Annotation of src/usr.bin/ssh/ssh_config.5, Revision 1.391
1.1 stevesk 1: .\"
2: .\" Author: Tatu Ylonen <ylo@cs.hut.fi>
3: .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
4: .\" All rights reserved
5: .\"
6: .\" As far as I am concerned, the code I have written for this software
7: .\" can be used freely for any purpose. Any derived versions of this
8: .\" software must be clearly marked as such, and if the derived work is
9: .\" incompatible with the protocol description in the RFC file, it must be
10: .\" called by a name other than "ssh" or "Secure Shell".
11: .\"
12: .\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved.
13: .\" Copyright (c) 1999 Aaron Campbell. All rights reserved.
14: .\" Copyright (c) 1999 Theo de Raadt. All rights reserved.
15: .\"
16: .\" Redistribution and use in source and binary forms, with or without
17: .\" modification, are permitted provided that the following conditions
18: .\" are met:
19: .\" 1. Redistributions of source code must retain the above copyright
20: .\" notice, this list of conditions and the following disclaimer.
21: .\" 2. Redistributions in binary form must reproduce the above copyright
22: .\" notice, this list of conditions and the following disclaimer in the
23: .\" documentation and/or other materials provided with the distribution.
24: .\"
25: .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
26: .\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
27: .\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
28: .\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
29: .\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
30: .\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
31: .\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
32: .\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
33: .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
34: .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
35: .\"
1.391 ! djm 36: .\" $OpenBSD: ssh_config.5,v 1.390 2023/10/11 22:42:26 djm Exp $
1.390 djm 37: .Dd $Mdocdate: October 11 2023 $
1.1 stevesk 38: .Dt SSH_CONFIG 5
39: .Os
40: .Sh NAME
41: .Nm ssh_config
1.310 jmc 42: .Nd OpenSSH client configuration file
1.1 stevesk 43: .Sh DESCRIPTION
1.84 jmc 44: .Xr ssh 1
1.1 stevesk 45: obtains configuration data from the following sources in
46: the following order:
1.79 jmc 47: .Pp
1.2 stevesk 48: .Bl -enum -offset indent -compact
49: .It
50: command-line options
51: .It
52: user's configuration file
1.50 djm 53: .Pq Pa ~/.ssh/config
1.2 stevesk 54: .It
55: system-wide configuration file
56: .Pq Pa /etc/ssh/ssh_config
57: .El
1.1 stevesk 58: .Pp
1.379 djm 59: Unless noted otherwise, for each parameter, the first obtained value
1.1 stevesk 60: will be used.
1.41 jmc 61: The configuration files contain sections separated by
1.240 jmc 62: .Cm Host
1.1 stevesk 63: specifications, and that section is only applied for hosts that
64: match one of the patterns given in the specification.
1.193 djm 65: The matched host name is usually the one given on the command line
66: (see the
67: .Cm CanonicalizeHostname
1.240 jmc 68: option for exceptions).
1.1 stevesk 69: .Pp
70: Since the first obtained value for each parameter is used, more
71: host-specific declarations should be given near the beginning of the
72: file, and general defaults at the end.
1.80 jmc 73: .Pp
1.240 jmc 74: The file contains keyword-argument pairs, one per line.
75: Lines starting with
1.1 stevesk 76: .Ql #
1.240 jmc 77: and empty lines are interpreted as comments.
78: Arguments may optionally be enclosed in double quotes
79: .Pq \&"
80: in order to represent arguments containing spaces.
1.1 stevesk 81: Configuration options may be separated by whitespace or
82: optional whitespace and exactly one
83: .Ql = ;
84: the latter format is useful to avoid the need to quote whitespace
85: when specifying configuration options using the
86: .Nm ssh ,
1.87 jmc 87: .Nm scp ,
1.1 stevesk 88: and
89: .Nm sftp
90: .Fl o
91: option.
92: .Pp
93: The possible
94: keywords and their meanings are as follows (note that
95: keywords are case-insensitive and arguments are case-sensitive):
96: .Bl -tag -width Ds
97: .It Cm Host
98: Restricts the following declarations (up to the next
99: .Cm Host
1.169 djm 100: or
101: .Cm Match
1.1 stevesk 102: keyword) to be only for those hosts that match one of the patterns
103: given after the keyword.
1.112 krw 104: If more than one pattern is provided, they should be separated by whitespace.
1.1 stevesk 105: A single
1.83 jmc 106: .Ql *
1.1 stevesk 107: as a pattern can be used to provide global
108: defaults for all hosts.
1.193 djm 109: The host is usually the
1.1 stevesk 110: .Ar hostname
1.193 djm 111: argument given on the command line
112: (see the
113: .Cm CanonicalizeHostname
1.240 jmc 114: keyword for exceptions).
1.148 djm 115: .Pp
116: A pattern entry may be negated by prefixing it with an exclamation mark
117: .Pq Sq !\& .
118: If a negated entry is matched, then the
119: .Cm Host
120: entry is ignored, regardless of whether any other patterns on the line
121: match.
122: Negated matches are therefore useful to provide exceptions for wildcard
123: matches.
1.81 jmc 124: .Pp
125: See
126: .Sx PATTERNS
127: for more information on patterns.
1.170 jmc 128: .It Cm Match
1.169 djm 129: Restricts the following declarations (up to the next
130: .Cm Host
131: or
132: .Cm Match
133: keyword) to be used only when the conditions following the
134: .Cm Match
135: keyword are satisfied.
1.220 sobrado 136: Match conditions are specified using one or more criteria
1.178 dtucker 137: or the single token
138: .Cm all
1.193 djm 139: which always matches.
140: The available criteria keywords are:
141: .Cm canonical ,
1.287 djm 142: .Cm final ,
1.176 djm 143: .Cm exec ,
1.381 djm 144: .Cm localnetwork ,
1.169 djm 145: .Cm host ,
146: .Cm originalhost ,
1.382 djm 147: .Cm Tag ,
1.169 djm 148: .Cm user ,
149: and
150: .Cm localuser .
1.193 djm 151: The
152: .Cm all
153: criteria must appear alone or immediately after
1.287 djm 154: .Cm canonical
155: or
156: .Cm final .
1.193 djm 157: Other criteria may be combined arbitrarily.
158: All criteria but
1.288 jmc 159: .Cm all ,
160: .Cm canonical ,
1.193 djm 161: and
1.287 djm 162: .Cm final
1.193 djm 163: require an argument.
164: Criteria may be negated by prepending an exclamation mark
165: .Pq Sq !\& .
1.169 djm 166: .Pp
1.177 jmc 167: The
1.193 djm 168: .Cm canonical
1.210 dtucker 169: keyword matches only when the configuration file is being re-parsed
1.193 djm 170: after hostname canonicalization (see the
171: .Cm CanonicalizeHostname
1.288 jmc 172: option).
1.193 djm 173: This may be useful to specify conditions that work with canonical host
174: names only.
1.287 djm 175: .Pp
176: The
177: .Cm final
178: keyword requests that the configuration be re-parsed (regardless of whether
179: .Cm CanonicalizeHostname
180: is enabled), and matches only during this final pass.
181: If
182: .Cm CanonicalizeHostname
183: is enabled, then
184: .Cm canonical
185: and
186: .Cm final
187: match during the same pass.
188: .Pp
1.193 djm 189: The
1.176 djm 190: .Cm exec
1.177 jmc 191: keyword executes the specified command under the user's shell.
1.169 djm 192: If the command returns a zero exit status then the condition is considered true.
193: Commands containing whitespace characters must be quoted.
1.239 jmc 194: Arguments to
195: .Cm exec
196: accept the tokens described in the
197: .Sx TOKENS
198: section.
1.381 djm 199: .Pp
200: The
201: .Cm localnetwork
202: keyword matches the addresses of active local network interfaces against the
203: supplied list of networks in CIDR format.
204: This may be convenient for varying the effective configuration on devices that
205: roam between networks.
206: Note that network address is not a trustworthy criteria in many
207: situations (e.g. when the network is automatically configured using DHCP)
208: and so caution should be applied if using it to control security-sensitive
209: configuration.
1.169 djm 210: .Pp
211: The other keywords' criteria must be single entries or comma-separated
212: lists and may use the wildcard and negation operators described in the
213: .Sx PATTERNS
214: section.
215: The criteria for the
216: .Cm host
217: keyword are matched against the target hostname, after any substitution
218: by the
1.295 jmc 219: .Cm Hostname
1.193 djm 220: or
221: .Cm CanonicalizeHostname
222: options.
1.169 djm 223: The
224: .Cm originalhost
225: keyword matches against the hostname as it was specified on the command-line.
226: The
1.382 djm 227: .Cm tagged
228: keyword matches a tag name specified by a prior
229: .Cm Tag
230: directive or on the
231: .Xr ssh 1
232: command-line using the
233: .Fl P
234: flag.
235: The
1.169 djm 236: .Cm user
237: keyword matches against the target username on the remote host.
238: The
239: .Cm localuser
240: keyword matches against the name of the local user running
241: .Xr ssh 1
242: (this keyword may be useful in system-wide
243: .Nm
244: files).
1.222 jcs 245: .It Cm AddKeysToAgent
246: Specifies whether keys should be automatically added to a running
1.223 jmc 247: .Xr ssh-agent 1 .
1.222 jcs 248: If this option is set to
1.240 jmc 249: .Cm yes
1.222 jcs 250: and a key is loaded from a file, the key and its passphrase are added to
251: the agent with the default lifetime, as if by
252: .Xr ssh-add 1 .
253: If this option is set to
1.240 jmc 254: .Cm ask ,
255: .Xr ssh 1
1.222 jcs 256: will require confirmation using the
257: .Ev SSH_ASKPASS
258: program before adding a key (see
259: .Xr ssh-add 1
260: for details).
261: If this option is set to
1.240 jmc 262: .Cm confirm ,
1.222 jcs 263: each use of the key must be confirmed, as if the
264: .Fl c
265: option was specified to
266: .Xr ssh-add 1 .
267: If this option is set to
1.240 jmc 268: .Cm no ,
1.222 jcs 269: no keys are added to the agent.
1.332 djm 270: Alternately, this option may be specified as a time interval
271: using the format described in the
272: .Sx TIME FORMATS
273: section of
274: .Xr sshd_config 5
275: to specify the key's lifetime in
276: .Xr ssh-agent 1 ,
277: after which it will automatically be removed.
1.222 jcs 278: The argument must be
1.332 djm 279: .Cm no
280: (the default),
1.240 jmc 281: .Cm yes ,
1.332 djm 282: .Cm confirm
283: (optionally followed by a time interval),
284: .Cm ask
285: or a time interval.
1.10 djm 286: .It Cm AddressFamily
1.11 jmc 287: Specifies which address family to use when connecting.
288: Valid arguments are
1.240 jmc 289: .Cm any
290: (the default),
291: .Cm inet
1.84 jmc 292: (use IPv4 only), or
1.240 jmc 293: .Cm inet6
1.40 jmc 294: (use IPv6 only).
1.1 stevesk 295: .It Cm BatchMode
296: If set to
1.240 jmc 297: .Cm yes ,
1.318 djm 298: user interaction such as password prompts and host key confirmation requests
299: will be disabled.
1.1 stevesk 300: This option is useful in scripts and other batch jobs where no user
1.318 djm 301: is present to interact with
302: .Xr ssh 1 .
1.1 stevesk 303: The argument must be
1.240 jmc 304: .Cm yes
1.1 stevesk 305: or
1.240 jmc 306: .Cm no
307: (the default).
1.268 jmc 308: .It Cm BindAddress
309: Use the specified address on the local machine as the source address of
310: the connection.
311: Only useful on systems with more than one address.
312: .It Cm BindInterface
313: Use the address of the specified interface on the local machine as the
314: source address of the connection.
1.171 djm 315: .It Cm CanonicalDomains
1.172 jmc 316: When
1.173 djm 317: .Cm CanonicalizeHostname
1.171 djm 318: is enabled, this option specifies the list of domain suffixes in which to
319: search for the specified destination host.
1.173 djm 320: .It Cm CanonicalizeFallbackLocal
1.174 djm 321: Specifies whether to fail with an error when hostname canonicalization fails.
1.172 jmc 322: The default,
1.240 jmc 323: .Cm yes ,
1.172 jmc 324: will attempt to look up the unqualified hostname using the system resolver's
1.171 djm 325: search rules.
