cm Port |
.It Cm Port |
Specifies the port number to connect on the remote host. |
Specifies the port number to connect on the remote host. |
Default is 22. |
The default is 22. |
.It Cm PreferredAuthentications |
.It Cm PreferredAuthentications |
Specifies the order in which the client should try protocol 2 |
Specifies the order in which the client should try protocol 2 |
authentication methods. |
authentication methods. |
|
|
over another method (e.g.\& |
over another method (e.g.\& |
.Cm password ) |
.Cm password ) |
The default for this option is: |
The default for this option is: |
.Dq hostbased,publickey,keyboard-interactive,password . |
.Do gssapi-with-mic , |
|
hostbased, |
|
publickey, |
|
keyboard-interactive, |
|
password |
|
.Dc . |
.It Cm Protocol |
.It Cm Protocol |
Specifies the protocol versions |
Specifies the protocol versions |
.Nm ssh |
.Xr ssh 1 |
should support in order of preference. |
should support in order of preference. |
The possible values are |
The possible values are |
.Dq 1 |
.Sq 1 |
and |
and |
.Dq 2 . |
.Sq 2 . |
Multiple versions must be comma-separated. |
Multiple versions must be comma-separated. |
The default is |
The default is |
.Dq 2,1 . |
.Dq 2,1 . |
This means that |
This means that ssh |
.Nm ssh |
|
tries version 2 and falls back to version 1 |
tries version 2 and falls back to version 1 |
if version 2 is not available. |
if version 2 is not available. |
.It Cm ProxyCommand |
.It Cm ProxyCommand |
|
|
The default is |
The default is |
.Dq yes . |
.Dq yes . |
This option applies to protocol version 2 only. |
This option applies to protocol version 2 only. |
|
.It Cm RekeyLimit |
|
Specifies the maximum amount of data that may be transmitted before the |
|
session key is renegotiated. |
|
The argument is the number of bytes, with an optional suffix of |
|
.Sq K , |
|
.Sq M , |
|
or |
|
.Sq G |
|
to indicate Kilobytes, Megabytes, or Gigabytes, respectively. |
|
The default is between |
|
.Sq 1G |
|
and |
|
.Sq 4G , |
|
depending on the cipher. |
|
This option applies to protocol version 2 only. |
.It Cm RemoteForward |
.It Cm RemoteForward |
Specifies that a TCP/IP port on the remote machine be forwarded over |
Specifies that a TCP port on the remote machine be forwarded over |
the secure channel to the specified host and port from the local machine. |
the secure channel to the specified host and port from the local machine. |
The first argument must be |
The first argument must be |
.Sm off |
.Sm off |
|
|
The default is |
The default is |
.Dq no . |
.Dq no . |
This option applies to protocol version 1 only and requires |
This option applies to protocol version 1 only and requires |
.Nm ssh |
.Xr ssh 1 |
to be setuid root. |
to be setuid root. |
.It Cm RSAAuthentication |
.It Cm RSAAuthentication |
Specifies whether to try RSA authentication. |
Specifies whether to try RSA authentication. |
|
|
Specifies what variables from the local |
Specifies what variables from the local |
.Xr environ 7 |
.Xr environ 7 |
should be sent to the server. |
should be sent to the server. |
Note that environment passing is only supported for protocol 2, the |
Note that environment passing is only supported for protocol 2. |
server must also support it, and the server must be configured to |
The server must also support it, and the server must be configured to |
accept these environment variables. |
accept these environment variables. |
Refer to |
Refer to |
.Cm AcceptEnv |
.Cm AcceptEnv |
in |
in |
.Xr sshd_config 5 |
.Xr sshd_config 5 |
for how to configure the server. |
for how to configure the server. |
Variables are specified by name, which may contain the wildcard characters |
Variables are specified by name, which may contain wildcard characters. |
.Ql \&* |
|
and |
|
.Ql \&? . |
|
Multiple environment variables may be separated by whitespace or spread |
Multiple environment variables may be separated by whitespace or spread |
across multiple |
across multiple |
.Cm SendEnv |
.Cm SendEnv |
directives. |
directives. |
The default is not to send any environment variables. |
The default is not to send any environment variables. |
.It Cm ServerAliveInterval |
.Pp |
Sets a timeout interval in seconds after which if no data has been received |
See |
from the server, |
