[BACK]Return to sshd.8 CVS log [TXT][DIR] Up to [local] / src / usr.bin / ssh

Diff for /src/usr.bin/ssh/sshd.8 between version 1.153 and 1.153.2.3

version 1.153, 2001/09/27 17:53:24 version 1.153.2.3, 2002/03/07 17:37:48
Line 49 
Line 49 
 .Op Fl g Ar login_grace_time  .Op Fl g Ar login_grace_time
 .Op Fl h Ar host_key_file  .Op Fl h Ar host_key_file
 .Op Fl k Ar key_gen_time  .Op Fl k Ar key_gen_time
   .Op Fl o Ar option
 .Op Fl p Ar port  .Op Fl p Ar port
 .Op Fl u Ar len  .Op Fl u Ar len
 .Sh DESCRIPTION  .Sh DESCRIPTION
Line 197 
Line 198 
 .It Fl f Ar configuration_file  .It Fl f Ar configuration_file
 Specifies the name of the configuration file.  Specifies the name of the configuration file.
 The default is  The default is
 .Pa /etc/sshd_config .  .Pa /etc/ssh/sshd_config .
 .Nm  .Nm
 refuses to start if there is no configuration file.  refuses to start if there is no configuration file.
 .It Fl g Ar login_grace_time  .It Fl g Ar login_grace_time
Line 207 
Line 208 
 this many seconds, the server disconnects and exits.  this many seconds, the server disconnects and exits.
 A value of zero indicates no limit.  A value of zero indicates no limit.
 .It Fl h Ar host_key_file  .It Fl h Ar host_key_file
 Specifies the file from which the host key is read (default  Specifies a file from which a host key is read.
 .Pa /etc/ssh_host_key ) .  
 This option must be given if  This option must be given if
 .Nm  .Nm
 is not run as root (as the normal  is not run as root (as the normal
 host file is normally not readable by anyone but root).  host key files are normally not readable by anyone but root).
   The default is
   .Pa /etc/ssh/ssh_host_key
   for protocol version 1, and
   .Pa /etc/ssh/ssh_host_rsa_key
   and
   .Pa /etc/ssh/ssh_host_dsa_key
   for protocol version 2.
 It is possible to have multiple host key files for  It is possible to have multiple host key files for
 the different protocol versions and host key algorithms.  the different protocol versions and host key algorithms.
 .It Fl i  .It Fl i
Line 237 
Line 244 
 communications even if the machine is cracked into or physically  communications even if the machine is cracked into or physically
 seized.  seized.
 A value of zero indicates that the key will never be regenerated.  A value of zero indicates that the key will never be regenerated.
   .It Fl o Ar option
   Can be used to give options in the format used in the configuration file.
   This is useful for specifying options for which there is no separate
   command-line flag.
 .It Fl p Ar port  .It Fl p Ar port
 Specifies the port on which the server listens for connections  Specifies the port on which the server listens for connections
 (default 22).  (default 22).
   Multiple port options are permitted.
   Ports specified in the configuration file are ignored when a
   command-line port is specified.
 .It Fl q  .It Fl q
 Quiet mode.  Quiet mode.
 Nothing is sent to the system log.  Nothing is sent to the system log.
Line 248 
Line 262 
 .It Fl t  .It Fl t
 Test mode.  Test mode.
 Only check the validity of the configuration file and sanity of the keys.  Only check the validity of the configuration file and sanity of the keys.
 This is useful for updating  This is useful for updating
 .Nm  .Nm
 reliably as configuration options may change.  reliably as configuration options may change.
 .It Fl u Ar len  .It Fl u Ar len
Line 279 
Line 293 
 and using a  and using a
 .Cm from="pattern-list"  .Cm from="pattern-list"
 option in a key file.  option in a key file.
   Configuration options that require DNS include using a
   USER@HOST pattern in
   .Cm AllowUsers
   or
   .Cm DenyUsers .
 .It Fl D  .It Fl D
 When this option is specified  When this option is specified
 .Nm  .Nm
Line 297 
Line 316 
 .Sh CONFIGURATION FILE  .Sh CONFIGURATION FILE
 .Nm  .Nm
 reads configuration data from  reads configuration data from
 .Pa /etc/sshd_config  .Pa /etc/ssh/sshd_config
 (or the file specified with  (or the file specified with
 .Fl f  .Fl f
 on the command line).  on the command line).
