[BACK]Return to sshd_config.5 CVS log [TXT][DIR] Up to [local] / src / usr.bin / ssh

Diff for /src/usr.bin/ssh/sshd_config.5 between version 1.13.2.2 and 1.13.2.3

version 1.13.2.2, 2003/04/03 23:27:13 version 1.13.2.3, 2003/09/16 21:20:29
Line 61 
Line 61 
 keywords and their meanings are as follows (note that  keywords and their meanings are as follows (note that
 keywords are case-insensitive and arguments are case-sensitive):  keywords are case-insensitive and arguments are case-sensitive):
 .Bl -tag -width Ds  .Bl -tag -width Ds
 .It Cm AFSTokenPassing  
 Specifies whether an AFS token may be forwarded to the server.  
 Default is  
 .Dq no .  
 .It Cm AllowGroups  .It Cm AllowGroups
 This keyword can be followed by a list of group name patterns, separated  This keyword can be followed by a list of group name patterns, separated
 by spaces.  by spaces.
Line 72 
Line 68 
 group or supplementary group list matches one of the patterns.  group or supplementary group list matches one of the patterns.
 .Ql \&*  .Ql \&*
 and  and
 .Ql ?  .Ql \&?
 can be used as  can be used as
 wildcards in the patterns.  wildcards in the patterns.
 Only group names are valid; a numerical group ID is not recognized.  Only group names are valid; a numerical group ID is not recognized.
Line 93 
Line 89 
 match one of the patterns.  match one of the patterns.
 .Ql \&*  .Ql \&*
 and  and
 .Ql ?  .Ql \&?
 can be used as  can be used as
 wildcards in the patterns.  wildcards in the patterns.
 Only user names are valid; a numerical user ID is not recognized.  Only user names are valid; a numerical user ID is not recognized.
Line 107 
Line 103 
 for user authentication.  for user authentication.
 .Cm AuthorizedKeysFile  .Cm AuthorizedKeysFile
 may contain tokens of the form %T which are substituted during connection  may contain tokens of the form %T which are substituted during connection
 set-up. The following tokens are defined: %% is replaced by a literal '%',  set-up.
   The following tokens are defined: %% is replaced by a literal '%',
 %h is replaced by the home directory of the user being authenticated and  %h is replaced by the home directory of the user being authenticated and
 %u is replaced by the username of that user.  %u is replaced by the username of that user.
 After expansion,  After expansion,
Line 138 
Line 135 
 .Pp  .Pp
 .Bd -literal  .Bd -literal
   ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,    ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
     aes192-cbc,aes256-cbc''      aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr''
 .Ed  .Ed
 .It Cm ClientAliveInterval  .It Cm ClientAliveInterval
 Sets a timeout interval in seconds after which if no data has been received  Sets a timeout interval in seconds after which if no data has been received
Line 153 
Line 150 
 Sets the number of client alive messages (see above) which may be  Sets the number of client alive messages (see above) which may be
 sent without  sent without
 .Nm sshd  .Nm sshd
 receiving any messages back from the client. If this threshold is  receiving any messages back from the client.
 reached while client alive messages are being sent,  If this threshold is reached while client alive messages are being sent,
 .Nm sshd  .Nm sshd
 will disconnect the client, terminating the session. It is important  will disconnect the client, terminating the session.
 to note that the use of client alive messages is very different from  It is important to note that the use of client alive messages is very
   different from
 .Cm KeepAlive  .Cm KeepAlive
 (below). The client alive messages are sent through the  (below).
 encrypted channel and therefore will not be spoofable. The TCP keepalive  The client alive messages are sent through the encrypted channel
 option enabled by  and therefore will not be spoofable.
   The TCP keepalive option enabled by
 .Cm KeepAlive  .Cm KeepAlive
 is spoofable. The client alive mechanism is valuable when the client or  is spoofable.
   The client alive mechanism is valuable when the client or
 server depend on knowing when a connection has become inactive.  server depend on knowing when a connection has become inactive.
 .Pp  .Pp
 The default value is 3. If  The default value is 3.