.Sx PATTERNS |
.Nm ssh |
for more information on patterns. |
will send a message through the encrypted |
|
channel to request a response from the server. |
|
The default |
|
is 0, indicating that these messages will not be sent to the server. |
|
This option applies to protocol version 2 only. |
|
.It Cm ServerAliveCountMax |
.It Cm ServerAliveCountMax |
Sets the number of server alive messages (see above) which may be |
Sets the number of server alive messages (see below) which may be |
sent without |
sent without |
.Nm ssh |
.Xr ssh 1 |
receiving any messages back from the server. |
receiving any messages back from the server. |
If this threshold is reached while server alive messages are being sent, |
If this threshold is reached while server alive messages are being sent, |
.Nm ssh |
ssh will disconnect from the server, terminating the session. |
will disconnect from the server, terminating the session. |
|
It is important to note that the use of server alive messages is very |
It is important to note that the use of server alive messages is very |
different from |
different from |
.Cm TCPKeepAlive |
.Cm TCPKeepAlive |
|
|
The default value is 3. |
The default value is 3. |
If, for example, |
If, for example, |
.Cm ServerAliveInterval |
.Cm ServerAliveInterval |
(above) is set to 15, and |
(see below) is set to 15 and |
.Cm ServerAliveCountMax |
.Cm ServerAliveCountMax |
is left at the default, if the server becomes unresponsive ssh |
is left at the default, if the server becomes unresponsive, |
will disconnect after approximately 45 seconds. |
ssh will disconnect after approximately 45 seconds. |
|
This option applies to protocol version 2 only. |
|
.It Cm ServerAliveInterval |
|
Sets a timeout interval in seconds after which if no data has been received |
|
from the server, |
|
.Xr ssh 1 |
|
will send a message through the encrypted |
|
channel to request a response from the server. |
|
The default |
|
is 0, indicating that these messages will not be sent to the server. |
|
This option applies to protocol version 2 only. |
.It Cm SmartcardDevice |
.It Cm SmartcardDevice |
Specifies which smartcard device to use. |
Specifies which smartcard device to use. |
The argument to this keyword is the device |
The argument to this keyword is the device |
.Nm ssh |
.Xr ssh 1 |
should use to communicate with a smartcard used for storing the user's |
should use to communicate with a smartcard used for storing the user's |
private RSA key. |
private RSA key. |
By default, no device is specified and smartcard support is not activated. |
By default, no device is specified and smartcard support is not activated. |
.It Cm StrictHostKeyChecking |
.It Cm StrictHostKeyChecking |
If this flag is set to |
If this flag is set to |
.Dq yes , |
.Dq yes , |
.Nm ssh |
.Xr ssh 1 |
will never automatically add host keys to the |
will never automatically add host keys to the |
.Pa ~/.ssh/known_hosts |
.Pa ~/.ssh/known_hosts |
file, and refuses to connect to hosts whose host key has changed. |
file, and refuses to connect to hosts whose host key has changed. |
This provides maximum protection against trojan horse attacks, |
This provides maximum protection against trojan horse attacks, |
however, can be annoying when the |
though it can be annoying when the |
.Pa /etc/ssh/ssh_known_hosts |
.Pa /etc/ssh/ssh_known_hosts |
file is poorly maintained, or connections to new hosts are |
file is poorly maintained or when connections to new hosts are |
frequently made. |
frequently made. |
This option forces the user to manually |
This option forces the user to manually |
add all new hosts. |
add all new hosts. |
If this flag is set to |
If this flag is set to |
.Dq no , |
.Dq no , |
.Nm ssh |
ssh will automatically add new host keys to the |
will automatically add new host keys to the |
|
user known hosts files. |
user known hosts files. |
If this flag is set to |
If this flag is set to |
.Dq ask , |
.Dq ask , |
new host keys |
new host keys |
will be added to the user known host files only after the user |
will be added to the user known host files only after the user |
has confirmed that is what they really want to do, and |
has confirmed that is what they really want to do, and |
.Nm ssh |
ssh will refuse to connect to hosts whose host key has changed. |