Line 315 
Line 334 
 Default is  Default is
 .Dq yes .  .Dq yes .
 .It Cm AllowGroups  .It Cm AllowGroups
 This keyword can be followed by a list of group names, separated  This keyword can be followed by a list of group name patterns, separated
 by spaces.  by spaces.
 If specified, login is allowed only for users whose primary  If specified, login is allowed only for users whose primary
 group or supplementary group list matches one of the patterns.  group or supplementary group list matches one of the patterns.
Line 325 
Line 344 
 can be used as  can be used as
 wildcards in the patterns.  wildcards in the patterns.
 Only group names are valid; a numerical group ID is not recognized.  Only group names are valid; a numerical group ID is not recognized.
 By default login is allowed regardless of the group list.  By default, login is allowed for all groups.
 .Pp  .Pp
 .It Cm AllowTcpForwarding  .It Cm AllowTcpForwarding
 Specifies whether TCP forwarding is permitted.  Specifies whether TCP forwarding is permitted.
Line 336 
Line 355 
 own forwarders.  own forwarders.
 .Pp  .Pp
 .It Cm AllowUsers  .It Cm AllowUsers
 This keyword can be followed by a list of user names, separated  This keyword can be followed by a list of user name patterns, separated
 by spaces.  by spaces.
 If specified, login is allowed only for users names that  If specified, login is allowed only for users names that
 match one of the patterns.  match one of the patterns.
Line 346 
Line 365 
 can be used as  can be used as
 wildcards in the patterns.  wildcards in the patterns.
 Only user names are valid; a numerical user ID is not recognized.  Only user names are valid; a numerical user ID is not recognized.
 By default login is allowed regardless of the user name.  By default, login is allowed for all users.
 If the pattern takes the form USER@HOST then USER and HOST  If the pattern takes the form USER@HOST then USER and HOST
 are separately checked, restricting logins to particular  are separately checked, restricting logins to particular
 users from particular hosts.  users from particular hosts.
Line 364 
Line 383 
 is taken to be an absolute path or one relative to the user's home  is taken to be an absolute path or one relative to the user's home
 directory.  directory.
 The default is  The default is
 .Dq .ssh/authorized_keys  .Dq .ssh/authorized_keys .
 .It Cm Banner  .It Cm Banner
 In some jurisdictions, sending a warning message before authentication  In some jurisdictions, sending a warning message before authentication
 may be relevant for getting legal protection.  may be relevant for getting legal protection.
Line 383 
Line 402 
 Specifies the ciphers allowed for protocol version 2.  Specifies the ciphers allowed for protocol version 2.
 Multiple ciphers must be comma-separated.  Multiple ciphers must be comma-separated.
 The default is  The default is
 .Dq aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour.  .Pp
   .Bd -literal
     ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
       aes192-cbc,aes256-cbc''
   .Ed
 .It Cm ClientAliveInterval  .It Cm ClientAliveInterval
 Sets a timeout interval in seconds after which if no data has been received  Sets a timeout interval in seconds after which if no data has been received
 from the client,  from the client,
Line 402 
Line 425 
 .Nm  .Nm
 will disconnect the client, terminating the session. It is important  will disconnect the client, terminating the session. It is important
 to note that the use of client alive messages is very different from  to note that the use of client alive messages is very different from
 .Cm Keepalive  .Cm KeepAlive
 (below). The client alive messages are sent through the  (below). The client alive messages are sent through the
 encrypted channel and therefore will not be spoofable. The TCP keepalive  encrypted channel and therefore will not be spoofable. The TCP keepalive
 option enabled by  option enabled by
 .Cm Keepalive  .Cm KeepAlive
 is spoofable. The client alive mechanism is valuable when the client or  is spoofable. The client alive mechanism is valuable when the client or
 server depend on knowing when a connection has become inactive.  server depend on knowing when a connection has become inactive.
 .Pp  .Pp
Line 417 
Line 440 
 is left at the default, unresponsive ssh clients  is left at the default, unresponsive ssh clients
 will be disconnected after approximately 45 seconds.  will be disconnected after approximately 45 seconds.
 .It Cm DenyGroups  .It Cm DenyGroups
 This keyword can be followed by a number of group names, separated  This keyword can be followed by a list of group name patterns, separated
 by spaces.  by spaces.
