[BACK]Return to sshd.8 CVS log [TXT][DIR] Up to [local] / src / usr.bin / ssh

Diff for /src/usr.bin/ssh/sshd.8 between version 1.120.2.4 and 1.120.2.5

version 1.120.2.4, 2001/12/03 00:36:34 version 1.120.2.5, 2002/03/09 00:20:45
Line 49 
Line 49 
 .Op Fl g Ar login_grace_time  .Op Fl g Ar login_grace_time
 .Op Fl h Ar host_key_file  .Op Fl h Ar host_key_file
 .Op Fl k Ar key_gen_time  .Op Fl k Ar key_gen_time
   .Op Fl o Ar option
 .Op Fl p Ar port  .Op Fl p Ar port
 .Op Fl u Ar len  .Op Fl u Ar len
 .Sh DESCRIPTION  .Sh DESCRIPTION
Line 207 
Line 208 
 this many seconds, the server disconnects and exits.  this many seconds, the server disconnects and exits.
 A value of zero indicates no limit.  A value of zero indicates no limit.
 .It Fl h Ar host_key_file  .It Fl h Ar host_key_file
 Specifies the file from which the host key is read (default  Specifies a file from which a host key is read.
 .Pa /etc/ssh_host_key ) .  
 This option must be given if  This option must be given if
 .Nm  .Nm
 is not run as root (as the normal  is not run as root (as the normal
 host file is normally not readable by anyone but root).  host key files are normally not readable by anyone but root).
   The default is
   .Pa /etc/ssh_host_key
   for protocol version 1, and
   .Pa /etc/ssh_host_rsa_key
   and
   .Pa /etc/ssh_host_dsa_key
   for protocol version 2.
 It is possible to have multiple host key files for  It is possible to have multiple host key files for
 the different protocol versions and host key algorithms.  the different protocol versions and host key algorithms.
 .It Fl i  .It Fl i
Line 237 
Line 244 
 communications even if the machine is cracked into or physically  communications even if the machine is cracked into or physically
 seized.  seized.
 A value of zero indicates that the key will never be regenerated.  A value of zero indicates that the key will never be regenerated.
   .It Fl o Ar option
   Can be used to give options in the format used in the configuration file.
   This is useful for specifying options for which there is no separate
   command-line flag.
 .It Fl p Ar port  .It Fl p Ar port
 Specifies the port on which the server listens for connections  Specifies the port on which the server listens for connections
 (default 22).  (default 22).
   Multiple port options are permitted.
   Ports specified in the configuration file are ignored when a
   command-line port is specified.
 .It Fl q  .It Fl q
 Quiet mode.  Quiet mode.
 Nothing is sent to the system log.  Nothing is sent to the system log.
Line 248 
Line 262 
 .It Fl t  .It Fl t
 Test mode.  Test mode.
 Only check the validity of the configuration file and sanity of the keys.  Only check the validity of the configuration file and sanity of the keys.
 This is useful for updating  This is useful for updating
 .Nm  .Nm
 reliably as configuration options may change.  reliably as configuration options may change.
 .It Fl u Ar len  .It Fl u Ar len
Line 279 
Line 293 
 and using a  and using a
 .Cm from="pattern-list"  .Cm from="pattern-list"
 option in a key file.  option in a key file.
   Configuration options that require DNS include using a
   USER@HOST pattern in
   .Cm AllowUsers
   or
   .Cm DenyUsers .
 .It Fl D  .It Fl D
 When this option is specified  When this option is specified
 .Nm  .Nm
Line 315 
Line 334 
 Default is  Default is
 .Dq yes .  .Dq yes .
 .It Cm AllowGroups  .It Cm AllowGroups
 This keyword can be followed by a list of group names, separated  This keyword can be followed by a list of group name patterns, separated
 by spaces.  by spaces.
 If specified, login is allowed only for users whose primary  If specified, login is allowed only for users whose primary
 group or supplementary group list matches one of the patterns.  group or supplementary group list matches one of the patterns.
Line 325 
Line 344 
 can be used as  can be used as
 wildcards in the patterns.  wildcards in the patterns.
 Only group names are valid; a numerical group ID is not recognized.  Only group names are valid; a numerical group ID is not recognized.
 By default login is allowed regardless of the group list.  By default, login is allowed for all groups.
 .Pp  .Pp
 .It Cm AllowTcpForwarding  .It Cm AllowTcpForwarding
 Specifies whether TCP forwarding is permitted.  Specifies whether TCP forwarding is permitted.
Line 336 
Line 355 
 own forwarders.  own forwarders.