326: A value of
1.240 jmc 327: .Cm no
1.171 djm 328: will cause
329: .Xr ssh 1
330: to fail instantly if
1.173 djm 331: .Cm CanonicalizeHostname
1.171 djm 332: is enabled and the target hostname cannot be found in any of the domains
333: specified by
334: .Cm CanonicalDomains .
1.173 djm 335: .It Cm CanonicalizeHostname
1.174 djm 336: Controls whether explicit hostname canonicalization is performed.
1.172 jmc 337: The default,
1.240 jmc 338: .Cm no ,
1.171 djm 339: is not to perform any name rewriting and let the system resolver handle all
340: hostname lookups.
341: If set to
1.240 jmc 342: .Cm yes
1.171 djm 343: then, for connections that do not use a
1.284 djm 344: .Cm ProxyCommand
345: or
346: .Cm ProxyJump ,
1.171 djm 347: .Xr ssh 1
1.173 djm 348: will attempt to canonicalize the hostname specified on the command line
1.171 djm 349: using the
350: .Cm CanonicalDomains
351: suffixes and
1.173 djm 352: .Cm CanonicalizePermittedCNAMEs
1.171 djm 353: rules.
354: If
1.173 djm 355: .Cm CanonicalizeHostname
1.171 djm 356: is set to
1.240 jmc 357: .Cm always ,
1.174 djm 358: then canonicalization is applied to proxied connections too.
1.185 djm 359: .Pp
1.193 djm 360: If this option is enabled, then the configuration files are processed
361: again using the new target name to pick up any new configuration in matching
1.185 djm 362: .Cm Host
1.193 djm 363: and
364: .Cm Match
1.185 djm 365: stanzas.
1.361 dtucker 366: A value of
367: .Cm none
368: disables the use of a
369: .Cm ProxyJump
370: host.
1.173 djm 371: .It Cm CanonicalizeMaxDots
1.172 jmc 372: Specifies the maximum number of dot characters in a hostname before
1.174 djm 373: canonicalization is disabled.
1.240 jmc 374: The default, 1,
1.172 jmc 375: allows a single dot (i.e. hostname.subdomain).
1.173 djm 376: .It Cm CanonicalizePermittedCNAMEs
1.172 jmc 377: Specifies rules to determine whether CNAMEs should be followed when
1.173 djm 378: canonicalizing hostnames.
1.171 djm 379: The rules consist of one or more arguments of
1.172 jmc 380: .Ar source_domain_list : Ns Ar target_domain_list ,
1.171 djm 381: where
382: .Ar source_domain_list
1.174 djm 383: is a pattern-list of domains that may follow CNAMEs in canonicalization,
1.171 djm 384: and
385: .Ar target_domain_list
1.172 jmc 386: is a pattern-list of domains that they may resolve to.
1.171 djm 387: .Pp
388: For example,
1.240 jmc 389: .Qq *.a.example.com:*.b.example.com,*.c.example.com
1.171 djm 390: will allow hostnames matching
1.240 jmc 391: .Qq *.a.example.com
1.173 djm 392: to be canonicalized to names in the
1.240 jmc 393: .Qq *.b.example.com
1.171 djm 394: or
1.240 jmc 395: .Qq *.c.example.com
1.171 djm 396: domains.
1.365 djm 397: .Pp
398: A single argument of
399: .Qq none
400: causes no CNAMEs to be considered for canonicalization.
401: This is the default behaviour.
1.283 jmc 402: .It Cm CASignatureAlgorithms
403: Specifies which algorithms are allowed for signing of certificates
404: by certificate authorities (CAs).
405: The default is:
406: .Bd -literal -offset indent
1.362 djm 407: ssh-ed25519,ecdsa-sha2-nistp256,
408: ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
409: sk-ssh-ed25519@openssh.com,
410: sk-ecdsa-sha2-nistp256@openssh.com,
1.351 djm 411: rsa-sha2-512,rsa-sha2-256
1.283 jmc 412: .Ed
1.362 djm 413: .Pp
414: If the specified list begins with a
415: .Sq +
416: character, then the specified algorithms will be appended to the default set
417: instead of replacing them.
418: If the specified list begins with a
419: .Sq -
420: character, then the specified algorithms (including wildcards) will be removed
421: from the default set instead of replacing them.
1.283 jmc 422: .Pp
423: .Xr ssh 1
424: will not accept host certificates signed using algorithms other than those
425: specified.
1.221 djm 426: .It Cm CertificateFile
427: Specifies a file from which the user's certificate is read.
428: A corresponding private key must be provided separately in order
429: to use this certificate either
430: from an
431: .Cm IdentityFile
432: directive or
433: .Fl i
434: flag to
435: .Xr ssh 1 ,
436: via
437: .Xr ssh-agent 1 ,
438: or via a
1.305 naddy 439: .Cm PKCS11Provider
440: or
441: .Cm SecurityKeyProvider .
1.221 djm 442: .Pp
1.239 jmc 443: Arguments to
444: .Cm CertificateFile
1.326 dtucker 445: may use the tilde syntax to refer to a user's home directory,
446: the tokens described in the
1.239 jmc 447: .Sx TOKENS
1.326 dtucker 448: section and environment variables as described in the
449: .Sx ENVIRONMENT VARIABLES
1.239 jmc 450: section.
1.221 djm 451: .Pp
452: It is possible to have multiple certificate files specified in
453: configuration files; these certificates will be tried in sequence.
454: Multiple
455: .Cm CertificateFile
456: directives will add to the list of certificates used for
457: authentication.
1.390 djm 458: .It Cm ChannelTimeout
459: Specifies whether and how quickly
460: .Xr ssh 1
461: should close inactive channels.
462: Timeouts are specified as one or more
463: .Dq type=interval
464: pairs separated by whitespace, where the
465: .Dq type
466: must be a channel type name (as described in the table below), optionally
467: containing wildcard characters.
468: .Pp
469: The timeout value
470: .Dq interval
471: is specified in seconds or may use any of the units documented in the
472: .Sx TIME FORMATS
473: section.
474: For example,
475: .Dq session=5m
476: would cause the interactive session to terminate after five minutes of
477: inactivity.
478: Specifying a zero value disables the inactivity timeout.
479: .Pp
480: The available channel types include:
481: .Bl -tag -width Ds
482: .It Cm agent-connection
483: Open connections to
484: .Xr ssh-agent 1 .
485: .It Cm direct-tcpip , Cm direct-streamlocal@openssh.com
486: Open TCP or Unix socket (respectively) connections that have
487: been established from a
488: .Xr ssh 1
489: local forwarding, i.e.\&
490: .Cm LocalForward
491: or
492: .Cm DynamicForward .
493: .It Cm forwarded-tcpip , Cm forwarded-streamlocal@openssh.com
494: Open TCP or Unix socket (respectively) connections that have been
495: established to a
496: .Xr sshd 8
497: listening on behalf of a
498: .Xr ssh 1
499: remote forwarding, i.e.\&
500: .Cm RemoteForward .
501: .It Cm session
502: The interactive main session, including shell session, command execution,
503: .Xr scp 1 ,
504: .Xr sftp 1 ,
505: etc.
506: .It Cm tun-connection
507: Open
508: .Cm TunnelForward
509: connections.
510: .It Cm x11-connection
511: Open X11 forwarding sessions.
512: .El
513: .Pp
514: Note that in all the above cases, terminating an inactive session does not
515: guarantee to remove all resources associated with the session, e.g. shell
516: processes or X11 clients relating to the session may continue to execute.
517: .Pp
518: Moreover, terminating an inactive channel or session does not necessarily
519: close the SSH connection, nor does it prevent a client from
520: requesting another channel of the same type.
521: In particular, expiring an inactive forwarding session does not prevent
522: another identical forwarding from being subsequently created.
523: .Pp
524: The default is not to expire channels of any type for inactivity.
1.1 stevesk 525: .It Cm CheckHostIP
1.240 jmc 526: If set to
1.370 naddy 527: .Cm yes ,
1.84 jmc 528: .Xr ssh 1
529: will additionally check the host IP address in the
1.1 stevesk 530: .Pa known_hosts
531: file.
1.240 jmc 532: This allows it to detect if a host key changed due to DNS spoofing
1.211 djm 533: and will add addresses of destination hosts to
534: .Pa ~/.ssh/known_hosts
535: in the process, regardless of the setting of
536: .Cm StrictHostKeyChecking .
1.107 grunk 537: If the option is set to
1.341 djm 538: .Cm no
539: (the default),
1.1 stevesk 540: the check will not be executed.
541: .It Cm Ciphers
1.245 djm 542: Specifies the ciphers allowed and their order of preference.
1.1 stevesk 543: Multiple ciphers must be comma-separated.
1.299 kn 544: If the specified list begins with a
1.214 djm 545: .Sq +
546: character, then the specified ciphers will be appended to the default set
547: instead of replacing them.
1.299 kn 548: If the specified list begins with a
1.241 djm 549: .Sq -
550: character, then the specified ciphers (including wildcards) will be removed
551: from the default set instead of replacing them.
1.301 naddy 552: If the specified list begins with a
553: .Sq ^
554: character, then the specified ciphers will be placed at the head of the
555: default set.
1.214 djm 556: .Pp
1.180 djm 557: The supported ciphers are:
1.240 jmc 558: .Bd -literal -offset indent
1.186 naddy 559: 3des-cbc
560: aes128-cbc
561: aes192-cbc
562: aes256-cbc
563: aes128-ctr
564: aes192-ctr
565: aes256-ctr
566: aes128-gcm@openssh.com
567: aes256-gcm@openssh.com
568: chacha20-poly1305@openssh.com
1.240 jmc 569: .Ed
1.180 djm 570: .Pp
1.84 jmc 571: The default is:
1.186 naddy 572: .Bd -literal -offset indent
1.215 jmc 573: chacha20-poly1305@openssh.com,
1.186 naddy 574: aes128-ctr,aes192-ctr,aes256-ctr,
1.270 djm 575: aes128-gcm@openssh.com,aes256-gcm@openssh.com
1.1 stevesk 576: .Ed
1.180 djm 577: .Pp
1.240 jmc 578: The list of available ciphers may also be obtained using
579: .Qq ssh -Q cipher .
1.1 stevesk 580: .It Cm ClearAllForwardings
1.84 jmc 581: Specifies that all local, remote, and dynamic port forwardings
1.1 stevesk 582: specified in the configuration files or on the command line be
1.7 jmc 583: cleared.
584: This option is primarily useful when used from the
1.84 jmc 585: .Xr ssh 1
1.1 stevesk 586: command line to clear port forwardings set in
587: configuration files, and is automatically set by
588: .Xr scp 1
589: and
590: .Xr sftp 1 .
591: The argument must be
1.240 jmc 592: .Cm yes
1.1 stevesk 593: or
1.240 jmc 594: .Cm no
595: (the default).
1.1 stevesk 596: .It Cm Compression
597: Specifies whether to use compression.
598: The argument must be
1.240 jmc 599: .Cm yes
1.1 stevesk 600: or
1.240 jmc 601: .Cm no
602: (the default).
1.247 naddy 603: .It Cm ConnectionAttempts
604: Specifies the number of tries (one per second) to make before exiting.
605: The argument must be an integer.
606: This may be useful in scripts if the connection sometimes fails.
607: The default is 1.
1.9 djm 608: .It Cm ConnectTimeout
1.84 jmc 609: Specifies the timeout (in seconds) used when connecting to the
610: SSH server, instead of using the default system TCP timeout.
1.302 djm 611: This timeout is applied both to establishing the connection and to performing
612: the initial SSH protocol handshake and key exchange.
1.36 djm 613: .It Cm ControlMaster
614: Enables the sharing of multiple sessions over a single network connection.
615: When set to
1.240 jmc 616: .Cm yes ,
1.84 jmc 617: .Xr ssh 1
1.36 djm 618: will listen for connections on a control socket specified using the
619: .Cm ControlPath
620: argument.
621: Additional sessions can connect to this socket using the same
622: .Cm ControlPath
623: with
624: .Cm ControlMaster
625: set to
1.240 jmc 626: .Cm no
1.38 jmc 627: (the default).
1.64 jmc 628: These sessions will try to reuse the master instance's network connection
1.63 djm 629: rather than initiating new ones, but will fall back to connecting normally
630: if the control socket does not exist, or is not listening.
631: .Pp
1.37 djm 632: Setting this to
1.240 jmc 633: .Cm ask
634: will cause
635: .Xr ssh 1
1.206 jmc 636: to listen for control connections, but require confirmation using
637: .Xr ssh-askpass 1 .