 Users whose primary group or supplementary group list matches  Login is disallowed for users whose primary group or supplementary
 one of the patterns aren't allowed to log in.  group list matches one of the patterns.
 .Ql \&*  .Ql \&*
 and  and
 .Ql ?  .Ql ?
 can be used as  can be used as
 wildcards in the patterns.  wildcards in the patterns.
 Only group names are valid; a numerical group ID is not recognized.  Only group names are valid; a numerical group ID is not recognized.
 By default login is allowed regardless of the group list.  By default, login is allowed for all groups.
 .Pp  .Pp
 .It Cm DenyUsers  .It Cm DenyUsers
 This keyword can be followed by a number of user names, separated  This keyword can be followed by a list of user name patterns, separated
 by spaces.  by spaces.
 Login is disallowed for user names that match one of the patterns.  Login is disallowed for user names that match one of the patterns.
 .Ql \&*  .Ql \&*
Line 438 
Line 461 
 .Ql ?  .Ql ?
 can be used as wildcards in the patterns.  can be used as wildcards in the patterns.
 Only user names are valid; a numerical user ID is not recognized.  Only user names are valid; a numerical user ID is not recognized.
 By default login is allowed regardless of the user name.  By default, login is allowed for all users.
   If the pattern takes the form USER@HOST then USER and HOST
   are separately checked, restricting logins to particular
   users from particular hosts.
 .It Cm GatewayPorts  .It Cm GatewayPorts
 Specifies whether remote hosts are allowed to connect to ports  Specifies whether remote hosts are allowed to connect to ports
 forwarded for the client.  forwarded for the client.
Line 467 
Line 493 
 The default is  The default is
 .Dq no .  .Dq no .
 .It Cm HostKey  .It Cm HostKey
 Specifies the file containing the private host keys (default  Specifies a file containing a private host key
 .Pa /etc/ssh_host_key )  used by SSH.
 used by SSH protocol versions 1 and 2.  The default is
   .Pa /etc/ssh/ssh_host_key
   for protocol version 1, and
   .Pa /etc/ssh/ssh_host_rsa_key
   and
   .Pa /etc/ssh/ssh_host_dsa_key
   for protocol version 2.
 Note that  Note that
 .Nm  .Nm
 will refuse to use a file if it is group/world-accessible.  will refuse to use a file if it is group/world-accessible.
Line 509 
Line 541 
 The default is  The default is
 .Dq no .  .Dq no .
 .It Cm KeepAlive  .It Cm KeepAlive
 Specifies whether the system should send keepalive messages to the  Specifies whether the system should send TCP keepalive messages to the
 other side.  other side.
 If they are sent, death of the connection or crash of one  If they are sent, death of the connection or crash of one
 of the machines will be properly noticed.  of the machines will be properly noticed.
Line 524 
Line 556 
 The default is  The default is
 .Dq yes  .Dq yes
 (to send keepalives), and the server will notice  (to send keepalives), and the server will notice
 if the network goes down or the client host reboots.  if the network goes down or the client host crashes.
 This avoids infinitely hanging sessions.  This avoids infinitely hanging sessions.
 .Pp  .Pp
 To disable keepalives, the value should be set to  To disable keepalives, the value should be set to
 .Dq no  .Dq no .
 in both the server and the client configuration files.  
 .It Cm KerberosAuthentication  .It Cm KerberosAuthentication
 Specifies whether Kerberos authentication is allowed.  Specifies whether Kerberos authentication is allowed.
 This can be in the form of a Kerberos ticket, or if  This can be in the form of a Kerberos ticket, or if
Line 612 
Line 643 
 Gives the verbosity level that is used when logging messages from  Gives the verbosity level that is used when logging messages from
 .Nm sshd .  .Nm sshd .
 The possible values are:  The possible values are:
 QUIET, FATAL, ERROR, INFO, VERBOSE and DEBUG.  QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3.
 The default is INFO.  The default is INFO.  DEBUG and DEBUG1 are equivalent.  DEBUG2
 Logging with level DEBUG violates the privacy of users  and DEBUG3 each specify higher levels of debugging output.
   Logging with a DEBUG level violates the privacy of users
 and is not recommended.  and is not recommended.
 .It Cm MACs  .It Cm MACs
 Specifies the available MAC (message authentication code) algorithms.  Specifies the available MAC (message authentication code) algorithms.
Line 733 
Line 765 
 The default is  The default is
 .Dq yes .  .Dq yes .