   If
 .Cm ClientAliveInterval  .Cm ClientAliveInterval
 (above) is set to 15, and  (above) is set to 15, and
 .Cm ClientAliveCountMax  .Cm ClientAliveCountMax
Line 187 
Line 188 
 group list matches one of the patterns.  group list matches one of the patterns.
 .Ql \&*  .Ql \&*
 and  and
 .Ql ?  .Ql \&?
 can be used as  can be used as
 wildcards in the patterns.  wildcards in the patterns.
 Only group names are valid; a numerical group ID is not recognized.  Only group names are valid; a numerical group ID is not recognized.
Line 199 
Line 200 
 Login is disallowed for user names that match one of the patterns.  Login is disallowed for user names that match one of the patterns.
 .Ql \&*  .Ql \&*
 and  and
 .Ql ?  .Ql \&?
 can be used as wildcards in the patterns.  can be used as wildcards in the patterns.
 Only user names are valid; a numerical user ID is not recognized.  Only user names are valid; a numerical user ID is not recognized.
 By default, login is allowed for all users.  By default, login is allowed for all users.
Line 224 
Line 225 
 .Dq no .  .Dq no .
 The default is  The default is
 .Dq no .  .Dq no .
   .It Cm GSSAPIAuthentication
   Specifies whether user authentication based on GSSAPI is allowed.
   The default is
   .Dq no .
   Note that this option applies to protocol version 2 only.
   .It Cm GSSAPICleanupCredentials
   Specifies whether to automatically destroy the user's credentials cache
   on logout.
   The default is
   .Dq yes .
   Note that this option applies to protocol version 2 only.
 .It Cm HostbasedAuthentication  .It Cm HostbasedAuthentication
 Specifies whether rhosts or /etc/hosts.equiv authentication together  Specifies whether rhosts or /etc/hosts.equiv authentication together
 with successful public key client host authentication is allowed  with successful public key client host authentication is allowed
Line 259 
Line 271 
 and  and
 .Pa .shosts  .Pa .shosts
 files will not be used in  files will not be used in
 .Cm RhostsAuthentication ,  
 .Cm RhostsRSAAuthentication  .Cm RhostsRSAAuthentication
 or  or
 .Cm HostbasedAuthentication .  .Cm HostbasedAuthentication .
Line 303 
Line 314 
 To disable keepalives, the value should be set to  To disable keepalives, the value should be set to
 .Dq no .  .Dq no .
 .It Cm KerberosAuthentication  .It Cm KerberosAuthentication
 Specifies whether Kerberos authentication is allowed.  Specifies whether the password provided by the user for
 This can be in the form of a Kerberos ticket, or if  
 .Cm PasswordAuthentication  .Cm PasswordAuthentication
 is yes, the password provided by the user will be validated through  will be validated through the Kerberos KDC.
 the Kerberos KDC.  
 To use this option, the server needs a  To use this option, the server needs a
 Kerberos servtab which allows the verification of the KDC's identity.  Kerberos servtab which allows the verification of the KDC's identity.
 Default is  Default is
Line 319 
Line 328 
 .Pa /etc/passwd .  .Pa /etc/passwd .
 Default is  Default is
 .Dq yes .  .Dq yes .
 .It Cm KerberosTgtPassing  
 Specifies whether a Kerberos TGT may be forwarded to the server.  
 Default is  
 .Dq no ,  
 as this only works when the Kerberos KDC is actually an AFS kaserver.  
 .It Cm KerberosTicketCleanup  .It Cm KerberosTicketCleanup
 Specifies whether to automatically destroy the user's ticket cache  Specifies whether to automatically destroy the user's ticket cache
 file on logout.  file on logout.
Line 369 
Line 373 
 .Nm sshd  .Nm sshd
 will listen on the address and all prior  will listen on the address and all prior
 .Cm Port  .Cm Port
 options specified. The default is to listen on all local  options specified.
 addresses.  The default is to listen on all local addresses.
 Multiple  Multiple
 .Cm ListenAddress  .Cm ListenAddress
 options are permitted. Additionally, any  options are permitted.
   Additionally, any
 .Cm Port  .Cm Port
 options must precede this option for non port qualified addresses.  options must precede this option for non port qualified addresses.