1.51 jakob 638: If the
639: .Cm ControlPath
1.84 jmc 640: cannot be opened,
1.240 jmc 641: .Xr ssh 1
642: will continue without connecting to a master instance.
1.58 djm 643: .Pp
644: X11 and
1.59 jmc 645: .Xr ssh-agent 1
1.58 djm 646: forwarding is supported over these multiplexed connections, however the
1.70 stevesk 647: display and agent forwarded will be the one belonging to the master
1.59 jmc 648: connection i.e. it is not possible to forward multiple displays or agents.
1.56 djm 649: .Pp
650: Two additional options allow for opportunistic multiplexing: try to use a
651: master connection but fall back to creating a new one if one does not already
652: exist.
653: These options are:
1.240 jmc 654: .Cm auto
1.56 djm 655: and
1.240 jmc 656: .Cm autoask .
1.56 djm 657: The latter requires confirmation like the
1.240 jmc 658: .Cm ask
1.56 djm 659: option.
1.36 djm 660: .It Cm ControlPath
1.55 djm 661: Specify the path to the control socket used for connection sharing as described
662: in the
1.36 djm 663: .Cm ControlMaster
1.57 djm 664: section above or the string
1.240 jmc 665: .Cm none
1.57 djm 666: to disable connection sharing.
1.239 jmc 667: Arguments to
668: .Cm ControlPath
1.326 dtucker 669: may use the tilde syntax to refer to a user's home directory,
670: the tokens described in the
1.239 jmc 671: .Sx TOKENS
1.326 dtucker 672: section and environment variables as described in the
673: .Sx ENVIRONMENT VARIABLES
1.239 jmc 674: section.
1.56 djm 675: It is recommended that any
676: .Cm ControlPath
677: used for opportunistic connection sharing include
1.195 djm 678: at least %h, %p, and %r (or alternatively %C) and be placed in a directory
679: that is not writable by other users.
1.56 djm 680: This ensures that shared connections are uniquely identified.
1.137 djm 681: .It Cm ControlPersist
682: When used in conjunction with
683: .Cm ControlMaster ,
684: specifies that the master connection should remain open
685: in the background (waiting for future client connections)
686: after the initial client connection has been closed.
687: If set to
1.314 naddy 688: .Cm no
689: (the default),
1.137 djm 690: then the master connection will not be placed into the background,
691: and will close as soon as the initial client connection is closed.
692: If set to
1.240 jmc 693: .Cm yes
694: or 0,
1.137 djm 695: then the master connection will remain in the background indefinitely
696: (until killed or closed via a mechanism such as the
1.240 jmc 697: .Qq ssh -O exit ) .
1.137 djm 698: If set to a time in seconds, or a time in any of the formats documented in
699: .Xr sshd_config 5 ,
700: then the backgrounded master connection will automatically terminate
701: after it has remained idle (with no client connections) for the
702: specified time.
1.38 jmc 703: .It Cm DynamicForward
1.74 jmc 704: Specifies that a TCP port on the local machine be forwarded
1.38 jmc 705: over the secure channel, and the application
706: protocol is then used to determine where to connect to from the
707: remote machine.
1.62 djm 708: .Pp
709: The argument must be
710: .Sm off
711: .Oo Ar bind_address : Oc Ar port .
712: .Sm on
1.138 djm 713: IPv6 addresses can be specified by enclosing addresses in square brackets.
1.62 djm 714: By default, the local port is bound in accordance with the
715: .Cm GatewayPorts
716: setting.
717: However, an explicit
718: .Ar bind_address
719: may be used to bind the connection to a specific address.
720: The
721: .Ar bind_address
722: of
1.240 jmc 723: .Cm localhost
1.62 djm 724: indicates that the listening port be bound for local use only, while an
725: empty address or
726: .Sq *
727: indicates that the port should be available from all interfaces.
728: .Pp
1.38 jmc 729: Currently the SOCKS4 and SOCKS5 protocols are supported, and
1.84 jmc 730: .Xr ssh 1
1.38 jmc 731: will act as a SOCKS server.
732: Multiple forwardings may be specified, and
733: additional forwardings can be given on the command line.
734: Only the superuser can forward privileged ports.
1.376 djm 735: .It Cm EnableEscapeCommandline
736: Enables the command line option in the
737: .Cm EscapeChar
738: menu for interactive sessions (default
739: .Ql ~C ) .
740: By default, the command line is disabled.
1.14 markus 741: .It Cm EnableSSHKeysign
742: Setting this option to
1.240 jmc 743: .Cm yes
1.14 markus 744: in the global client configuration file
745: .Pa /etc/ssh/ssh_config
746: enables the use of the helper program
747: .Xr ssh-keysign 8
748: during
749: .Cm HostbasedAuthentication .
750: The argument must be
1.240 jmc 751: .Cm yes
1.14 markus 752: or
1.240 jmc 753: .Cm no
754: (the default).
1.23 jmc 755: This option should be placed in the non-hostspecific section.
1.14 markus 756: See
757: .Xr ssh-keysign 8
758: for more information.
1.1 stevesk 759: .It Cm EscapeChar
760: Sets the escape character (default:
761: .Ql ~ ) .
762: The escape character can also
763: be set on the command line.
764: The argument should be a single character,
765: .Ql ^
766: followed by a letter, or
1.240 jmc 767: .Cm none
1.1 stevesk 768: to disable the escape
769: character entirely (making the connection transparent for binary
770: data).
1.96 markus 771: .It Cm ExitOnForwardFailure
772: Specifies whether
773: .Xr ssh 1
774: should terminate the connection if it cannot set up all requested
1.216 djm 775: dynamic, tunnel, local, and remote port forwardings, (e.g.\&
1.217 jmc 776: if either end is unable to bind and listen on a specified port).
1.216 djm 777: Note that
778: .Cm ExitOnForwardFailure
779: does not apply to connections made over port forwardings and will not,
780: for example, cause
781: .Xr ssh 1
782: to exit if TCP connections to the ultimate forwarding destination fail.
1.96 markus 783: The argument must be
1.240 jmc 784: .Cm yes
1.96 markus 785: or
1.240 jmc 786: .Cm no
787: (the default).
1.197 djm 788: .It Cm FingerprintHash
789: Specifies the hash algorithm used when displaying key fingerprints.
790: Valid options are:
1.240 jmc 791: .Cm md5
1.197 djm 792: and
1.240 jmc 793: .Cm sha256
1.359 djm 794: (the default).
795: .It Cm ForkAfterAuthentication
796: Requests
797: .Nm ssh
798: to go to background just before command execution.
799: This is useful if
800: .Nm ssh
801: is going to ask for passwords or passphrases, but the user
802: wants it in the background.
803: This implies the
804: .Cm StdinNull
805: configuration option being set to
806: .Dq yes .
807: The recommended way to start X11 programs at a remote site is with
808: something like
809: .Ic ssh -f host xterm ,
810: which is the same as
811: .Ic ssh host xterm
812: if the
813: .Cm ForkAfterAuthentication
814: configuration option is set to
815: .Dq yes .
816: .Pp
817: If the
818: .Cm ExitOnForwardFailure
819: configuration option is set to
820: .Dq yes ,
821: then a client started with the
822: .Cm ForkAfterAuthentication
823: configuration option being set to
824: .Dq yes
825: will wait for all remote port forwards to be successfully established
826: before placing itself in the background.
827: The argument to this keyword must be
828: .Cm yes
829: (same as the
830: .Fl f
831: option) or
832: .Cm no
1.240 jmc 833: (the default).
1.1 stevesk 834: .It Cm ForwardAgent
835: Specifies whether the connection to the authentication agent (if any)
836: will be forwarded to the remote machine.
1.312 djm 837: The argument may be
838: .Cm yes ,
1.240 jmc 839: .Cm no
1.312 djm 840: (the default),
841: an explicit path to an agent socket or the name of an environment variable
842: (beginning with
843: .Sq $ )
844: in which to find the path.
1.3 stevesk 845: .Pp
1.7 jmc 846: Agent forwarding should be enabled with caution.
847: Users with the ability to bypass file permissions on the remote host
848: (for the agent's Unix-domain socket)
849: can access the local agent through the forwarded connection.
850: An attacker cannot obtain key material from the agent,
1.3 stevesk 851: however they can perform operations on the keys that enable them to
852: authenticate using the identities loaded into the agent.
1.1 stevesk 853: .It Cm ForwardX11
854: Specifies whether X11 connections will be automatically redirected
855: over the secure channel and
856: .Ev DISPLAY
857: set.
858: The argument must be
1.240 jmc 859: .Cm yes
1.1 stevesk 860: or
1.240 jmc 861: .Cm no
862: (the default).
1.3 stevesk 863: .Pp
1.7 jmc 864: X11 forwarding should be enabled with caution.
865: Users with the ability to bypass file permissions on the remote host
1.22 markus 866: (for the user's X11 authorization database)
1.7 jmc 867: can access the local X11 display through the forwarded connection.
1.22 markus 868: An attacker may then be able to perform activities such as keystroke monitoring
869: if the
870: .Cm ForwardX11Trusted
871: option is also enabled.
1.134 djm 872: .It Cm ForwardX11Timeout
1.135 jmc 873: Specify a timeout for untrusted X11 forwarding
874: using the format described in the
1.240 jmc 875: .Sx TIME FORMATS
876: section of
1.134 djm 877: .Xr sshd_config 5 .
878: X11 connections received by
879: .Xr ssh 1
880: after this time will be refused.
1.285 djm 881: Setting
882: .Cm ForwardX11Timeout
883: to zero will disable the timeout and permit X11 forwarding for the life
884: of the connection.
1.134 djm 885: The default is to disable untrusted X11 forwarding after twenty minutes has
886: elapsed.
1.22 markus 887: .It Cm ForwardX11Trusted
1.34 jmc 888: If this option is set to
1.240 jmc 889: .Cm yes ,
1.84 jmc 890: remote X11 clients will have full access to the original X11 display.
1.42 djm 891: .Pp
1.22 markus 892: If this option is set to
1.240 jmc 893: .Cm no
894: (the default),
1.84 jmc 895: remote X11 clients will be considered untrusted and prevented
1.22 markus 896: from stealing or tampering with data belonging to trusted X11
897: clients.
1.42 djm 898: Furthermore, the
899: .Xr xauth 1
900: token used for the session will be set to expire after 20 minutes.
901: Remote clients will be refused access after this time.
1.22 markus 902: .Pp
903: See the X11 SECURITY extension specification for full details on
904: the restrictions imposed on untrusted clients.
1.1 stevesk 905: .It Cm GatewayPorts
906: Specifies whether remote hosts are allowed to connect to local
907: forwarded ports.
908: By default,
1.84 jmc 909: .Xr ssh 1
1.7 jmc 910: binds local port forwardings to the loopback address.
911: This prevents other remote hosts from connecting to forwarded ports.
1.1 stevesk 912: .Cm GatewayPorts
1.84 jmc 913: can be used to specify that ssh
1.1 stevesk 914: should bind local port forwardings to the wildcard address,
915: thus allowing remote hosts to connect to forwarded ports.
916: The argument must be
1.240 jmc 917: .Cm yes
1.1 stevesk 918: or
1.240 jmc 919: .Cm no
920: (the default).
1.1 stevesk 921: .It Cm GlobalKnownHostsFile
1.151 djm 922: Specifies one or more files to use for the global
923: host key database, separated by whitespace.
924: The default is
925: .Pa /etc/ssh/ssh_known_hosts ,
926: .Pa /etc/ssh/ssh_known_hosts2 .
1.18 markus 927: .It Cm GSSAPIAuthentication
1.27 markus 928: Specifies whether user authentication based on GSSAPI is allowed.
1.20 jmc 929: The default is
1.240 jmc 930: .Cm no .
1.18 markus 931: .It Cm GSSAPIDelegateCredentials
932: Forward (delegate) credentials to the server.
933: The default is
1.240 jmc 934: .Cm no .
1.44 djm 935: .It Cm HashKnownHosts
936: Indicates that
1.84 jmc 937: .Xr ssh 1
1.44 djm 938: should hash host names and addresses when they are added to
1.50 djm 939: .Pa ~/.ssh/known_hosts .
1.44 djm 940: These hashed names may be used normally by
1.84 jmc 941: .Xr ssh 1
1.44 djm 942: and
1.84 jmc 943: .Xr sshd 8 ,
1.316 djm 944: but they do not visually reveal identifying information if the
945: file's contents are disclosed.
1.44 djm 946: The default is
1.240 jmc 947: .Cm no .