 Note that this option applies to protocol version 2 only.  Note that this option applies to protocol version 2 only.
 .It Cm ReverseMappingCheck  
 Specifies whether  
 .Nm  
 should try to verify the remote host name and check that  
 the resolved host name for the remote IP address maps back to the  
 very same IP address.  
 The default is  
 .Dq no .  
 .It Cm RhostsAuthentication  .It Cm RhostsAuthentication
 Specifies whether authentication using rhosts or /etc/hosts.equiv  Specifies whether authentication using rhosts or /etc/hosts.equiv
 files is sufficient.  files is sufficient.
Line 808 
Line 832 
 does not know how to handle  does not know how to handle
 .Xr xauth 1  .Xr xauth 1
 cookies.  cookies.
   .It Cm VerifyReverseMapping
   Specifies whether
   .Nm
   should try to verify the remote host name and check that
   the resolved host name for the remote IP address maps back to the
   very same IP address.
   The default is
   .Dq no .
 .It Cm X11DisplayOffset  .It Cm X11DisplayOffset
 Specifies the first display number available for  Specifies the first display number available for
 .Nm sshd Ns 's  .Nm sshd Ns 's
Line 825 
Line 857 
 X11 forwarding is automatically disabled if  X11 forwarding is automatically disabled if
 .Cm UseLogin  .Cm UseLogin
 is enabled.  is enabled.
   .It Cm X11UseLocalhost
   Specifies whether
   .Nm
   should bind the X11 forwarding server to the loopback address or to
   the wildcard address.  By default,
   .Nm
   binds the forwarding server to the loopback address and sets the
   hostname part of the
   .Ev DISPLAY
   environment variable to
   .Dq localhost .
   This prevents remote hosts from connecting to the fake display.
   However, some older X11 clients may not function with this
   configuration.
   .Cm X11UseLocalhost
   may be set to
   .Dq no
   to specify that the forwarding server should be bound to the wildcard
   address.
   The argument must be
   .Dq yes
   or
   .Dq no .
   The default is
   .Dq yes .
 .It Cm XAuthLocation  .It Cm XAuthLocation
 Specifies the location of the  Specifies the location of the
 .Xr xauth 1  .Xr xauth 1
Line 909 
Line 966 
 If  If
 .Pa $HOME/.ssh/rc  .Pa $HOME/.ssh/rc
 exists, runs it; else if  exists, runs it; else if
 .Pa /etc/sshrc  .Pa /etc/ssh/sshrc
 exists, runs  exists, runs
 it; otherwise runs xauth.  it; otherwise runs xauth.
 The  The
Line 1006 
Line 1063 
 Environment variables set this way  Environment variables set this way
 override other default environment values.  override other default environment values.
 Multiple options of this type are permitted.  Multiple options of this type are permitted.
   This option is automatically disabled if
   .Cm UseLogin
   is enabled.
 .It Cm no-port-forwarding  .It Cm no-port-forwarding
 Forbids TCP/IP forwarding when this key is used for authentication.  Forbids TCP/IP forwarding when this key is used for authentication.
 Any port forward requests by the client will return an error.  Any port forward requests by the client will return an error.
Line 1043 
Line 1103 
 permitopen="10.2.1.55:80",permitopen="10.2.1.56:25" 1024 33 23.\|.\|.\|2323  permitopen="10.2.1.55:80",permitopen="10.2.1.56:25" 1024 33 23.\|.\|.\|2323
 .Sh SSH_KNOWN_HOSTS FILE FORMAT  .Sh SSH_KNOWN_HOSTS FILE FORMAT
 The  The
 .Pa /etc/ssh_known_hosts ,  .Pa /etc/ssh/ssh_known_hosts ,
 and  and
 .Pa $HOME/.ssh/known_hosts  .Pa $HOME/.ssh/known_hosts
 files contain host public keys for all known hosts.  files contain host public keys for all known hosts.
Line 1068 
Line 1128 
 .Pp  .Pp
 Bits, exponent, and modulus are taken directly from the RSA host key; they  Bits, exponent, and modulus are taken directly from the RSA host key; they
 can be obtained, e.g., from  can be obtained, e.g., from
 .Pa /etc/ssh_host_key.pub .  .Pa /etc/ssh/ssh_host_key.pub .
