version 1.83, 2006/02/24 20:31:31 |
version 1.84, 2006/02/24 23:20:07 |
|
|
.It Pa /etc/ssh/ssh_config |
.It Pa /etc/ssh/ssh_config |
.El |
.El |
.Sh DESCRIPTION |
.Sh DESCRIPTION |
.Nm ssh |
.Xr ssh 1 |
obtains configuration data from the following sources in |
obtains configuration data from the following sources in |
the following order: |
the following order: |
.Pp |
.Pp |
|
|
Valid arguments are |
Valid arguments are |
.Dq any , |
.Dq any , |
.Dq inet |
.Dq inet |
(use IPv4 only) or |
(use IPv4 only), or |
.Dq inet6 |
.Dq inet6 |
(use IPv6 only). |
(use IPv6 only). |
.It Cm BatchMode |
.It Cm BatchMode |
|
|
.It Cm CheckHostIP |
.It Cm CheckHostIP |
If this flag is set to |
If this flag is set to |
.Dq yes , |
.Dq yes , |
ssh will additionally check the host IP address in the |
.Xr ssh 1 |
|
will additionally check the host IP address in the |
.Pa known_hosts |
.Pa known_hosts |
file. |
file. |
This allows ssh to detect if a host key changed due to DNS spoofing. |
This allows ssh to detect if a host key changed due to DNS spoofing. |
|
|
are supported. |
are supported. |
.Ar des |
.Ar des |
is only supported in the |
is only supported in the |
.Nm ssh |
.Xr ssh 1 |
client for interoperability with legacy protocol 1 implementations |
client for interoperability with legacy protocol 1 implementations |
that do not support the |
that do not support the |
.Ar 3des |
.Ar 3des |
|
|
.Dq blowfish-cbc , |
.Dq blowfish-cbc , |
and |
and |
.Dq cast128-cbc . |
.Dq cast128-cbc . |
The default is |
The default is: |
.Bd -literal |
.Bd -literal -offset 3n |
``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128, |
aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128, |
arcfour256,arcfour,aes192-cbc,aes256-cbc,aes128-ctr, |
arcfour256,arcfour,aes192-cbc,aes256-cbc,aes128-ctr, |
aes192-ctr,aes256-ctr'' |
aes192-ctr,aes256-ctr |
.Ed |
.Ed |
.It Cm ClearAllForwardings |
.It Cm ClearAllForwardings |
Specifies that all local, remote and dynamic port forwardings |
Specifies that all local, remote, and dynamic port forwardings |
specified in the configuration files or on the command line be |
specified in the configuration files or on the command line be |
cleared. |
cleared. |
This option is primarily useful when used from the |
This option is primarily useful when used from the |
.Nm ssh |
.Xr ssh 1 |
command line to clear port forwardings set in |
command line to clear port forwardings set in |
configuration files, and is automatically set by |
configuration files, and is automatically set by |
.Xr scp 1 |
.Xr scp 1 |
|
|
This may be useful in scripts if the connection sometimes fails. |
This may be useful in scripts if the connection sometimes fails. |
The default is 1. |
The default is 1. |
.It Cm ConnectTimeout |
.It Cm ConnectTimeout |
Specifies the timeout (in seconds) used when connecting to the ssh |
Specifies the timeout (in seconds) used when connecting to the |
server, instead of using the default system TCP timeout. |
SSH server, instead of using the default system TCP timeout. |
This value is used only when the target is down or really unreachable, |
This value is used only when the target is down or really unreachable, |
not when it refuses the connection. |
not when it refuses the connection. |
.It Cm ControlMaster |
.It Cm ControlMaster |
Enables the sharing of multiple sessions over a single network connection. |
Enables the sharing of multiple sessions over a single network connection. |
When set to |
When set to |
.Dq yes |
.Dq yes , |
.Nm ssh |
.Xr ssh 1 |
will listen for connections on a control socket specified using the |
will listen for connections on a control socket specified using the |
.Cm ControlPath |
.Cm ControlPath |
argument. |
argument. |
|
|
.Pp |
.Pp |
Setting this to |
Setting this to |
.Dq ask |
.Dq ask |
will cause |
will cause ssh |
.Nm ssh |
|
to listen for control connections, but require confirmation using the |
to listen for control connections, but require confirmation using the |
.Ev SSH_ASKPASS |
.Ev SSH_ASKPASS |
program before they are accepted (see |