1.97 jmc 948: Note that existing names and addresses in known hosts files
949: will not be converted automatically,
950: but may be manually hashed using
1.45 djm 951: .Xr ssh-keygen 1 .
1.344 dtucker 952: .It Cm HostbasedAcceptedAlgorithms
1.348 djm 953: Specifies the signature algorithms that will be used for hostbased
954: authentication as a comma-separated list of patterns.
1.300 naddy 955: Alternately if the specified list begins with a
1.214 djm 956: .Sq +
1.348 djm 957: character, then the specified signature algorithms will be appended
958: to the default set instead of replacing them.
1.300 naddy 959: If the specified list begins with a
1.241 djm 960: .Sq -
1.348 djm 961: character, then the specified signature algorithms (including wildcards)
962: will be removed from the default set instead of replacing them.
1.301 naddy 963: If the specified list begins with a
964: .Sq ^
1.348 djm 965: character, then the specified signature algorithms will be placed
966: at the head of the default set.
1.213 markus 967: The default for this option is:
968: .Bd -literal -offset 3n
1.333 djm 969: ssh-ed25519-cert-v01@openssh.com,
1.213 markus 970: ecdsa-sha2-nistp256-cert-v01@openssh.com,
971: ecdsa-sha2-nistp384-cert-v01@openssh.com,
972: ecdsa-sha2-nistp521-cert-v01@openssh.com,
1.333 djm 973: sk-ssh-ed25519-cert-v01@openssh.com,
1.311 naddy 974: sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
1.305 naddy 975: rsa-sha2-512-cert-v01@openssh.com,
976: rsa-sha2-256-cert-v01@openssh.com,
1.333 djm 977: ssh-ed25519,
1.213 markus 978: ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
1.333 djm 979: sk-ssh-ed25519@openssh.com,
1.311 naddy 980: sk-ecdsa-sha2-nistp256@openssh.com,
1.366 kn 981: rsa-sha2-512,rsa-sha2-256
1.213 markus 982: .Ed
983: .Pp
1.202 djm 984: The
985: .Fl Q
986: option of
987: .Xr ssh 1
1.348 djm 988: may be used to list supported signature algorithms.
1.344 dtucker 989: This was formerly named HostbasedKeyTypes.
1.345 naddy 990: .It Cm HostbasedAuthentication
991: Specifies whether to try rhosts based authentication with public key
992: authentication.
993: The argument must be
994: .Cm yes
995: or
996: .Cm no
997: (the default).
1.1 stevesk 998: .It Cm HostKeyAlgorithms
1.348 djm 999: Specifies the host key signature algorithms
1.1 stevesk 1000: that the client wants to use in order of preference.
1.300 naddy 1001: Alternately if the specified list begins with a
1.214 djm 1002: .Sq +
1.348 djm 1003: character, then the specified signature algorithms will be appended to
1004: the default set instead of replacing them.
1.300 naddy 1005: If the specified list begins with a
1.241 djm 1006: .Sq -
1.348 djm 1007: character, then the specified signature algorithms (including wildcards)
1008: will be removed from the default set instead of replacing them.
1.301 naddy 1009: If the specified list begins with a
1010: .Sq ^
1.348 djm 1011: character, then the specified signature algorithms will be placed
1012: at the head of the default set.
1.1 stevesk 1013: The default for this option is:
1.139 djm 1014: .Bd -literal -offset 3n
1.333 djm 1015: ssh-ed25519-cert-v01@openssh.com,
1.139 djm 1016: ecdsa-sha2-nistp256-cert-v01@openssh.com,
1017: ecdsa-sha2-nistp384-cert-v01@openssh.com,
1018: ecdsa-sha2-nistp521-cert-v01@openssh.com,
1.333 djm 1019: sk-ssh-ed25519-cert-v01@openssh.com,
1.311 naddy 1020: sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
1.305 naddy 1021: rsa-sha2-512-cert-v01@openssh.com,
1022: rsa-sha2-256-cert-v01@openssh.com,
1.333 djm 1023: ssh-ed25519,
1.139 djm 1024: ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
1.311 naddy 1025: sk-ecdsa-sha2-nistp256@openssh.com,
1.333 djm 1026: sk-ssh-ed25519@openssh.com,
1.366 kn 1027: rsa-sha2-512,rsa-sha2-256
1.139 djm 1028: .Ed
1.145 djm 1029: .Pp
1030: If hostkeys are known for the destination host then this default is modified
1031: to prefer their algorithms.
1.198 djm 1032: .Pp
1.348 djm 1033: The list of available signature algorithms may also be obtained using
1.322 dtucker 1034: .Qq ssh -Q HostKeyAlgorithms .
1.1 stevesk 1035: .It Cm HostKeyAlias
1036: Specifies an alias that should be used instead of the
1037: real host name when looking up or saving the host key
1.251 djm 1038: in the host key database files and when validating host certificates.
1.84 jmc 1039: This option is useful for tunneling SSH connections
1.1 stevesk 1040: or for multiple servers running on a single host.
1.295 jmc 1041: .It Cm Hostname
1.1 stevesk 1042: Specifies the real host name to log into.
1043: This can be used to specify nicknames or abbreviations for hosts.
1.239 jmc 1044: Arguments to
1.295 jmc 1045: .Cm Hostname
1.239 jmc 1046: accept the tokens described in the
1047: .Sx TOKENS
1048: section.
1.1 stevesk 1049: Numeric IP addresses are also permitted (both on the command line and in
1.295 jmc 1050: .Cm Hostname
1.1 stevesk 1051: specifications).
1.239 jmc 1052: The default is the name given on the command line.
1.29 markus 1053: .It Cm IdentitiesOnly
1054: Specifies that
1.84 jmc 1055: .Xr ssh 1
1.304 djm 1056: should only use the configured authentication identity and certificate files
1057: (either the default files, or those explicitly configured in the
1.31 jmc 1058: .Nm
1.221 djm 1059: files
1060: or passed on the
1061: .Xr ssh 1
1.304 djm 1062: command-line),
1.84 jmc 1063: even if
1064: .Xr ssh-agent 1
1.159 djm 1065: or a
1066: .Cm PKCS11Provider
1.305 naddy 1067: or
1068: .Cm SecurityKeyProvider
1.29 markus 1069: offers more identities.
1070: The argument to this keyword must be
1.240 jmc 1071: .Cm yes
1.29 markus 1072: or
1.240 jmc 1073: .Cm no
1074: (the default).
1.84 jmc 1075: This option is intended for situations where ssh-agent
1.29 markus 1076: offers many different identities.
1.231 markus 1077: .It Cm IdentityAgent
1078: Specifies the
1079: .Ux Ns -domain
1080: socket used to communicate with the authentication agent.
1081: .Pp
1082: This option overrides the
1.240 jmc 1083: .Ev SSH_AUTH_SOCK
1.231 markus 1084: environment variable and can be used to select a specific agent.
1085: Setting the socket name to
1.240 jmc 1086: .Cm none
1.231 markus 1087: disables the use of an authentication agent.
1.232 markus 1088: If the string
1.240 jmc 1089: .Qq SSH_AUTH_SOCK
1.232 markus 1090: is specified, the location of the socket will be read from the
1091: .Ev SSH_AUTH_SOCK
1092: environment variable.
1.286 djm 1093: Otherwise if the specified value begins with a
1094: .Sq $
1095: character, then it will be treated as an environment variable containing
1096: the location of the socket.
1.231 markus 1097: .Pp
1.239 jmc 1098: Arguments to
1099: .Cm IdentityAgent
1.326 dtucker 1100: may use the tilde syntax to refer to a user's home directory,
1101: the tokens described in the
1.239 jmc 1102: .Sx TOKENS
1.326 dtucker 1103: section and environment variables as described in the
1104: .Sx ENVIRONMENT VARIABLES
1.239 jmc 1105: section.
1.67 jmc 1106: .It Cm IdentityFile
1.313 naddy 1107: Specifies a file from which the user's DSA, ECDSA, authenticator-hosted ECDSA,
1108: Ed25519, authenticator-hosted Ed25519 or RSA authentication identity is read.
1.375 dtucker 1109: You can also specify a public key file to use the corresponding
1110: private key that is loaded in
1111: .Xr ssh-agent 1
1112: when the private key file is not present locally.
1.67 jmc 1113: The default is
1.368 dtucker 1114: .Pa ~/.ssh/id_rsa ,
1.183 naddy 1115: .Pa ~/.ssh/id_ecdsa ,
1.305 naddy 1116: .Pa ~/.ssh/id_ecdsa_sk ,
1.308 naddy 1117: .Pa ~/.ssh/id_ed25519 ,
1118: .Pa ~/.ssh/id_ed25519_sk
1.139 djm 1119: and
1.368 dtucker 1120: .Pa ~/.ssh/id_dsa .
1.67 jmc 1121: Additionally, any identities represented by the authentication agent
1.165 djm 1122: will be used for authentication unless
1123: .Cm IdentitiesOnly
1124: is set.
1.221 djm 1125: If no certificates have been explicitly specified by
1126: .Cm CertificateFile ,
1.129 djm 1127: .Xr ssh 1
1128: will try to load certificate information from the filename obtained by
1129: appending
1130: .Pa -cert.pub
1131: to the path of a specified
1132: .Cm IdentityFile .
1.90 djm 1133: .Pp
1.239 jmc 1134: Arguments to
1135: .Cm IdentityFile
1136: may use the tilde syntax to refer to a user's home directory
1137: or the tokens described in the
1138: .Sx TOKENS
1139: section.
1.389 djm 1140: Alternately an argument of
1141: .Cm none
1142: may be used to indicate no identity files should be loaded.
1.90 djm 1143: .Pp
1.67 jmc 1144: It is possible to have
1145: multiple identity files specified in configuration files; all these
1146: identities will be tried in sequence.
1.152 djm 1147: Multiple
1148: .Cm IdentityFile
1149: directives will add to the list of identities tried (this behaviour
1150: differs from that of other configuration directives).
1.165 djm 1151: .Pp
1152: .Cm IdentityFile
1153: may be used in conjunction with
1154: .Cm IdentitiesOnly
1155: to select which identities in an agent are offered during authentication.
1.221 djm 1156: .Cm IdentityFile
1157: may also be used in conjunction with
1158: .Cm CertificateFile
1159: in order to provide any certificate also needed for authentication with
1160: the identity.
1.164 jmc 1161: .It Cm IgnoreUnknown
1162: Specifies a pattern-list of unknown options to be ignored if they are
1163: encountered in configuration parsing.
1164: This may be used to suppress errors if
1165: .Nm
1166: contains options that are unrecognised by
1167: .Xr ssh 1 .
1168: It is recommended that
1169: .Cm IgnoreUnknown
1170: be listed early in the configuration file as it will not be applied
1171: to unknown options that appear before it.
1.229 djm 1172: .It Cm Include
1173: Include the specified configuration file(s).
1.230 jmc 1174: Multiple pathnames may be specified and each pathname may contain
1.281 kn 1175: .Xr glob 7
1.229 djm 1176: wildcards and, for user configurations, shell-like
1.240 jmc 1177: .Sq ~
1.229 djm 1178: references to user home directories.
1.327 djm 1179: Wildcards will be expanded and processed in lexical order.
1.229 djm 1180: Files without absolute paths are assumed to be in
1181: .Pa ~/.ssh
1.230 jmc 1182: if included in a user configuration file or
1.229 djm 1183: .Pa /etc/ssh
1184: if included from the system configuration file.
1185: .Cm Include
1186: directive may appear inside a
1187: .Cm Match
1188: or
1189: .Cm Host
1190: block
1191: to perform conditional inclusion.
1.143 djm 1192: .It Cm IPQoS
1193: Specifies the IPv4 type-of-service or DSCP class for connections.
1194: Accepted values are
1.240 jmc 1195: .Cm af11 ,
1196: .Cm af12 ,
1197: .Cm af13 ,
1198: .Cm af21 ,
1199: .Cm af22 ,
1200: .Cm af23 ,
1201: .Cm af31 ,
1202: .Cm af32 ,
1203: .Cm af33 ,
1204: .Cm af41 ,
1205: .Cm af42 ,
1206: .Cm af43 ,
1207: .Cm cs0 ,
1208: .Cm cs1 ,
1209: .Cm cs2 ,
1210: .Cm cs3 ,
1211: .Cm cs4 ,
1212: .Cm cs5 ,
1213: .Cm cs6 ,
1214: .Cm cs7 ,
1215: .Cm ef ,
1.319 djm 1216: .Cm le ,
1.240 jmc 1217: .Cm lowdelay ,
1218: .Cm throughput ,
1219: .Cm reliability ,
1.253 djm 1220: a numeric value, or
1221: .Cm none
1222: to use the operating system default.