 .Pp  .Pp
 .It Cm AllowUsers  .It Cm AllowUsers
 This keyword can be followed by a list of user names, separated  This keyword can be followed by a list of user name patterns, separated
 by spaces.  by spaces.
 If specified, login is allowed only for users names that  If specified, login is allowed only for users names that
 match one of the patterns.  match one of the patterns.
Line 346 
Line 365 
 can be used as  can be used as
 wildcards in the patterns.  wildcards in the patterns.
 Only user names are valid; a numerical user ID is not recognized.  Only user names are valid; a numerical user ID is not recognized.
 By default login is allowed regardless of the user name.  By default, login is allowed for all users.
 If the pattern takes the form USER@HOST then USER and HOST  If the pattern takes the form USER@HOST then USER and HOST
 are separately checked, restricting logins to particular  are separately checked, restricting logins to particular
 users from particular hosts.  users from particular hosts.
Line 364 
Line 383 
 is taken to be an absolute path or one relative to the user's home  is taken to be an absolute path or one relative to the user's home
 directory.  directory.
 The default is  The default is
 .Dq .ssh/authorized_keys  .Dq .ssh/authorized_keys .
 .It Cm Banner  .It Cm Banner
 In some jurisdictions, sending a warning message before authentication  In some jurisdictions, sending a warning message before authentication
 may be relevant for getting legal protection.  may be relevant for getting legal protection.
Line 383 
Line 402 
 Specifies the ciphers allowed for protocol version 2.  Specifies the ciphers allowed for protocol version 2.
 Multiple ciphers must be comma-separated.  Multiple ciphers must be comma-separated.
 The default is  The default is
 .Dq aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour.  .Pp
   .Bd -literal
     ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
       aes192-cbc,aes256-cbc''
   .Ed
 .It Cm ClientAliveInterval  .It Cm ClientAliveInterval
 Sets a timeout interval in seconds after which if no data has been received  Sets a timeout interval in seconds after which if no data has been received
 from the client,  from the client,
Line 417 
Line 440 
 is left at the default, unresponsive ssh clients  is left at the default, unresponsive ssh clients
 will be disconnected after approximately 45 seconds.  will be disconnected after approximately 45 seconds.
 .It Cm DenyGroups  .It Cm DenyGroups
 This keyword can be followed by a number of group names, separated  This keyword can be followed by a list of group name patterns, separated
 by spaces.  by spaces.
 Users whose primary group or supplementary group list matches  Login is disallowed for users whose primary group or supplementary
 one of the patterns aren't allowed to log in.  group list matches one of the patterns.
 .Ql \&*  .Ql \&*
 and  and
 .Ql ?  .Ql ?
 can be used as  can be used as
 wildcards in the patterns.  wildcards in the patterns.
 Only group names are valid; a numerical group ID is not recognized.  Only group names are valid; a numerical group ID is not recognized.
 By default login is allowed regardless of the group list.  By default, login is allowed for all groups.
 .Pp  .Pp
 .It Cm DenyUsers  .It Cm DenyUsers
 This keyword can be followed by a number of user names, separated  This keyword can be followed by a list of user name patterns, separated
 by spaces.  by spaces.
 Login is disallowed for user names that match one of the patterns.  Login is disallowed for user names that match one of the patterns.
 .Ql \&*  .Ql \&*
Line 438 
Line 461 
 .Ql ?  .Ql ?
 can be used as wildcards in the patterns.  can be used as wildcards in the patterns.
 Only user names are valid; a numerical user ID is not recognized.  Only user names are valid; a numerical user ID is not recognized.
 By default login is allowed regardless of the user name.  By default, login is allowed for all users.
   If the pattern takes the form USER@HOST then USER and HOST
   are separately checked, restricting logins to particular
   users from particular hosts.
 .It Cm GatewayPorts  .It Cm GatewayPorts
 Specifies whether remote hosts are allowed to connect to ports  Specifies whether remote hosts are allowed to connect to ports
 forwarded for the client.  forwarded for the client.
Line 467 
Line 493 
 The default is  The default is
 .Dq no .  .Dq no .
 .It Cm HostKey  .It Cm HostKey
 Specifies the file containing the private host keys (default  Specifies a file containing a private host key
 .Pa /etc/ssh_host_key )  used by SSH.
 used by SSH protocol versions 1 and 2.  The default is
   .Pa /etc/ssh_host_key
   for protocol version 1, and
   .Pa /etc/ssh_host_rsa_key
   and
   .Pa /etc/ssh_host_dsa_key
   for protocol version 2.