program before they are accepted (see |
|
|
for details). |
for details). |
If the |
If the |
.Cm ControlPath |
.Cm ControlPath |
can not be opened, |
cannot be opened, |
.Nm ssh |
ssh will continue without connecting to a master instance. |
will continue without connecting to a master instance. |
|
.Pp |
.Pp |
X11 and |
X11 and |
.Xr ssh-agent 1 |
.Xr ssh-agent 1 |
|
|
.Ql %h |
.Ql %h |
will be substituted by the target host name, |
will be substituted by the target host name, |
.Ql %p |
.Ql %p |
the port and |
the port, and |
.Ql %r |
.Ql %r |
by the remote login username. |
by the remote login username. |
It is recommended that any |
It is recommended that any |
|
|
indicates that the port should be available from all interfaces. |
indicates that the port should be available from all interfaces. |
.Pp |
.Pp |
Currently the SOCKS4 and SOCKS5 protocols are supported, and |
Currently the SOCKS4 and SOCKS5 protocols are supported, and |
.Nm ssh |
.Xr ssh 1 |
will act as a SOCKS server. |
will act as a SOCKS server. |
Multiple forwardings may be specified, and |
Multiple forwardings may be specified, and |
additional forwardings can be given on the command line. |
additional forwardings can be given on the command line. |
|
|
option is also enabled. |
option is also enabled. |
.It Cm ForwardX11Trusted |
.It Cm ForwardX11Trusted |
If this option is set to |
If this option is set to |
.Dq yes |
.Dq yes , |
then remote X11 clients will have full access to the original X11 display. |
remote X11 clients will have full access to the original X11 display. |
.Pp |
.Pp |
If this option is set to |
If this option is set to |
.Dq no |
.Dq no , |
then remote X11 clients will be considered untrusted and prevented |
remote X11 clients will be considered untrusted and prevented |
from stealing or tampering with data belonging to trusted X11 |
from stealing or tampering with data belonging to trusted X11 |
clients. |
clients. |
Furthermore, the |
Furthermore, the |
|
|
Specifies whether remote hosts are allowed to connect to local |
Specifies whether remote hosts are allowed to connect to local |
forwarded ports. |
forwarded ports. |
By default, |
By default, |
.Nm ssh |
.Xr ssh 1 |
binds local port forwardings to the loopback address. |
binds local port forwardings to the loopback address. |
This prevents other remote hosts from connecting to forwarded ports. |
This prevents other remote hosts from connecting to forwarded ports. |
.Cm GatewayPorts |
.Cm GatewayPorts |
can be used to specify that |
can be used to specify that ssh |
.Nm ssh |
|
should bind local port forwardings to the wildcard address, |
should bind local port forwardings to the wildcard address, |
thus allowing remote hosts to connect to forwarded ports. |
thus allowing remote hosts to connect to forwarded ports. |
The argument must be |
The argument must be |
|
|
Note that this option applies to protocol version 2 only. |
Note that this option applies to protocol version 2 only. |
.It Cm HashKnownHosts |
.It Cm HashKnownHosts |
Indicates that |
Indicates that |
.Nm ssh |
.Xr ssh 1 |
should hash host names and addresses when they are added to |
should hash host names and addresses when they are added to |
.Pa ~/.ssh/known_hosts . |
.Pa ~/.ssh/known_hosts . |
These hashed names may be used normally by |
These hashed names may be used normally by |
.Nm ssh |
.Xr ssh 1 |
and |
and |
.Nm sshd , |
.Xr sshd 8 , |
but they do not reveal identifying information should the file's contents |
but they do not reveal identifying information should the file's contents |
be disclosed. |
be disclosed. |
The default is |
The default is |
|
|
Specifies an alias that should be used instead of the |
Specifies an alias that should be used instead of the |
real host name when looking up or saving the host key |
real host name when looking up or saving the host key |
in the host key database files. |
in the host key database files. |
This option is useful for tunneling ssh connections |
This option is useful for tunneling SSH connections |
or for multiple servers running on a single host. |