1.146 djm 1223: This option may take one or two arguments, separated by whitespace.
1.143 djm 1224: If one argument is specified, it is used as the packet class unconditionally.
1225: If two values are specified, the first is automatically selected for
1226: interactive sessions and the second for non-interactive sessions.
1227: The default is
1.269 job 1228: .Cm af21
1.272 jmc 1229: (Low-Latency Data)
1.143 djm 1230: for interactive sessions and
1.269 job 1231: .Cm cs1
1.272 jmc 1232: (Lower Effort)
1.143 djm 1233: for non-interactive sessions.
1.103 djm 1234: .It Cm KbdInteractiveAuthentication
1235: Specifies whether to use keyboard-interactive authentication.
1236: The argument to this keyword must be
1.240 jmc 1237: .Cm yes
1238: (the default)
1.103 djm 1239: or
1.240 jmc 1240: .Cm no .
1.355 dtucker 1241: .Cm ChallengeResponseAuthentication
1242: is a deprecated alias for this.
1.39 djm 1243: .It Cm KbdInteractiveDevices
1244: Specifies the list of methods to use in keyboard-interactive authentication.
1245: Multiple method names must be comma-separated.
1246: The default is to use the server specified list.
1.85 jmc 1247: The methods available vary depending on what the server supports.
1248: For an OpenSSH server,
1249: it may be zero or more of:
1.240 jmc 1250: .Cm bsdauth ,
1251: .Cm pam ,
1.85 jmc 1252: and
1.240 jmc 1253: .Cm skey .
1.140 djm 1254: .It Cm KexAlgorithms
1255: Specifies the available KEX (Key Exchange) algorithms.
1256: Multiple algorithms must be comma-separated.
1.299 kn 1257: If the specified list begins with a
1.214 djm 1258: .Sq +
1.363 dtucker 1259: character, then the specified algorithms will be appended to the default set
1.214 djm 1260: instead of replacing them.
1.299 kn 1261: If the specified list begins with a
1.241 djm 1262: .Sq -
1.363 dtucker 1263: character, then the specified algorithms (including wildcards) will be removed
1.241 djm 1264: from the default set instead of replacing them.
1.301 naddy 1265: If the specified list begins with a
1266: .Sq ^
1.363 dtucker 1267: character, then the specified algorithms will be placed at the head of the
1.301 naddy 1268: default set.
1.141 jmc 1269: The default is:
1270: .Bd -literal -offset indent
1.371 naddy 1271: sntrup761x25519-sha512@openssh.com,
1.238 djm 1272: curve25519-sha256,curve25519-sha256@libssh.org,
1.141 jmc 1273: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
1274: diffie-hellman-group-exchange-sha256,
1.266 djm 1275: diffie-hellman-group16-sha512,
1276: diffie-hellman-group18-sha512,
1.317 tedu 1277: diffie-hellman-group14-sha256
1.141 jmc 1278: .Ed
1.198 djm 1279: .Pp
1.240 jmc 1280: The list of available key exchange algorithms may also be obtained using
1281: .Qq ssh -Q kex .
1.339 djm 1282: .It Cm KnownHostsCommand
1.340 jmc 1283: Specifies a command to use to obtain a list of host keys, in addition to
1.339 djm 1284: those listed in
1285: .Cm UserKnownHostsFile
1286: and
1287: .Cm GlobalKnownHostsFile .
1288: This command is executed after the files have been read.
1.340 jmc 1289: It may write host key lines to standard output in identical format to the
1.339 djm 1290: usual files (described in the
1291: .Sx VERIFYING HOST KEYS
1292: section in
1293: .Xr ssh 1 ) .
1294: Arguments to
1295: .Cm KnownHostsCommand
1296: accept the tokens described in the
1297: .Sx TOKENS
1298: section.
1.340 jmc 1299: The command may be invoked multiple times per connection: once when preparing
1.339 djm 1300: the preference list of host key algorithms to use, again to obtain the
1301: host key for the requested host name and, if
1302: .Cm CheckHostIP
1303: is enabled, one more time to obtain the host key matching the server's
1304: address.
1305: If the command exits abnormally or returns a non-zero exit status then the
1306: connection is terminated.
1.65 reyk 1307: .It Cm LocalCommand
1308: Specifies a command to execute on the local machine after successfully
1309: connecting to the server.
1310: The command string extends to the end of the line, and is executed with
1.105 jmc 1311: the user's shell.
1.239 jmc 1312: Arguments to
1313: .Cm LocalCommand
1314: accept the tokens described in the
1315: .Sx TOKENS
1316: section.
1.123 djm 1317: .Pp
1318: The command is run synchronously and does not have access to the
1319: session of the
1320: .Xr ssh 1
1321: that spawned it.
1322: It should not be used for interactive commands.
1323: .Pp
1.65 reyk 1324: This directive is ignored unless
1325: .Cm PermitLocalCommand
1326: has been enabled.
1.1 stevesk 1327: .It Cm LocalForward
1.74 jmc 1328: Specifies that a TCP port on the local machine be forwarded over
1.1 stevesk 1329: the secure channel to the specified host and port from the remote machine.
1.324 dtucker 1330: The first argument specifies the listener and may be
1.43 djm 1331: .Sm off
1.49 jmc 1332: .Oo Ar bind_address : Oc Ar port
1.43 djm 1333: .Sm on
1.324 dtucker 1334: or a Unix domain socket path.
1335: The second argument is the destination and may be
1336: .Ar host : Ns Ar hostport
1337: or a Unix domain socket path if the remote host supports it.
1338: .Pp
1.138 djm 1339: IPv6 addresses can be specified by enclosing addresses in square brackets.
1.46 jmc 1340: Multiple forwardings may be specified, and additional forwardings can be
1.43 djm 1341: given on the command line.
1.1 stevesk 1342: Only the superuser can forward privileged ports.
1.43 djm 1343: By default, the local port is bound in accordance with the
1344: .Cm GatewayPorts
1345: setting.
1346: However, an explicit
1347: .Ar bind_address
1348: may be used to bind the connection to a specific address.
1349: The
1350: .Ar bind_address
1351: of
1.240 jmc 1352: .Cm localhost
1.46 jmc 1353: indicates that the listening port be bound for local use only, while an
1354: empty address or
1355: .Sq *
1.43 djm 1356: indicates that the port should be available from all interfaces.
1.326 dtucker 1357: Unix domain socket paths may use the tokens described in the
1.324 dtucker 1358: .Sx TOKENS
1.326 dtucker 1359: section and environment variables as described in the
1360: .Sx ENVIRONMENT VARIABLES
1.324 dtucker 1361: section.
1.1 stevesk 1362: .It Cm LogLevel
1363: Gives the verbosity level that is used when logging messages from
1.84 jmc 1364: .Xr ssh 1 .
1.1 stevesk 1365: The possible values are:
1.84 jmc 1366: QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3.
1.7 jmc 1367: The default is INFO.
1368: DEBUG and DEBUG1 are equivalent.
1369: DEBUG2 and DEBUG3 each specify higher levels of verbose output.
1.337 djm 1370: .It Cm LogVerbose
1371: Specify one or more overrides to LogLevel.
1372: An override consists of a pattern lists that matches the source file, function
1373: and line number to force detailed logging for.
1374: For example, an override pattern of:
1375: .Bd -literal -offset indent
1376: kex.c:*:1000,*:kex_exchange_identification():*,packet.c:*
1377: .Ed
1378: .Pp
1379: would enable detailed logging for line 1000 of
1.338 jmc 1380: .Pa kex.c ,
1.337 djm 1381: everything in the
1382: .Fn kex_exchange_identification
1383: function, and all code in the
1384: .Pa packet.c
1385: file.
1386: This option is intended for debugging and no overrides are enabled by default.
1.1 stevesk 1387: .It Cm MACs
1388: Specifies the MAC (message authentication code) algorithms
1389: in order of preference.
1.226 jmc 1390: The MAC algorithm is used for data integrity protection.
1.1 stevesk 1391: Multiple algorithms must be comma-separated.
1.299 kn 1392: If the specified list begins with a
1.214 djm 1393: .Sq +
1394: character, then the specified algorithms will be appended to the default set
1395: instead of replacing them.
1.299 kn 1396: If the specified list begins with a
1.241 djm 1397: .Sq -
1398: character, then the specified algorithms (including wildcards) will be removed
1399: from the default set instead of replacing them.
1.301 naddy 1400: If the specified list begins with a
1401: .Sq ^
1402: character, then the specified algorithms will be placed at the head of the
1403: default set.
1.214 djm 1404: .Pp
1.160 markus 1405: The algorithms that contain
1.240 jmc 1406: .Qq -etm
1.160 markus 1407: calculate the MAC after encryption (encrypt-then-mac).
1408: These are considered safer and their use recommended.
1.214 djm 1409: .Pp
1.84 jmc 1410: The default is:
1.101 jmc 1411: .Bd -literal -offset indent
1.160 markus 1412: umac-64-etm@openssh.com,umac-128-etm@openssh.com,
1413: hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,
1.224 djm 1414: hmac-sha1-etm@openssh.com,
1.186 naddy 1415: umac-64@openssh.com,umac-128@openssh.com,
1.224 djm 1416: hmac-sha2-256,hmac-sha2-512,hmac-sha1
1.101 jmc 1417: .Ed
1.198 djm 1418: .Pp
1.240 jmc 1419: The list of available MAC algorithms may also be obtained using
1420: .Qq ssh -Q mac .
1.1 stevesk 1421: .It Cm NoHostAuthenticationForLocalhost
1.264 djm 1422: Disable host authentication for localhost (loopback addresses).
1.1 stevesk 1423: The argument to this keyword must be
1.240 jmc 1424: .Cm yes
1.1 stevesk 1425: or
1.242 jmc 1426: .Cm no
1.240 jmc 1427: (the default).
1.1 stevesk 1428: .It Cm NumberOfPasswordPrompts
1429: Specifies the number of password prompts before giving up.
1430: The argument to this keyword must be an integer.
1.84 jmc 1431: The default is 3.
1.384 djm 1432: .It Cm ObscureKeystrokeTiming
1433: Specifies whether
1434: .Xr ssh 1
1435: should try to obscure inter-keystroke timings from passive observers of
1436: network traffic.
1437: If enabled, then for interactive sessions,
1438: .Xr ssh 1
1439: will send keystrokes at fixed intervals of a few tens of milliseconds
1440: and will send fake keystroke packets for some time after typing ceases.
1441: The argument to this keyword must be
1442: .Cm yes ,
1443: .Cm no
1444: or an interval specifier of the form
1445: .Cm interval:milliseconds
1446: (e.g.\&
1.386 djm 1447: .Cm interval:80
1448: for 80 milliseconds).
1.384 djm 1449: The default is to obscure keystrokes using a 20ms packet interval.
1450: Note that smaller intervals will result in higher fake keystroke packet rates.
1.1 stevesk 1451: .It Cm PasswordAuthentication
1452: Specifies whether to use password authentication.
1453: The argument to this keyword must be
1.240 jmc 1454: .Cm yes
1455: (the default)
1.1 stevesk 1456: or
1.240 jmc 1457: .Cm no .
1.65 reyk 1458: .It Cm PermitLocalCommand
1459: Allow local command execution via the
1460: .Ic LocalCommand
1461: option or using the
1.66 jmc 1462: .Ic !\& Ns Ar command
1.65 reyk 1463: escape sequence in
1464: .Xr ssh 1 .
1465: The argument must be
1.240 jmc 1466: .Cm yes
1.65 reyk 1467: or
1.240 jmc 1468: .Cm no
1469: (the default).
1.347 markus 1470: .It Cm PermitRemoteOpen
1471: Specifies the destinations to which remote TCP port forwarding is permitted when
1472: .Cm RemoteForward
1473: is used as a SOCKS proxy.
1474: The forwarding specification must be one of the following forms:
1475: .Pp
1476: .Bl -item -offset indent -compact
1477: .It
1478: .Cm PermitRemoteOpen
1479: .Sm off
1480: .Ar host : port
1481: .Sm on
1482: .It
1483: .Cm PermitRemoteOpen
1484: .Sm off
1485: .Ar IPv4_addr : port
1486: .Sm on
1487: .It
1488: .Cm PermitRemoteOpen
1489: .Sm off
1490: .Ar \&[ IPv6_addr \&] : port
1491: .Sm on
1492: .El
1493: .Pp
1494: Multiple forwards may be specified by separating them with whitespace.