 The optional comment field continues to the end of the line, and is not used.  The optional comment field continues to the end of the line, and is not used.
 .Pp  .Pp
 Lines starting with  Lines starting with
Line 1090 
Line 1150 
 long, and you definitely don't want to type in the host keys by hand.  long, and you definitely don't want to type in the host keys by hand.
 Rather, generate them by a script  Rather, generate them by a script
 or by taking  or by taking
 .Pa /etc/ssh_host_key.pub  .Pa /etc/ssh/ssh_host_key.pub
 and adding the host names at the front.  and adding the host names at the front.
 .Ss Examples  .Ss Examples
 .Bd -literal  .Bd -literal
Line 1099 
Line 1159 
 .Ed  .Ed
 .Sh FILES  .Sh FILES
 .Bl -tag -width Ds  .Bl -tag -width Ds
 .It Pa /etc/sshd_config  .It Pa /etc/ssh/sshd_config
 Contains configuration data for  Contains configuration data for
 .Nm sshd .  .Nm sshd .
 This file should be writable by root only, but it is recommended  This file should be writable by root only, but it is recommended
 (though not necessary) that it be world-readable.  (though not necessary) that it be world-readable.
 .It Pa /etc/ssh_host_key, /etc/ssh_host_dsa_key, /etc/ssh_host_rsa_key  .It Pa /etc/ssh/ssh_host_key, /etc/ssh/ssh_host_dsa_key, /etc/ssh/ssh_host_rsa_key
 These three files contain the private parts of the host keys.  These three files contain the private parts of the host keys.
 These files should only be owned by root, readable only by root, and not  These files should only be owned by root, readable only by root, and not
 accessible to others.  accessible to others.
 Note that  Note that
 .Nm  .Nm
 does not start if this file is group/world-accessible.  does not start if this file is group/world-accessible.
 .It Pa /etc/ssh_host_key.pub, /etc/ssh_host_dsa_key.pub, /etc/ssh_host_rsa_key.pub  .It Pa /etc/ssh/ssh_host_key.pub, /etc/ssh/ssh_host_dsa_key.pub, /etc/ssh/ssh_host_rsa_key.pub
 These three files contain the public parts of the host keys.  These three files contain the public parts of the host keys.
 These files should be world-readable but writable only by  These files should be world-readable but writable only by
 root.  root.
Line 1144 
Line 1204 
 .Pa id_rsa.pub  .Pa id_rsa.pub
 files into this file, as described in  files into this file, as described in
 .Xr ssh-keygen 1 .  .Xr ssh-keygen 1 .
 .It Pa "/etc/ssh_known_hosts" and "$HOME/.ssh/known_hosts"  .It Pa "/etc/ssh/ssh_known_hosts" and "$HOME/.ssh/known_hosts"
 These files are consulted when using rhosts with RSA host  These files are consulted when using rhosts with RSA host
 authentication or protocol version 2 hostbased authentication  authentication or protocol version 2 hostbased authentication
 to check the public key of the host.  to check the public key of the host.
Line 1152 
Line 1212 
 The client uses the same files  The client uses the same files
 to verify that it is connecting to the correct remote host.  to verify that it is connecting to the correct remote host.
 These files should be writable only by root/the owner.  These files should be writable only by root/the owner.
 .Pa /etc/ssh_known_hosts  .Pa /etc/ssh/ssh_known_hosts
 should be world-readable, and  should be world-readable, and
 .Pa $HOME/.ssh/known_hosts  .Pa $HOME/.ssh/known_hosts
 can but need not be world-readable.  can but need not be world-readable.
Line 1260 
Line 1320 
 .Ed  .Ed
 .Pp  .Pp
 If this file does not exist,  If this file does not exist,
 .Pa /etc/sshrc  .Pa /etc/ssh/sshrc
 is run, and if that  is run, and if that
 does not exist either, xauth is used to store the cookie.  does not exist either, xauth is used to store the cookie.
 .Pp  .Pp
 This file should be writable only by the user, and need not be  This file should be writable only by the user, and need not be
 readable by anyone else.  readable by anyone else.
 .It Pa /etc/sshrc  .It Pa /etc/ssh/sshrc
 Like  Like
 .Pa $HOME/.ssh/rc .  .Pa $HOME/.ssh/rc .
 This can be used to specify  This can be used to specify
Legend:
Removed from v.1.153  
changed lines
  Added in v.1.153.2.3