or for multiple servers running on a single host. |
.It Cm HostName |
.It Cm HostName |
Specifies the real host name to log into. |
Specifies the real host name to log into. |
This can be used to specify nicknames or abbreviations for hosts. |
This can be used to specify nicknames or abbreviations for hosts. |
Default is the name given on the command line. |
The default is the name given on the command line. |
Numeric IP addresses are also permitted (both on the command line and in |
Numeric IP addresses are also permitted (both on the command line and in |
.Cm HostName |
.Cm HostName |
specifications). |
specifications). |
.It Cm IdentitiesOnly |
.It Cm IdentitiesOnly |
Specifies that |
Specifies that |
.Nm ssh |
.Xr ssh 1 |
should only use the authentication identity files configured in the |
should only use the authentication identity files configured in the |
.Nm |
.Nm |
files, |
files, |
even if the |
even if |
.Nm ssh-agent |
.Xr ssh-agent 1 |
offers more identities. |
offers more identities. |
The argument to this keyword must be |
The argument to this keyword must be |
.Dq yes |
.Dq yes |
or |
or |
.Dq no . |
.Dq no . |
This option is intended for situations where |
This option is intended for situations where ssh-agent |
.Nm ssh-agent |
|
offers many different identities. |
offers many different identities. |
The default is |
The default is |
.Dq no . |
.Dq no . |
|
|
indicates that the port should be available from all interfaces. |
indicates that the port should be available from all interfaces. |
.It Cm LogLevel |
.It Cm LogLevel |
Gives the verbosity level that is used when logging messages from |
Gives the verbosity level that is used when logging messages from |
.Nm ssh . |
.Xr ssh 1 . |
The possible values are: |
The possible values are: |
QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3. |
QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. |
The default is INFO. |
The default is INFO. |
DEBUG and DEBUG1 are equivalent. |
DEBUG and DEBUG1 are equivalent. |
DEBUG2 and DEBUG3 each specify higher levels of verbose output. |
DEBUG2 and DEBUG3 each specify higher levels of verbose output. |
|
|
The MAC algorithm is used in protocol version 2 |
The MAC algorithm is used in protocol version 2 |
for data integrity protection. |
for data integrity protection. |
Multiple algorithms must be comma-separated. |
Multiple algorithms must be comma-separated. |
The default is |
The default is: |
.Dq hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96 . |
.Dq hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96 . |
.It Cm NoHostAuthenticationForLocalhost |
.It Cm NoHostAuthenticationForLocalhost |
This option can be used if the home directory is shared across machines. |
This option can be used if the home directory is shared across machines. |
|
|
.It Cm NumberOfPasswordPrompts |
.It Cm NumberOfPasswordPrompts |
Specifies the number of password prompts before giving up. |
Specifies the number of password prompts before giving up. |
The argument to this keyword must be an integer. |
The argument to this keyword must be an integer. |
Default is 3. |
The default is 3. |
.It Cm PasswordAuthentication |
.It Cm PasswordAuthentication |
Specifies whether to use password authentication. |
Specifies whether to use password authentication. |
The argument to this keyword must be |
The argument to this keyword must be |
|
|
.Dq no . |
.Dq no . |
.It Cm Port |
.It Cm Port |
Specifies the port number to connect on the remote host. |
Specifies the port number to connect on the remote host. |
Default is 22. |
The default is 22. |
.It Cm PreferredAuthentications |
.It Cm PreferredAuthentications |
Specifies the order in which the client should try protocol 2 |
Specifies the order in which the client should try protocol 2 |
authentication methods. |
authentication methods. |
|
|
.Dq hostbased,publickey,keyboard-interactive,password . |
.Dq hostbased,publickey,keyboard-interactive,password . |
.It Cm Protocol |
.It Cm Protocol |
Specifies the protocol versions |
Specifies the protocol versions |
.Nm ssh |