1495: An argument of
1496: .Cm any
1497: can be used to remove all restrictions and permit any forwarding requests.
1498: An argument of
1499: .Cm none
1500: can be used to prohibit all forwarding requests.
1501: The wildcard
1502: .Sq *
1503: can be used for host or port to allow all hosts or ports respectively.
1504: Otherwise, no pattern matching or address lookups are performed on supplied
1505: names.
1.127 markus 1506: .It Cm PKCS11Provider
1.292 djm 1507: Specifies which PKCS#11 provider to use or
1508: .Cm none
1509: to indicate that no provider should be used (the default).
1510: The argument to this keyword is a path to the PKCS#11 shared library
1.127 markus 1511: .Xr ssh 1
1.292 djm 1512: should use to communicate with a PKCS#11 token providing keys for user
1513: authentication.
1.67 jmc 1514: .It Cm Port
1515: Specifies the port number to connect on the remote host.
1.84 jmc 1516: The default is 22.
1.1 stevesk 1517: .It Cm PreferredAuthentications
1.226 jmc 1518: Specifies the order in which the client should try authentication methods.
1.48 jmc 1519: This allows a client to prefer one method (e.g.\&
1.1 stevesk 1520: .Cm keyboard-interactive )
1.48 jmc 1521: over another method (e.g.\&
1.131 jmc 1522: .Cm password ) .
1523: The default is:
1524: .Bd -literal -offset indent
1525: gssapi-with-mic,hostbased,publickey,
1526: keyboard-interactive,password
1527: .Ed
1.1 stevesk 1528: .It Cm ProxyCommand
1529: Specifies the command to use to connect to the server.
1530: The command
1.190 djm 1531: string extends to the end of the line, and is executed
1532: using the user's shell
1533: .Ql exec
1534: directive to avoid a lingering shell process.
1535: .Pp
1.239 jmc 1536: Arguments to
1537: .Cm ProxyCommand
1538: accept the tokens described in the
1539: .Sx TOKENS
1540: section.
1.1 stevesk 1541: The command can be basically anything,
1542: and should read from its standard input and write to its standard output.
1543: It should eventually connect an
1544: .Xr sshd 8
1545: server running on some machine, or execute
1546: .Ic sshd -i
1547: somewhere.
1548: Host key management will be done using the
1.296 jmc 1549: .Cm Hostname
1550: of the host being connected (defaulting to the name typed by the user).
1.7 jmc 1551: Setting the command to
1.240 jmc 1552: .Cm none
1.6 markus 1553: disables this option entirely.
1.1 stevesk 1554: Note that
1555: .Cm CheckHostIP
1556: is not available for connects with a proxy command.
1.52 djm 1557: .Pp
1558: This directive is useful in conjunction with
1559: .Xr nc 1
1560: and its proxy support.
1.53 jmc 1561: For example, the following directive would connect via an HTTP proxy at
1.52 djm 1562: 192.0.2.0:
1563: .Bd -literal -offset 3n
1564: ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p
1565: .Ed
1.233 djm 1566: .It Cm ProxyJump
1.260 millert 1567: Specifies one or more jump proxies as either
1.233 djm 1568: .Xo
1569: .Sm off
1.234 jmc 1570: .Op Ar user No @
1.233 djm 1571: .Ar host
1.234 jmc 1572: .Op : Ns Ar port
1.233 djm 1573: .Sm on
1.260 millert 1574: or an ssh URI
1.233 djm 1575: .Xc .
1.235 djm 1576: Multiple proxies may be separated by comma characters and will be visited
1.236 djm 1577: sequentially.
1.233 djm 1578: Setting this option will cause
1579: .Xr ssh 1
1580: to connect to the target host by first making a
1581: .Xr ssh 1
1582: connection to the specified
1583: .Cm ProxyJump
1584: host and then establishing a
1.234 jmc 1585: TCP forwarding to the ultimate target from there.
1.346 dlg 1586: Setting the host to
1587: .Cm none
1588: disables this option entirely.
1.233 djm 1589: .Pp
1590: Note that this option will compete with the
1591: .Cm ProxyCommand
1592: option - whichever is specified first will prevent later instances of the
1593: other from taking effect.
1.289 djm 1594: .Pp
1595: Note also that the configuration for the destination host (either supplied
1596: via the command-line or the configuration file) is not generally applied
1597: to jump hosts.
1598: .Pa ~/.ssh/config
1599: should be used if specific configuration is required for jump hosts.
1.167 djm 1600: .It Cm ProxyUseFdpass
1.168 jmc 1601: Specifies that
1.167 djm 1602: .Cm ProxyCommand
1603: will pass a connected file descriptor back to
1.168 jmc 1604: .Xr ssh 1
1.167 djm 1605: instead of continuing to execute and pass data.
1606: The default is
1.240 jmc 1607: .Cm no .
1.343 dtucker 1608: .It Cm PubkeyAcceptedAlgorithms
1609: Specifies the signature algorithms that will be used for public key
1610: authentication as a comma-separated list of patterns.
1.299 kn 1611: If the specified list begins with a
1.214 djm 1612: .Sq +
1.343 dtucker 1613: character, then the algorithms after it will be appended to the default
1.214 djm 1614: instead of replacing it.
1.299 kn 1615: If the specified list begins with a
1.241 djm 1616: .Sq -
1.343 dtucker 1617: character, then the specified algorithms (including wildcards) will be removed
1.241 djm 1618: from the default set instead of replacing them.
1.301 naddy 1619: If the specified list begins with a
1620: .Sq ^
1.343 dtucker 1621: character, then the specified algorithms will be placed at the head of the
1.301 naddy 1622: default set.
1.213 markus 1623: The default for this option is:
1624: .Bd -literal -offset 3n
1.333 djm 1625: ssh-ed25519-cert-v01@openssh.com,
1.213 markus 1626: ecdsa-sha2-nistp256-cert-v01@openssh.com,
1627: ecdsa-sha2-nistp384-cert-v01@openssh.com,
1628: ecdsa-sha2-nistp521-cert-v01@openssh.com,
1.333 djm 1629: sk-ssh-ed25519-cert-v01@openssh.com,
1.311 naddy 1630: sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
1.305 naddy 1631: rsa-sha2-512-cert-v01@openssh.com,
1632: rsa-sha2-256-cert-v01@openssh.com,
1.333 djm 1633: ssh-ed25519,
1.311 naddy 1634: ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
1.333 djm 1635: sk-ssh-ed25519@openssh.com,
1.305 naddy 1636: sk-ecdsa-sha2-nistp256@openssh.com,
1.366 kn 1637: rsa-sha2-512,rsa-sha2-256
1.213 markus 1638: .Ed
1639: .Pp
1.348 djm 1640: The list of available signature algorithms may also be obtained using
1.343 dtucker 1641: .Qq ssh -Q PubkeyAcceptedAlgorithms .
1.1 stevesk 1642: .It Cm PubkeyAuthentication
1643: Specifies whether to try public key authentication.
1644: The argument to this keyword must be
1.240 jmc 1645: .Cm yes
1.369 djm 1646: (the default),
1647: .Cm no ,
1648: .Cm unbound
1.1 stevesk 1649: or
1.369 djm 1650: .Cm host-bound .
1651: The final two options enable public key authentication while respectively
1652: disabling or enabling the OpenSSH host-bound authentication protocol
1653: extension required for restricted
1654: .Xr ssh-agent 1
1655: forwarding.
1.75 dtucker 1656: .It Cm RekeyLimit
1.373 djm 1657: Specifies the maximum amount of data that may be transmitted or received
1658: before the session key is renegotiated, optionally followed by a maximum
1659: amount of time that may pass before the session key is renegotiated.
1.162 dtucker 1660: The first argument is specified in bytes and may have a suffix of
1.76 jmc 1661: .Sq K ,
1662: .Sq M ,
1.75 dtucker 1663: or
1.76 jmc 1664: .Sq G
1.75 dtucker 1665: to indicate Kilobytes, Megabytes, or Gigabytes, respectively.
1666: The default is between
1.84 jmc 1667: .Sq 1G
1.75 dtucker 1668: and
1.84 jmc 1669: .Sq 4G ,
1.75 dtucker 1670: depending on the cipher.
1.162 dtucker 1671: The optional second value is specified in seconds and may use any of the
1.293 schwarze 1672: units documented in the TIME FORMATS section of
1.162 dtucker 1673: .Xr sshd_config 5 .
1674: The default value for
1675: .Cm RekeyLimit
1676: is
1.240 jmc 1677: .Cm default none ,
1.162 dtucker 1678: which means that rekeying is performed after the cipher's default amount
1679: of data has been sent or received and no time based rekeying is done.
1.249 bluhm 1680: .It Cm RemoteCommand
1681: Specifies a command to execute on the remote machine after successfully
1682: connecting to the server.
1683: The command string extends to the end of the line, and is executed with
1684: the user's shell.
1.250 jmc 1685: Arguments to
1686: .Cm RemoteCommand
1687: accept the tokens described in the
1688: .Sx TOKENS
1689: section.
1.1 stevesk 1690: .It Cm RemoteForward
1.74 jmc 1691: Specifies that a TCP port on the remote machine be forwarded over
1.256 markus 1692: the secure channel.
1.273 djm 1693: The remote port may either be forwarded to a specified host and port
1.256 markus 1694: from the local machine, or may act as a SOCKS 4/5 proxy that allows a remote
1695: client to connect to arbitrary destinations from the local machine.
1.324 dtucker 1696: The first argument is the listening specification and may be
1.43 djm 1697: .Sm off
1.49 jmc 1698: .Oo Ar bind_address : Oc Ar port
1.43 djm 1699: .Sm on
1.324 dtucker 1700: or, if the remote host supports it, a Unix domain socket path.
1.256 markus 1701: If forwarding to a specific destination then the second argument must be
1.324 dtucker 1702: .Ar host : Ns Ar hostport
1703: or a Unix domain socket path,
1.256 markus 1704: otherwise if no destination argument is specified then the remote forwarding
1705: will be established as a SOCKS proxy.
1.370 naddy 1706: When acting as a SOCKS proxy, the destination of the connection can be
1.347 markus 1707: restricted by
1708: .Cm PermitRemoteOpen .
1.256 markus 1709: .Pp
1.138 djm 1710: IPv6 addresses can be specified by enclosing addresses in square brackets.
1.1 stevesk 1711: Multiple forwardings may be specified, and additional
1712: forwardings can be given on the command line.
1.113 stevesk 1713: Privileged ports can be forwarded only when
1714: logging in as root on the remote machine.
1.326 dtucker 1715: Unix domain socket paths may use the tokens described in the
1.324 dtucker 1716: .Sx TOKENS
1.326 dtucker 1717: section and environment variables as described in the
1718: .Sx ENVIRONMENT VARIABLES
1.324 dtucker 1719: section.
1.118 jmc 1720: .Pp
1.117 djm 1721: If the
1722: .Ar port
1.240 jmc 1723: argument is 0,
1.117 djm 1724: the listen port will be dynamically allocated on the server and reported
1725: to the client at run time.
1.43 djm 1726: .Pp
1727: If the
1728: .Ar bind_address
1729: is not specified, the default is to only bind to loopback addresses.
1730: If the
1731: .Ar bind_address
1732: is
1733: .Ql *
1734: or an empty string, then the forwarding is requested to listen on all
1735: interfaces.
1736: Specifying a remote
1737: .Ar bind_address
1.46 jmc 1738: will only succeed if the server's
1739: .Cm GatewayPorts
1.43 djm 1740: option is enabled (see
1.46 jmc 1741: .Xr sshd_config 5 ) .
1.149 djm 1742: .It Cm RequestTTY
1743: Specifies whether to request a pseudo-tty for the session.
1744: The argument may be one of:
1.240 jmc 1745: .Cm no
1.149 djm 1746: (never request a TTY),
1.240 jmc 1747: .Cm yes
1.149 djm 1748: (always request a TTY when standard input is a TTY),
1.240 jmc 1749: .Cm force
1.149 djm 1750: (always request a TTY) or
1.240 jmc 1751: .Cm auto
1.149 djm 1752: (request a TTY when opening a login session).
1753: This option mirrors the
1754: .Fl t
1755: and
1756: .Fl T
1757: flags for
1758: .Xr ssh 1 .
1.374 djm 1759: .It Cm RequiredRSASize
1760: Specifies the minimum RSA key size (in bits) that
1761: .Xr ssh 1
1762: will accept.