 Note that  Note that
 .Nm  .Nm
 will refuse to use a file if it is group/world-accessible.  will refuse to use a file if it is group/world-accessible.
Line 509 
Line 541 
 The default is  The default is
 .Dq no .  .Dq no .
 .It Cm KeepAlive  .It Cm KeepAlive
 Specifies whether the system should send keepalive messages to the  Specifies whether the system should send TCP keepalive messages to the
 other side.  other side.
 If they are sent, death of the connection or crash of one  If they are sent, death of the connection or crash of one
 of the machines will be properly noticed.  of the machines will be properly noticed.
Line 524 
Line 556 
 The default is  The default is
 .Dq yes  .Dq yes
 (to send keepalives), and the server will notice  (to send keepalives), and the server will notice
 if the network goes down or the client host reboots.  if the network goes down or the client host crashes.
 This avoids infinitely hanging sessions.  This avoids infinitely hanging sessions.
 .Pp  .Pp
 To disable keepalives, the value should be set to  To disable keepalives, the value should be set to
 .Dq no  .Dq no .
 in both the server and the client configuration files.  
 .It Cm KerberosAuthentication  .It Cm KerberosAuthentication
 Specifies whether Kerberos authentication is allowed.  Specifies whether Kerberos authentication is allowed.
 This can be in the form of a Kerberos ticket, or if  This can be in the form of a Kerberos ticket, or if
Line 612 
Line 643 
 Gives the verbosity level that is used when logging messages from  Gives the verbosity level that is used when logging messages from
 .Nm sshd .  .Nm sshd .
 The possible values are:  The possible values are:
 QUIET, FATAL, ERROR, INFO, VERBOSE and DEBUG.  QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3.
 The default is INFO.  The default is INFO.  DEBUG and DEBUG1 are equivalent.  DEBUG2
 Logging with level DEBUG violates the privacy of users  and DEBUG3 each specify higher levels of debugging output.
   Logging with a DEBUG level violates the privacy of users
 and is not recommended.  and is not recommended.
 .It Cm MACs  .It Cm MACs
 Specifies the available MAC (message authentication code) algorithms.  Specifies the available MAC (message authentication code) algorithms.
Line 733 
Line 765 
 The default is  The default is
 .Dq yes .  .Dq yes .
 Note that this option applies to protocol version 2 only.  Note that this option applies to protocol version 2 only.
 .It Cm ReverseMappingCheck  
 Specifies whether  
 .Nm  
 should try to verify the remote host name and check that  
 the resolved host name for the remote IP address maps back to the  
 very same IP address.  
 The default is  
 .Dq no .  
 .It Cm RhostsAuthentication  .It Cm RhostsAuthentication
 Specifies whether authentication using rhosts or /etc/hosts.equiv  Specifies whether authentication using rhosts or /etc/hosts.equiv
 files is sufficient.  files is sufficient.
Line 808 
Line 832 
 does not know how to handle  does not know how to handle
 .Xr xauth 1  .Xr xauth 1
 cookies.  cookies.
   .It Cm VerifyReverseMapping
   Specifies whether
   .Nm
   should try to verify the remote host name and check that
   the resolved host name for the remote IP address maps back to the
   very same IP address.
   The default is
   .Dq no .
 .It Cm X11DisplayOffset  .It Cm X11DisplayOffset
 Specifies the first display number available for  Specifies the first display number available for
 .Nm sshd Ns 's  .Nm sshd Ns 's
Line 825 
Line 857 
 X11 forwarding is automatically disabled if  X11 forwarding is automatically disabled if
 .Cm UseLogin  .Cm UseLogin
 is enabled.  is enabled.
   .It Cm X11UseLocalhost
   Specifies whether
   .Nm
   should bind the X11 forwarding server to the loopback address or to
   the wildcard address.  By default,
   .Nm
   binds the forwarding server to the loopback address and sets the
   hostname part of the
   .Ev DISPLAY
   environment variable to
   .Dq localhost .
   This prevents remote hosts from connecting to the fake display.
   However, some older X11 clients may not function with this
   configuration.
   .Cm X11UseLocalhost
   may be set to
   .Dq no
   to specify that the forwarding server should be bound to the wildcard
   address.
   The argument must be
   .Dq yes
   or
   .Dq no .
   The default is
   .Dq yes .
 .It Cm XAuthLocation  .It Cm XAuthLocation
 Specifies the location of the  Specifies the location of the
 .Xr xauth 1  .Xr xauth 1
Legend:
Removed from v.1.120.2.4  
changed lines
  Added in v.1.120.2.5