.Xr ssh 1 |
should support in order of preference. |
should support in order of preference. |
The possible values are |
The possible values are |
.Dq 1 |
.Sq 1 |
and |
and |
.Dq 2 . |
.Sq 2 . |
Multiple versions must be comma-separated. |
Multiple versions must be comma-separated. |
The default is |
The default is |
.Dq 2,1 . |
.Dq 2,1 . |
This means that |
This means that ssh |
.Nm ssh |
|
tries version 2 and falls back to version 1 |
tries version 2 and falls back to version 1 |
if version 2 is not available. |
if version 2 is not available. |
.It Cm ProxyCommand |
.It Cm ProxyCommand |
|
|
.Sq G |
.Sq G |
to indicate Kilobytes, Megabytes, or Gigabytes, respectively. |
to indicate Kilobytes, Megabytes, or Gigabytes, respectively. |
The default is between |
The default is between |
.Dq 1G |
.Sq 1G |
and |
and |
.Dq 4G , |
.Sq 4G , |
depending on the cipher. |
depending on the cipher. |
This option applies to protocol version 2 only. |
This option applies to protocol version 2 only. |
.It Cm RemoteForward |
.It Cm RemoteForward |
|
|
The default is |
The default is |
.Dq no . |
.Dq no . |
This option applies to protocol version 1 only and requires |
This option applies to protocol version 1 only and requires |
.Nm ssh |
.Xr ssh 1 |
to be setuid root. |
to be setuid root. |
.It Cm RSAAuthentication |
.It Cm RSAAuthentication |
Specifies whether to try RSA authentication. |
Specifies whether to try RSA authentication. |
|
|
Specifies what variables from the local |
Specifies what variables from the local |
.Xr environ 7 |
.Xr environ 7 |
should be sent to the server. |
should be sent to the server. |
Note that environment passing is only supported for protocol 2, the |
Note that environment passing is only supported for protocol 2. |
server must also support it, and the server must be configured to |
The server must also support it, and the server must be configured to |
accept these environment variables. |
accept these environment variables. |
Refer to |
Refer to |
.Cm AcceptEnv |
.Cm AcceptEnv |
|
|
.It Cm ServerAliveCountMax |
.It Cm ServerAliveCountMax |
Sets the number of server alive messages (see below) which may be |
Sets the number of server alive messages (see below) which may be |
sent without |
sent without |
.Nm ssh |
.Xr ssh 1 |
receiving any messages back from the server. |
receiving any messages back from the server. |
If this threshold is reached while server alive messages are being sent, |
If this threshold is reached while server alive messages are being sent, |
.Nm ssh |
ssh will disconnect from the server, terminating the session. |
will disconnect from the server, terminating the session. |
|
It is important to note that the use of server alive messages is very |
It is important to note that the use of server alive messages is very |
different from |
different from |
.Cm TCPKeepAlive |
.Cm TCPKeepAlive |
|
|
The default value is 3. |
The default value is 3. |
If, for example, |
If, for example, |
.Cm ServerAliveInterval |
.Cm ServerAliveInterval |
(see below) is set to 15, and |
(see below) is set to 15 and |
.Cm ServerAliveCountMax |
.Cm ServerAliveCountMax |
is left at the default, if the server becomes unresponsive ssh |
is left at the default, if the server becomes unresponsive, |
will disconnect after approximately 45 seconds. |
ssh will disconnect after approximately 45 seconds. |
.It Cm ServerAliveInterval |
.It Cm ServerAliveInterval |
Sets a timeout interval in seconds after which if no data has been received |
Sets a timeout interval in seconds after which if no data has been received |
from the server, |
from the server, |
.Nm ssh |
.Xr ssh 1 |
will send a message through the encrypted |
will send a message through the encrypted |
channel to request a response from the server. |
channel to request a response from the server. |
The default |
The default |
|
|
.It Cm SmartcardDevice |
.It Cm SmartcardDevice |
Specifies which smartcard device to use. |
Specifies which smartcard device to use. |
The argument to this keyword is the device |
The argument to this keyword is the device |