1763: User authentication keys smaller than this limit will be ignored.
1764: Servers that present host keys smaller than this limit will cause the
1765: connection to be terminated.
1766: The default is
1767: .Cm 1024
1768: bits.
1769: Note that this limit may only be raised from the default.
1.196 djm 1770: .It Cm RevokedHostKeys
1771: Specifies revoked host public keys.
1772: Keys listed in this file will be refused for host authentication.
1773: Note that if this file does not exist or is not readable,
1774: then host authentication will be refused for all hosts.
1775: Keys may be specified as a text file, listing one public key per line, or as
1776: an OpenSSH Key Revocation List (KRL) as generated by
1777: .Xr ssh-keygen 1 .
1778: For more information on KRLs, see the KEY REVOCATION LISTS section in
1779: .Xr ssh-keygen 1 .
1.380 dtucker 1780: Arguments to
1781: .Cm RevokedHostKeys
1782: may use the tilde syntax to refer to a user's home directory,
1783: the tokens described in the
1784: .Sx TOKENS
1785: section and environment variables as described in the
1786: .Sx ENVIRONMENT VARIABLES
1787: section.
1.305 naddy 1788: .It Cm SecurityKeyProvider
1.313 naddy 1789: Specifies a path to a library that will be used when loading any
1790: FIDO authenticator-hosted keys, overriding the default of using
1791: the built-in USB HID support.
1.309 naddy 1792: .Pp
1793: If the specified value begins with a
1794: .Sq $
1795: character, then it will be treated as an environment variable containing
1796: the path to the library.
1.32 djm 1797: .It Cm SendEnv
1798: Specifies what variables from the local
1799: .Xr environ 7
1800: should be sent to the server.
1.84 jmc 1801: The server must also support it, and the server must be configured to
1.33 djm 1802: accept these environment variables.
1.207 dtucker 1803: Note that the
1804: .Ev TERM
1.208 jmc 1805: environment variable is always sent whenever a
1.207 dtucker 1806: pseudo-terminal is requested as it is required by the protocol.
1.32 djm 1807: Refer to
1808: .Cm AcceptEnv
1809: in
1810: .Xr sshd_config 5
1811: for how to configure the server.
1.80 jmc 1812: Variables are specified by name, which may contain wildcard characters.
1.33 djm 1813: Multiple environment variables may be separated by whitespace or spread
1.32 djm 1814: across multiple
1815: .Cm SendEnv
1816: directives.
1.81 jmc 1817: .Pp
1818: See
1819: .Sx PATTERNS
1820: for more information on patterns.
1.271 djm 1821: .Pp
1.272 jmc 1822: It is possible to clear previously set
1.271 djm 1823: .Cm SendEnv
1824: variable names by prefixing patterns with
1825: .Pa - .
1826: The default is not to send any environment variables.
1.28 markus 1827: .It Cm ServerAliveCountMax
1.73 jmc 1828: Sets the number of server alive messages (see below) which may be
1.28 markus 1829: sent without
1.84 jmc 1830: .Xr ssh 1
1.28 markus 1831: receiving any messages back from the server.
1832: If this threshold is reached while server alive messages are being sent,
1.84 jmc 1833: ssh will disconnect from the server, terminating the session.
1.28 markus 1834: It is important to note that the use of server alive messages is very
1835: different from
1836: .Cm TCPKeepAlive
1837: (below).
1838: The server alive messages are sent through the encrypted channel
1839: and therefore will not be spoofable.
1840: The TCP keepalive option enabled by
1841: .Cm TCPKeepAlive
1842: is spoofable.
1843: The server alive mechanism is valuable when the client or
1.298 dtucker 1844: server depend on knowing when a connection has become unresponsive.
1.28 markus 1845: .Pp
1846: The default value is 3.
1847: If, for example,
1848: .Cm ServerAliveInterval
1.84 jmc 1849: (see below) is set to 15 and
1.28 markus 1850: .Cm ServerAliveCountMax
1.84 jmc 1851: is left at the default, if the server becomes unresponsive,
1852: ssh will disconnect after approximately 45 seconds.
1.67 jmc 1853: .It Cm ServerAliveInterval
1854: Sets a timeout interval in seconds after which if no data has been received
1855: from the server,
1.84 jmc 1856: .Xr ssh 1
1.67 jmc 1857: will send a message through the encrypted
1858: channel to request a response from the server.
1859: The default
1860: is 0, indicating that these messages will not be sent to the server.
1.357 jmc 1861: .It Cm SessionType
1862: May be used to either request invocation of a subsystem on the remote system,
1863: or to prevent the execution of a remote command at all.
1864: The latter is useful for just forwarding ports.
1865: The argument to this keyword must be
1866: .Cm none
1867: (same as the
1868: .Fl N
1869: option),
1870: .Cm subsystem
1871: (same as the
1872: .Fl s
1873: option) or
1874: .Cm default
1875: (shell or command execution).
1.277 jmc 1876: .It Cm SetEnv
1877: Directly specify one or more environment variables and their contents to
1878: be sent to the server.
1879: Similarly to
1880: .Cm SendEnv ,
1.354 djm 1881: with the exception of the
1882: .Ev TERM
1883: variable, the server must be prepared to accept the environment variable.
1.358 djm 1884: .It Cm StdinNull
1885: Redirects stdin from
1886: .Pa /dev/null
1887: (actually, prevents reading from stdin).
1888: Either this or the equivalent
1889: .Fl n
1890: option must be used when
1891: .Nm ssh
1892: is run in the background.
1893: The argument to this keyword must be
1894: .Cm yes
1895: (same as the
1896: .Fl n
1897: option) or
1898: .Cm no
1899: (the default).
1.191 millert 1900: .It Cm StreamLocalBindMask
1901: Sets the octal file creation mode mask
1902: .Pq umask
1903: used when creating a Unix-domain socket file for local or remote
1904: port forwarding.
1905: This option is only used for port forwarding to a Unix-domain socket file.
1906: .Pp
1907: The default value is 0177, which creates a Unix-domain socket file that is
1908: readable and writable only by the owner.
1909: Note that not all operating systems honor the file mode on Unix-domain
1910: socket files.
1911: .It Cm StreamLocalBindUnlink
1912: Specifies whether to remove an existing Unix-domain socket file for local
1913: or remote port forwarding before creating a new one.
1914: If the socket file already exists and
1915: .Cm StreamLocalBindUnlink
1916: is not enabled,
1917: .Nm ssh
1918: will be unable to forward the port to the Unix-domain socket file.
1919: This option is only used for port forwarding to a Unix-domain socket file.
1920: .Pp
1921: The argument must be
1.240 jmc 1922: .Cm yes
1.191 millert 1923: or
1.240 jmc 1924: .Cm no
1925: (the default).
1.1 stevesk 1926: .It Cm StrictHostKeyChecking
1927: If this flag is set to
1.240 jmc 1928: .Cm yes ,
1.84 jmc 1929: .Xr ssh 1
1.1 stevesk 1930: will never automatically add host keys to the
1.50 djm 1931: .Pa ~/.ssh/known_hosts
1.1 stevesk 1932: file, and refuses to connect to hosts whose host key has changed.
1.263 dtucker 1933: This provides maximum protection against man-in-the-middle (MITM) attacks,
1.84 jmc 1934: though it can be annoying when the
1.1 stevesk 1935: .Pa /etc/ssh/ssh_known_hosts
1.84 jmc 1936: file is poorly maintained or when connections to new hosts are
1.1 stevesk 1937: frequently made.
1938: This option forces the user to manually
1939: add all new hosts.
1.255 jmc 1940: .Pp
1.1 stevesk 1941: If this flag is set to
1.364 dtucker 1942: .Cm accept-new
1.360 jmc 1943: then ssh will automatically add new host keys to the user's
1944: .Pa known_hosts
1945: file, but will not permit connections to hosts with
1.254 djm 1946: changed host keys.
1947: If this flag is set to
1.364 dtucker 1948: .Cm no
1.254 djm 1949: or
1.364 dtucker 1950: .Cm off ,
1.255 jmc 1951: ssh will automatically add new host keys to the user known hosts files
1952: and allow connections to hosts with changed hostkeys to proceed,
1953: subject to some restrictions.
1.1 stevesk 1954: If this flag is set to
1.240 jmc 1955: .Cm ask
1956: (the default),
1.1 stevesk 1957: new host keys
1958: will be added to the user known host files only after the user
1959: has confirmed that is what they really want to do, and
1.84 jmc 1960: ssh will refuse to connect to hosts whose host key has changed.
1.1 stevesk 1961: The host keys of
1962: known hosts will be verified automatically in all cases.
1.244 jmc 1963: .It Cm SyslogFacility
1964: Gives the facility code that is used when logging messages from
1965: .Xr ssh 1 .
1966: The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2,
1967: LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
1968: The default is USER.
1.26 markus 1969: .It Cm TCPKeepAlive
1970: Specifies whether the system should send TCP keepalive messages to the
1971: other side.
1972: If they are sent, death of the connection or crash of one
1973: of the machines will be properly noticed.
1974: However, this means that
1975: connections will die if the route is down temporarily, and some people
1976: find it annoying.
1977: .Pp
1978: The default is
1.240 jmc 1979: .Cm yes
1.26 markus 1980: (to send TCP keepalive messages), and the client will notice
1981: if the network goes down or the remote host dies.
1982: This is important in scripts, and many users want it too.
1983: .Pp
1984: To disable TCP keepalive messages, the value should be set to
1.240 jmc 1985: .Cm no .
1.265 djm 1986: See also
1987: .Cm ServerAliveInterval
1988: for protocol-level keepalives.
1.382 djm 1989: .It Cm Tag
1990: Specify a configuration tag name that may be later used by a
1991: .Cm Match
1.383 jsg 1992: directive to select a block of configuration.
1.65 reyk 1993: .It Cm Tunnel
1.95 stevesk 1994: Request
1.65 reyk 1995: .Xr tun 4
1.69 jmc 1996: device forwarding between the client and the server.
1.65 reyk 1997: The argument must be
1.240 jmc 1998: .Cm yes ,
1999: .Cm point-to-point
1.95 stevesk 2000: (layer 3),
1.240 jmc 2001: .Cm ethernet
1.95 stevesk 2002: (layer 2),
1.65 reyk 2003: or
1.240 jmc 2004: .Cm no
2005: (the default).
1.95 stevesk 2006: Specifying
1.240 jmc 2007: .Cm yes
1.95 stevesk 2008: requests the default tunnel mode, which is
1.240 jmc 2009: .Cm point-to-point .
1.65 reyk 2010: .It Cm TunnelDevice
1.95 stevesk 2011: Specifies the
1.65 reyk 2012: .Xr tun 4
1.95 stevesk 2013: devices to open on the client
2014: .Pq Ar local_tun
2015: and the server
2016: .Pq Ar remote_tun .
2017: .Pp
2018: The argument must be
2019: .Sm off
2020: .Ar local_tun Op : Ar remote_tun .
2021: .Sm on
2022: The devices may be specified by numerical ID or the keyword
1.240 jmc 2023: .Cm any ,
1.95 stevesk 2024: which uses the next available tunnel device.
2025: If
2026: .Ar remote_tun
2027: is not specified, it defaults to
1.240 jmc 2028: .Cm any .
1.95 stevesk 2029: The default is
1.240 jmc 2030: .Cm any:any .
1.201 djm 2031: .It Cm UpdateHostKeys
1.200 djm 2032: Specifies whether
2033: .Xr ssh 1
2034: should accept notifications of additional hostkeys from the server sent
2035: after authentication has completed and add them to
2036: .Cm UserKnownHostsFile .
2037: The argument must be
1.240 jmc 2038: .Cm yes ,
2039: .Cm no
1.320 djm 2040: or
1.240 jmc 2041: .Cm ask .
1.320 djm 2042: This option allows learning alternate hostkeys for a server
1.201 djm 2043: and supports graceful key rotation by allowing a server to send replacement
2044: public keys before old ones are removed.
1.336 djm 2045: .Pp
1.200 djm 2046: Additional hostkeys are only accepted if the key used to authenticate the
1.336 djm 2047: host was already trusted or explicitly accepted by the user, the host was
2048: authenticated via
2049: .Cm UserKnownHostsFile
2050: (i.e. not
2051: .Cm GlobalKnownHostsFile )
2052: and the host was authenticated using a plain key and not a certificate.