 .It Cm LoginGraceTime  .It Cm LoginGraceTime
Line 454 
Line 459 
 .Ar command  .Ar command
 option has been specified  option has been specified
 (which may be useful for taking remote backups even if root login is  (which may be useful for taking remote backups even if root login is
 normally not allowed). All other authentication methods are disabled  normally not allowed).
 for root.  All other authentication methods are disabled for root.
 .Pp  .Pp
 If this option is set to  If this option is set to
 .Dq no  .Dq no
Line 528 
Line 533 
 The default is  The default is
 .Dq yes .  .Dq yes .
 Note that this option applies to protocol version 2 only.  Note that this option applies to protocol version 2 only.
 .It Cm RhostsAuthentication  
 Specifies whether authentication using rhosts or /etc/hosts.equiv  
 files is sufficient.  
 Normally, this method should not be permitted because it is insecure.  
 .Cm RhostsRSAAuthentication  .Cm RhostsRSAAuthentication
 should be used  should be used
 instead, because it performs RSA-based host authentication in addition  instead, because it performs RSA-based host authentication in addition
Line 579 
Line 580 
 The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2,  The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2,
 LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.  LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
 The default is AUTH.  The default is AUTH.
   .It Cm UseDNS
   Specifies whether
   .Nm sshd
   should lookup the remote host name and check that
   the resolved host name for the remote IP address maps back to the
   very same IP address.
   The default is
   .Dq yes .
 .It Cm UseLogin  .It Cm UseLogin
 Specifies whether  Specifies whether
 .Xr login 1  .Xr login 1
Line 609 
Line 618 
 escalation by containing any corruption within the unprivileged processes.  escalation by containing any corruption within the unprivileged processes.
 The default is  The default is
 .Dq yes .  .Dq yes .
 .It Cm VerifyReverseMapping  
 Specifies whether  
 .Nm sshd  
 should try to verify the remote host name and check that  
 the resolved host name for the remote IP address maps back to the  
 very same IP address.  
 The default is  
 .Dq no .  
 .It Cm X11DisplayOffset  .It Cm X11DisplayOffset
 Specifies the first display number available for  Specifies the first display number available for
 .Nm sshd Ns 's  .Nm sshd Ns 's
Line 647 
Line 648 
 forwarding (see the warnings for  forwarding (see the warnings for
 .Cm ForwardX11  .Cm ForwardX11
 in  in
 .Xr ssh_config 5 ).  .Xr ssh_config 5 ) .
 A system administrator may have a stance in which they want to  A system administrator may have a stance in which they want to
 protect clients that may expose themselves to attack by unwittingly  protect clients that may expose themselves to attack by unwittingly
 requesting X11 forwarding, which can warrant a  requesting X11 forwarding, which can warrant a
Line 693 
Line 694 
 .Pa /usr/X11R6/bin/xauth .  .Pa /usr/X11R6/bin/xauth .
 .El  .El
 .Ss Time Formats  .Ss Time Formats
 .Pp  
 .Nm sshd  .Nm sshd
 command-line arguments and configuration file options that specify time  command-line arguments and configuration file options that specify time
 may be expressed using a sequence of the form:  may be expressed using a sequence of the form:
Line 742 
Line 742 
 This file should be writable by root only, but it is recommended  This file should be writable by root only, but it is recommended
 (though not necessary) that it be world-readable.  (though not necessary) that it be world-readable.
 .El  .El
   .Sh SEE ALSO
   .Xr sshd 8
 .Sh AUTHORS  .Sh AUTHORS
 OpenSSH is a derivative of the original and free  OpenSSH is a derivative of the original and free
 ssh 1.2.12 release by Tatu Ylonen.  ssh 1.2.12 release by Tatu Ylonen.
Line 753 
Line 755 
 protocol versions 1.5 and 2.0.  protocol versions 1.5 and 2.0.
 Niels Provos and Markus Friedl contributed support  Niels Provos and Markus Friedl contributed support
 for privilege separation.  for privilege separation.
 .Sh SEE ALSO  
 .Xr sshd 8  
Legend:
Removed from v.1.13.2.2  
changed lines
  Added in v.1.13.2.3