.Nm ssh |
.Xr ssh 1 |
should use to communicate with a smartcard used for storing the user's |
should use to communicate with a smartcard used for storing the user's |
private RSA key. |
private RSA key. |
By default, no device is specified and smartcard support is not activated. |
By default, no device is specified and smartcard support is not activated. |
.It Cm StrictHostKeyChecking |
.It Cm StrictHostKeyChecking |
If this flag is set to |
If this flag is set to |
.Dq yes , |
.Dq yes , |
.Nm ssh |
.Xr ssh 1 |
will never automatically add host keys to the |
will never automatically add host keys to the |
.Pa ~/.ssh/known_hosts |
.Pa ~/.ssh/known_hosts |
file, and refuses to connect to hosts whose host key has changed. |
file, and refuses to connect to hosts whose host key has changed. |
This provides maximum protection against trojan horse attacks, |
This provides maximum protection against trojan horse attacks, |
however, can be annoying when the |
though it can be annoying when the |
.Pa /etc/ssh/ssh_known_hosts |
.Pa /etc/ssh/ssh_known_hosts |
file is poorly maintained, or connections to new hosts are |
file is poorly maintained or when connections to new hosts are |
frequently made. |
frequently made. |
This option forces the user to manually |
This option forces the user to manually |
add all new hosts. |
add all new hosts. |
If this flag is set to |
If this flag is set to |
.Dq no , |
.Dq no , |
.Nm ssh |
ssh will automatically add new host keys to the |
will automatically add new host keys to the |
|
user known hosts files. |
user known hosts files. |
If this flag is set to |
If this flag is set to |
.Dq ask , |
.Dq ask , |
new host keys |
new host keys |
will be added to the user known host files only after the user |
will be added to the user known host files only after the user |
has confirmed that is what they really want to do, and |
has confirmed that is what they really want to do, and |
.Nm ssh |
ssh will refuse to connect to hosts whose host key has changed. |
will refuse to connect to hosts whose host key has changed. |
|
The host keys of |
The host keys of |
known hosts will be verified automatically in all cases. |
known hosts will be verified automatically in all cases. |
The argument must be |
The argument must be |
.Dq yes , |
.Dq yes , |
.Dq no |
.Dq no , |
or |
or |
.Dq ask . |
.Dq ask . |
The default is |
The default is |
|
|
The argument must be |
The argument must be |
.Dq yes , |
.Dq yes , |
.Dq point-to-point , |
.Dq point-to-point , |
.Dq ethernet |
.Dq ethernet , |
or |
or |
.Dq no . |
.Dq no . |
The default is |
The default is |
|
|
The default is |
The default is |
.Dq no . |
.Dq no . |
If set to |
If set to |
.Dq yes |
.Dq yes , |
.Nm ssh |
.Xr ssh 1 |
must be setuid root. |
must be setuid root. |
Note that this option must be set to |
Note that this option must be set to |
.Dq yes |
.Dq yes |
|
|
option. |
option. |
The argument must be |
The argument must be |
.Dq yes , |
.Dq yes , |
.Dq no |
.Dq no , |
or |
or |
.Dq ask . |
.Dq ask . |
The default is |
The default is |
.Dq no . |
.Dq no . |
Note that this option applies to protocol version 2 only. |
Note that this option applies to protocol version 2 only. |
|
.Pp |
|
See also |
|
.Sx VERIFYING HOST KEYS |
|
in |
|
.Xr ssh 1 . |
.It Cm XAuthLocation |
.It Cm XAuthLocation |
Specifies the full pathname of the |
Specifies the full pathname of the |
.Xr xauth 1 |
.Xr xauth 1 |
|
|
.It Pa ~/.ssh/config |
.It Pa ~/.ssh/config |
This is the per-user configuration file. |
This is the per-user configuration file. |
The format of this file is described above. |
The format of this file is described above. |
This file is used by the |
This file is used by the SSH client. |
.Nm ssh |
|
client. |
|
Because of the potential for abuse, this file must have strict permissions: |
Because of the potential for abuse, this file must have strict permissions: |
read/write for the user, and not accessible by others. |
read/write for the user, and not accessible by others. |
.It Pa /etc/ssh/ssh_config |
.It Pa /etc/ssh/ssh_config |