will refuse to connect to hosts whose host key has changed. |
|
The host keys of |
The host keys of |
known hosts will be verified automatically in all cases. |
known hosts will be verified automatically in all cases. |
The argument must be |
The argument must be |
.Dq yes , |
.Dq yes , |
.Dq no |
.Dq no , |
or |
or |
.Dq ask . |
.Dq ask . |
The default is |
The default is |
|
|
.Pp |
.Pp |
To disable TCP keepalive messages, the value should be set to |
To disable TCP keepalive messages, the value should be set to |
.Dq no . |
.Dq no . |
|
.It Cm Tunnel |
|
Request |
|
.Xr tun 4 |
|
device forwarding between the client and the server. |
|
The argument must be |
|
.Dq yes , |
|
.Dq point-to-point |
|
(layer 3), |
|
.Dq ethernet |
|
(layer 2), |
|
or |
|
.Dq no . |
|
Specifying |
|
.Dq yes |
|
requests the default tunnel mode, which is |
|
.Dq point-to-point . |
|
The default is |
|
.Dq no . |
|
.It Cm TunnelDevice |
|
Specifies the |
|
.Xr tun 4 |
|
devices to open on the client |
|
.Pq Ar local_tun |
|
and the server |
|
.Pq Ar remote_tun . |
|
.Pp |
|
The argument must be |
|
.Sm off |
|
.Ar local_tun Op : Ar remote_tun . |
|
.Sm on |
|
The devices may be specified by numerical ID or the keyword |
|
.Dq any , |
|
which uses the next available tunnel device. |
|
If |
|
.Ar remote_tun |
|
is not specified, it defaults to |
|
.Dq any . |
|
The default is |
|
.Dq any:any . |
.It Cm UsePrivilegedPort |
.It Cm UsePrivilegedPort |
Specifies whether to use a privileged port for outgoing connections. |
Specifies whether to use a privileged port for outgoing connections. |
The argument must be |
The argument must be |
|
|
The default is |
The default is |
.Dq no . |
.Dq no . |
If set to |
If set to |
.Dq yes |
.Dq yes , |
.Nm ssh |
.Xr ssh 1 |
must be setuid root. |
must be setuid root. |
Note that this option must be set to |
Note that this option must be set to |
.Dq yes |
.Dq yes |
|
|
option. |
option. |
The argument must be |
The argument must be |
.Dq yes , |
.Dq yes , |
.Dq no |
.Dq no , |
or |
or |
.Dq ask . |
.Dq ask . |
The default is |
The default is |
.Dq no . |
.Dq no . |
Note that this option applies to protocol version 2 only. |
Note that this option applies to protocol version 2 only. |
|
.Pp |
|
See also |
|
.Sx VERIFYING HOST KEYS |
|
in |
|
.Xr ssh 1 . |
.It Cm XAuthLocation |
.It Cm XAuthLocation |
Specifies the full pathname of the |
Specifies the full pathname of the |
.Xr xauth 1 |
.Xr xauth 1 |
|
|
The default is |
The default is |
.Pa /usr/X11R6/bin/xauth . |
.Pa /usr/X11R6/bin/xauth . |
.El |
.El |
|
.Sh PATTERNS |
|
A |
|
.Em pattern |
|
consists of zero or more non-whitespace characters, |
|
.Sq * |
|
(a wildcard that matches zero or more characters), |
|
or |
|
.Sq ?\& |
|
(a wildcard that matches exactly one character). |
|
For example, to specify a set of declarations for any host in the |
|
.Dq .co.uk |
|
set of domains, |
|
the following pattern could be used: |
|
.Pp |
|
.Dl Host *.co.uk |
|
.Pp |
|
The following pattern |
|
would match any host in the 192.168.0.[0-9] network range: |
|
.Pp |
|
.Dl Host 192.168.0.? |
|
.Pp |
|
A |
|
.Em pattern-list |
|
is a comma-separated list of patterns. |
|
Patterns within pattern-lists may be negated |
|
by preceding them with an exclamation mark |
|
.Pq Sq !\& . |
|
For example, |
|
to allow a key to be used from anywhere within an organisation |
|
except from the |
|
.Dq dialup |
|
pool, |
|
the following entry (in authorized_keys) could be used: |
|
.Pp |
|
.Dl from=\&"!*.dialup.example.com,*.example.com\&" |
.Sh FILES |
.Sh FILES |
.Bl -tag -width Ds |
.Bl -tag -width Ds |
.It Pa ~/.ssh/config |
.It Pa ~/.ssh/config |
This is the per-user configuration file. |
This is the per-user configuration file. |
The format of this file is described above. |
The format of this file is described above. |
This file is used by the |
This file is used by the SSH client. |
.Nm ssh |
|
client. |
|
Because of the potential for abuse, this file must have strict permissions: |
Because of the potential for abuse, this file must have strict permissions: |
read/write for the user, and not accessible by others. |
read/write for the user, and not accessible by others. |
.It Pa /etc/ssh/ssh_config |
.It Pa /etc/ssh/ssh_config |