1.320 djm 2053: .Pp
2054: .Cm UpdateHostKeys
1.321 jmc 2055: is enabled by default if the user has not overridden the default
1.320 djm 2056: .Cm UserKnownHostsFile
1.335 djm 2057: setting and has not enabled
2058: .Cm VerifyHostKeyDNS ,
2059: otherwise
1.320 djm 2060: .Cm UpdateHostKeys
2061: will be set to
1.334 djm 2062: .Cm no .
1.320 djm 2063: .Pp
1.204 djm 2064: If
2065: .Cm UpdateHostKeys
2066: is set to
1.240 jmc 2067: .Cm ask ,
1.204 djm 2068: then the user is asked to confirm the modifications to the known_hosts file.
1.205 djm 2069: Confirmation is currently incompatible with
2070: .Cm ControlPersist ,
2071: and will be disabled if it is enabled.
1.200 djm 2072: .Pp
2073: Presently, only
2074: .Xr sshd 8
2075: from OpenSSH 6.8 and greater support the
1.240 jmc 2076: .Qq hostkeys@openssh.com
1.200 djm 2077: protocol extension used to inform the client of all the server's hostkeys.
1.1 stevesk 2078: .It Cm User
2079: Specifies the user to log in as.
2080: This can be useful when a different user name is used on different machines.
2081: This saves the trouble of
2082: having to remember to give the user name on the command line.
2083: .It Cm UserKnownHostsFile
1.151 djm 2084: Specifies one or more files to use for the user
2085: host key database, separated by whitespace.
1.329 dtucker 2086: Each filename may use tilde notation to refer to the user's home directory,
2087: the tokens described in the
2088: .Sx TOKENS
2089: section and environment variables as described in the
2090: .Sx ENVIRONMENT VARIABLES
2091: section.
1.377 dtucker 2092: A value of
2093: .Cm none
2094: causes
2095: .Xr ssh 1
1.378 jmc 2096: to ignore any user-specific known hosts files.
1.151 djm 2097: The default is
2098: .Pa ~/.ssh/known_hosts ,
2099: .Pa ~/.ssh/known_hosts2 .
1.8 jakob 2100: .It Cm VerifyHostKeyDNS
2101: Specifies whether to verify the remote key using DNS and SSHFP resource
2102: records.
1.24 jakob 2103: If this option is set to
1.240 jmc 2104: .Cm yes ,
1.25 jmc 2105: the client will implicitly trust keys that match a secure fingerprint
1.24 jakob 2106: from DNS.
2107: Insecure fingerprints will be handled as if this option was set to
1.240 jmc 2108: .Cm ask .
1.24 jakob 2109: If this option is set to
1.240 jmc 2110: .Cm ask ,
1.24 jakob 2111: information on fingerprint match will be displayed, but the user will still
2112: need to confirm new host keys according to the
2113: .Cm StrictHostKeyChecking
2114: option.
1.8 jakob 2115: The default is
1.240 jmc 2116: .Cm no .
1.84 jmc 2117: .Pp
1.240 jmc 2118: See also
2119: .Sx VERIFYING HOST KEYS
2120: in
1.84 jmc 2121: .Xr ssh 1 .
1.111 grunk 2122: .It Cm VisualHostKey
2123: If this flag is set to
1.240 jmc 2124: .Cm yes ,
1.111 grunk 2125: an ASCII art representation of the remote host key fingerprint is
1.197 djm 2126: printed in addition to the fingerprint string at login and
1.114 stevesk 2127: for unknown host keys.
1.111 grunk 2128: If this flag is set to
1.240 jmc 2129: .Cm no
2130: (the default),
1.114 stevesk 2131: no fingerprint strings are printed at login and
1.197 djm 2132: only the fingerprint string will be printed for unknown host keys.
1.1 stevesk 2133: .It Cm XAuthLocation
1.5 stevesk 2134: Specifies the full pathname of the
1.1 stevesk 2135: .Xr xauth 1
2136: program.
2137: The default is
2138: .Pa /usr/X11R6/bin/xauth .
2139: .El
1.86 jmc 2140: .Sh PATTERNS
2141: A
2142: .Em pattern
2143: consists of zero or more non-whitespace characters,
2144: .Sq *
2145: (a wildcard that matches zero or more characters),
2146: or
2147: .Sq ?\&
2148: (a wildcard that matches exactly one character).
2149: For example, to specify a set of declarations for any host in the
1.240 jmc 2150: .Qq .co.uk
1.86 jmc 2151: set of domains,
2152: the following pattern could be used:
2153: .Pp
2154: .Dl Host *.co.uk
2155: .Pp
2156: The following pattern
2157: would match any host in the 192.168.0.[0-9] network range:
2158: .Pp
2159: .Dl Host 192.168.0.?
2160: .Pp
2161: A
2162: .Em pattern-list
2163: is a comma-separated list of patterns.
2164: Patterns within pattern-lists may be negated
2165: by preceding them with an exclamation mark
2166: .Pq Sq !\& .
2167: For example,
1.174 djm 2168: to allow a key to be used from anywhere within an organization
1.86 jmc 2169: except from the
1.240 jmc 2170: .Qq dialup
1.86 jmc 2171: pool,
2172: the following entry (in authorized_keys) could be used:
2173: .Pp
2174: .Dl from=\&"!*.dialup.example.com,*.example.com\&"
1.258 djm 2175: .Pp
2176: Note that a negated match will never produce a positive result by itself.
2177: For example, attempting to match
2178: .Qq host3
2179: against the following pattern-list will fail:
2180: .Pp
2181: .Dl from=\&"!host1,!host2\&"
2182: .Pp
2183: The solution here is to include a term that will yield a positive match,
2184: such as a wildcard:
2185: .Pp
2186: .Dl from=\&"!host1,!host2,*\&"
1.239 jmc 2187: .Sh TOKENS
2188: Arguments to some keywords can make use of tokens,
2189: which are expanded at runtime:
2190: .Pp
2191: .Bl -tag -width XXXX -offset indent -compact
2192: .It %%
2193: A literal
2194: .Sq % .
2195: .It \&%C
1.391 ! djm 2196: Hash of %l%h%p%r%j.
1.239 jmc 2197: .It %d
2198: Local user's home directory.
1.339 djm 2199: .It %f
2200: The fingerprint of the server's host key.
2201: .It %H
2202: The
2203: .Pa known_hosts
2204: hostname or address that is being searched for.
1.239 jmc 2205: .It %h
2206: The remote hostname.
1.340 jmc 2207: .It \%%I
1.339 djm 2208: A string describing the reason for a
2209: .Cm KnownHostsCommand
1.340 jmc 2210: execution: either
2211: .Cm ADDRESS
1.339 djm 2212: when looking up a host by address (only when
2213: .Cm CheckHostIP
2214: is enabled),
1.340 jmc 2215: .Cm HOSTNAME
2216: when searching by hostname, or
2217: .Cm ORDER
1.339 djm 2218: when preparing the host key algorithm preference list to use for the
2219: destination host.
1.239 jmc 2220: .It %i
2221: The local user ID.
1.391 ! djm 2222: .It %j
! 2223: The contents of the ProxyJump option, or the empty string if this
! 2224: option is unset.
1.339 djm 2225: .It %K
2226: The base64 encoded host key.
1.330 dtucker 2227: .It %k
1.350 jsg 2228: The host key alias if specified, otherwise the original remote hostname given
1.330 dtucker 2229: on the command line.
1.239 jmc 2230: .It %L
2231: The local hostname.
2232: .It %l
2233: The local hostname, including the domain name.
2234: .It %n
2235: The original remote hostname, as given on the command line.
2236: .It %p
2237: The remote port.
2238: .It %r
2239: The remote username.
1.261 djm 2240: .It \&%T
2241: The local
2242: .Xr tun 4
2243: or
2244: .Xr tap 4
2245: network interface assigned if
1.262 jmc 2246: tunnel forwarding was requested, or
2247: .Qq NONE
1.261 djm 2248: otherwise.
1.339 djm 2249: .It %t
2250: The type of the server host key, e.g.
1.360 jmc 2251: .Cm ssh-ed25519 .
1.239 jmc 2252: .It %u
2253: The local username.
2254: .El
2255: .Pp
1.323 dtucker 2256: .Cm CertificateFile ,
2257: .Cm ControlPath ,
2258: .Cm IdentityAgent ,
2259: .Cm IdentityFile ,
1.339 djm 2260: .Cm KnownHostsCommand ,
1.325 jmc 2261: .Cm LocalForward ,
1.324 dtucker 2262: .Cm Match exec ,
2263: .Cm RemoteCommand ,
1.329 dtucker 2264: .Cm RemoteForward ,
1.380 dtucker 2265: .Cm RevokedHostKeys ,
1.323 dtucker 2266: and
1.331 jmc 2267: .Cm UserKnownHostsFile
1.391 ! djm 2268: accept the tokens %%, %C, %d, %h, %i, %j, %k, %L, %l, %n, %p, %r, and %u.
1.239 jmc 2269: .Pp
1.339 djm 2270: .Cm KnownHostsCommand
2271: additionally accepts the tokens %f, %H, %I, %K and %t.
2272: .Pp
1.295 jmc 2273: .Cm Hostname
1.239 jmc 2274: accepts the tokens %% and %h.
2275: .Pp
2276: .Cm LocalCommand
1.323 dtucker 2277: accepts all tokens.
1.239 jmc 2278: .Pp
2279: .Cm ProxyCommand
1.372 dtucker 2280: and
2281: .Cm ProxyJump
2282: accept the tokens %%, %h, %n, %p, and %r.
1.387 djm 2283: .Pp
2284: Note that some of these directives build commands for execution via the shell.
2285: Because
2286: .Xr ssh 1
2287: performs no filtering or escaping of characters that have special meaning in
1.388 jmc 2288: shell commands (e.g. quotes), it is the user's responsibility to ensure that
1.387 djm 2289: the arguments passed to
2290: .Xr ssh 1
2291: do not contain such characters and that tokens are appropriately quoted
2292: when used.
1.326 dtucker 2293: .Sh ENVIRONMENT VARIABLES
2294: Arguments to some keywords can be expanded at runtime from environment
2295: variables on the client by enclosing them in
2296: .Ic ${} ,
2297: for example
2298: .Ic ${HOME}/.ssh
2299: would refer to the user's .ssh directory.
2300: If a specified environment variable does not exist then an error will be
2301: returned and the setting for that keyword will be ignored.
2302: .Pp
2303: The keywords
2304: .Cm CertificateFile ,
2305: .Cm ControlPath ,
1.329 dtucker 2306: .Cm IdentityAgent ,
1.352 jmc 2307: .Cm IdentityFile ,
1.339 djm 2308: .Cm KnownHostsCommand ,
1.326 dtucker 2309: and
1.329 dtucker 2310: .Cm UserKnownHostsFile
1.326 dtucker 2311: support environment variables.
2312: The keywords
2313: .Cm LocalForward
2314: and
2315: .Cm RemoteForward
2316: support environment variables only for Unix domain socket paths.
1.1 stevesk 2317: .Sh FILES
2318: .Bl -tag -width Ds
1.50 djm 2319: .It Pa ~/.ssh/config
1.1 stevesk 2320: This is the per-user configuration file.
2321: The format of this file is described above.
1.84 jmc 2322: This file is used by the SSH client.
1.30 djm 2323: Because of the potential for abuse, this file must have strict permissions:
1.290 jmc 2324: read/write for the user, and not writable by others.
1.1 stevesk 2325: .It Pa /etc/ssh/ssh_config
2326: Systemwide configuration file.
2327: This file provides defaults for those
2328: values that are not specified in the user's configuration file, and
2329: for those users who do not have a configuration file.
2330: This file must be world-readable.
2331: .El
1.13 jmc 2332: .Sh SEE ALSO
2333: .Xr ssh 1
1.1 stevesk 2334: .Sh AUTHORS
1.240 jmc 2335: .An -nosplit
1.1 stevesk 2336: OpenSSH is a derivative of the original and free
1.240 jmc 2337: ssh 1.2.12 release by
2338: .An Tatu Ylonen .
2339: .An Aaron Campbell , Bob Beck , Markus Friedl ,
2340: .An Niels Provos , Theo de Raadt
2341: and
2342: .An Dug Song
1.1 stevesk 2343: removed many bugs, re-added newer features and
2344: created OpenSSH.
1.240 jmc 2345: .An Markus Friedl
2346: contributed the support for SSH protocol versions 1.5 and 2.0.
![[BACK]](/icons/back.gif){kind=icon}
Return to ssh_config.5 CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh