[BACK]Return to sshd_config.5 CVS log [TXT][DIR] Up to [local] / src / usr.bin / ssh

Diff for /src/usr.bin/ssh/sshd_config.5 between version 1.13.2.3 and 1.14

version 1.13.2.3, 2003/09/16 21:20:29 version 1.14, 2003/01/23 08:58:47
Line 61 
Line 61 
 keywords and their meanings are as follows (note that  keywords and their meanings are as follows (note that
 keywords are case-insensitive and arguments are case-sensitive):  keywords are case-insensitive and arguments are case-sensitive):
 .Bl -tag -width Ds  .Bl -tag -width Ds
   .It Cm AFSTokenPassing
   Specifies whether an AFS token may be forwarded to the server.
   Default is
   .Dq no .
 .It Cm AllowGroups  .It Cm AllowGroups
 This keyword can be followed by a list of group name patterns, separated  This keyword can be followed by a list of group name patterns, separated
 by spaces.  by spaces.
Line 68 
Line 72 
 group or supplementary group list matches one of the patterns.  group or supplementary group list matches one of the patterns.
 .Ql \&*  .Ql \&*
 and  and
 .Ql \&?  .Ql ?
 can be used as  can be used as
 wildcards in the patterns.  wildcards in the patterns.
 Only group names are valid; a numerical group ID is not recognized.  Only group names are valid; a numerical group ID is not recognized.
Line 89 
Line 93 
 match one of the patterns.  match one of the patterns.
 .Ql \&*  .Ql \&*
 and  and
 .Ql \&?  .Ql ?
 can be used as  can be used as
 wildcards in the patterns.  wildcards in the patterns.
 Only user names are valid; a numerical user ID is not recognized.  Only user names are valid; a numerical user ID is not recognized.
Line 103 
Line 107 
 for user authentication.  for user authentication.
 .Cm AuthorizedKeysFile  .Cm AuthorizedKeysFile
 may contain tokens of the form %T which are substituted during connection  may contain tokens of the form %T which are substituted during connection
 set-up.  set-up. The following tokens are defined: %% is replaced by a literal '%',
 The following tokens are defined: %% is replaced by a literal '%',  
 %h is replaced by the home directory of the user being authenticated and  %h is replaced by the home directory of the user being authenticated and
 %u is replaced by the username of that user.  %u is replaced by the username of that user.
 After expansion,  After expansion,
Line 135 
Line 138 
 .Pp  .Pp
 .Bd -literal  .Bd -literal
   ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,    ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
     aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr''      aes192-cbc,aes256-cbc''
 .Ed  .Ed
 .It Cm ClientAliveInterval  .It Cm ClientAliveInterval
 Sets a timeout interval in seconds after which if no data has been received  Sets a timeout interval in seconds after which if no data has been received
Line 150 
Line 153 
 Sets the number of client alive messages (see above) which may be  Sets the number of client alive messages (see above) which may be
 sent without  sent without
 .Nm sshd  .Nm sshd
 receiving any messages back from the client.  receiving any messages back from the client. If this threshold is
 If this threshold is reached while client alive messages are being sent,  reached while client alive messages are being sent,
 .Nm sshd  .Nm sshd
 will disconnect the client, terminating the session.  will disconnect the client, terminating the session. It is important
 It is important to note that the use of client alive messages is very  to note that the use of client alive messages is very different from
 different from  
 .Cm KeepAlive  .Cm KeepAlive
 (below).  (below). The client alive messages are sent through the
 The client alive messages are sent through the encrypted channel  encrypted channel and therefore will not be spoofable. The TCP keepalive
 and therefore will not be spoofable.  option enabled by
 The TCP keepalive option enabled by  
 .Cm KeepAlive  .Cm KeepAlive
 is spoofable.  is spoofable. The client alive mechanism is valuable when the client or
 The client alive mechanism is valuable when the client or  
 server depend on knowing when a connection has become inactive.  server depend on knowing when a connection has become inactive.
 .Pp  .Pp
 The default value is 3.  The default value is 3. If
 If  
 .Cm ClientAliveInterval  .Cm ClientAliveInterval
 (above) is set to 15, and  (above) is set to 15, and
 .Cm ClientAliveCountMax  .Cm ClientAliveCountMax
Line 188 
Line 187 
 group list matches one of the patterns.  group list matches one of the patterns.
 .Ql \&*  .Ql \&*
 and  and
 .Ql \&?  .Ql ?
 can be used as  can be used as
 wildcards in the patterns.  wildcards in the patterns.
 Only group names are valid; a numerical group ID is not recognized.  Only group names are valid; a numerical group ID is not recognized.
Line 200 
Line 199 
 Login is disallowed for user names that match one of the patterns.  Login is disallowed for user names that match one of the patterns.
 .Ql \&*  .Ql \&*
 and  and
 .Ql \&?  .Ql ?
 can be used as wildcards in the patterns.  can be used as wildcards in the patterns.
 Only user names are valid; a numerical user ID is not recognized.  Only user names are valid; a numerical user ID is not recognized.
 By default, login is allowed for all users.  By default, login is allowed for all users.
Line 212 
Line 211 
 forwarded for the client.  forwarded for the client.
 By default,  By default,
 .Nm sshd  .Nm sshd
 binds remote port forwardings to the loopback address.  binds remote port forwardings to the loopback address.  This
 This prevents other remote hosts from connecting to forwarded ports.  prevents other remote hosts from connecting to forwarded ports.
 .Cm GatewayPorts  .Cm GatewayPorts
 can be used to specify that  can be used to specify that
 .Nm sshd  .Nm sshd
Line 225 
Line 224 
 .Dq no .  .Dq no .
 The default is  The default is
 .Dq no .  .Dq no .
 .It Cm GSSAPIAuthentication  
 Specifies whether user authentication based on GSSAPI is allowed.  
 The default is  
 .Dq no .  
 Note that this option applies to protocol version 2 only.  
 .It Cm GSSAPICleanupCredentials  
 Specifies whether to automatically destroy the user's credentials cache  
 on logout.  
 The default is  
 .Dq yes .  
 Note that this option applies to protocol version 2 only.  
 .It Cm HostbasedAuthentication  .It Cm HostbasedAuthentication
 Specifies whether rhosts or /etc/hosts.equiv authentication together  Specifies whether rhosts or /etc/hosts.equiv authentication together
 with successful public key client host authentication is allowed  with successful public key client host authentication is allowed
Line 271 
Line 259 
 and  and
 .Pa .shosts  .Pa .shosts
 files will not be used in  files will not be used in
   .Cm RhostsAuthentication ,
 .Cm RhostsRSAAuthentication  .Cm RhostsRSAAuthentication
 or  or
 .Cm HostbasedAuthentication .  .Cm HostbasedAuthentication .
Line 314 
Line 303 
 To disable keepalives, the value should be set to  To disable keepalives, the value should be set to
 .Dq no .  .Dq no .
 .It Cm KerberosAuthentication  .It Cm KerberosAuthentication
 Specifies whether the password provided by the user for  Specifies whether Kerberos authentication is allowed.
   This can be in the form of a Kerberos ticket, or if
 .Cm PasswordAuthentication  .Cm PasswordAuthentication
 will be validated through the Kerberos KDC.  is yes, the password provided by the user will be validated through
   the Kerberos KDC.
 To use this option, the server needs a  To use this option, the server needs a
 Kerberos servtab which allows the verification of the KDC's identity.  Kerberos servtab which allows the verification of the KDC's identity.
 Default is  Default is
Line 328 
Line 319 
 .Pa /etc/passwd .  .Pa /etc/passwd .
 Default is  Default is
 .Dq yes .  .Dq yes .
   .It Cm KerberosTgtPassing
   Specifies whether a Kerberos TGT may be forwarded to the server.
   Default is
   .Dq no ,
   as this only works when the Kerberos KDC is actually an AFS kaserver.
 .It Cm KerberosTicketCleanup  .It Cm KerberosTicketCleanup
 Specifies whether to automatically destroy the user's ticket cache  Specifies whether to automatically destroy the user's ticket cache
 file on logout.  file on logout.
Line 373 
Line 369 
 .Nm sshd  .Nm sshd
 will listen on the address and all prior  will listen on the address and all prior
 .Cm Port  .Cm Port
 options specified.  options specified. The default is to listen on all local
 The default is to listen on all local addresses.  addresses.  Multiple
 Multiple  
 .Cm ListenAddress  .Cm ListenAddress
 options are permitted.  options are permitted. Additionally, any
 Additionally, any  
 .Cm Port  .Cm Port
 options must precede this option for non port qualified addresses.  options must precede this option for non port qualified addresses.
 .It Cm LoginGraceTime  .It Cm LoginGraceTime
Line 391 
Line 385 
 .Nm sshd .  .Nm sshd .
 The possible values are:  The possible values are:
 QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3.  QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3.
 The default is INFO.  The default is INFO.  DEBUG and DEBUG1 are equivalent.  DEBUG2
 DEBUG and DEBUG1 are equivalent.  and DEBUG3 each specify higher levels of debugging output.
 DEBUG2 and DEBUG3 each specify higher levels of debugging output.  Logging with a DEBUG level violates the privacy of users
 Logging with a DEBUG level violates the privacy of users and is not recommended.  and is not recommended.
 .It Cm MACs  .It Cm MACs
 Specifies the available MAC (message authentication code) algorithms.  Specifies the available MAC (message authentication code) algorithms.
 The MAC algorithm is used in protocol version 2  The MAC algorithm is used in protocol version 2
Line 459 
Line 453 
 .Ar command  .Ar command
 option has been specified  option has been specified
 (which may be useful for taking remote backups even if root login is  (which may be useful for taking remote backups even if root login is
 normally not allowed).  normally not allowed). All other authentication methods are disabled
 All other authentication methods are disabled for root.  for root.
 .Pp  .Pp
 If this option is set to  If this option is set to
 .Dq no  .Dq no
Line 533 
Line 527 
 The default is  The default is
 .Dq yes .  .Dq yes .
 Note that this option applies to protocol version 2 only.  Note that this option applies to protocol version 2 only.
   .It Cm RhostsAuthentication
   Specifies whether authentication using rhosts or /etc/hosts.equiv
   files is sufficient.
   Normally, this method should not be permitted because it is insecure.
 .Cm RhostsRSAAuthentication  .Cm RhostsRSAAuthentication
 should be used  should be used
 instead, because it performs RSA-based host authentication in addition  instead, because it performs RSA-based host authentication in addition
Line 580 
Line 578 
 The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2,  The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2,
 LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.  LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
 The default is AUTH.  The default is AUTH.
 .It Cm UseDNS  
 Specifies whether  
 .Nm sshd  
 should lookup the remote host name and check that  
 the resolved host name for the remote IP address maps back to the  
 very same IP address.  
 The default is  
 .Dq yes .  
 .It Cm UseLogin  .It Cm UseLogin
 Specifies whether  Specifies whether
 .Xr login 1  .Xr login 1
Line 603 
Line 593 
 .Xr login 1  .Xr login 1
 does not know how to handle  does not know how to handle
 .Xr xauth 1  .Xr xauth 1
 cookies.  cookies.  If
 If  
 .Cm UsePrivilegeSeparation  .Cm UsePrivilegeSeparation
 is specified, it will be disabled after authentication.  is specified, it will be disabled after authentication.
 .It Cm UsePrivilegeSeparation  .It Cm UsePrivilegeSeparation
 Specifies whether  Specifies whether
 .Nm sshd  .Nm sshd
 separates privileges by creating an unprivileged child process  separates privileges by creating an unprivileged child process
 to deal with incoming network traffic.  to deal with incoming network traffic.  After successful authentication,
 After successful authentication, another process will be created that has  another process will be created that has the privilege of the authenticated
 the privilege of the authenticated user.  user.  The goal of privilege separation is to prevent privilege
 The goal of privilege separation is to prevent privilege  
 escalation by containing any corruption within the unprivileged processes.  escalation by containing any corruption within the unprivileged processes.
 The default is  The default is
 .Dq yes .  .Dq yes .
   .It Cm VerifyReverseMapping
   Specifies whether
   .Nm sshd
   should try to verify the remote host name and check that
   the resolved host name for the remote IP address maps back to the
   very same IP address.
   The default is
   .Dq no .
 .It Cm X11DisplayOffset  .It Cm X11DisplayOffset
 Specifies the first display number available for  Specifies the first display number available for
 .Nm sshd Ns 's  .Nm sshd Ns 's
Line 648 
Line 644 
 forwarding (see the warnings for  forwarding (see the warnings for
 .Cm ForwardX11  .Cm ForwardX11
 in  in
 .Xr ssh_config 5 ) .  .Xr ssh_config 5 ).
 A system administrator may have a stance in which they want to  A system administrator may have a stance in which they want to
 protect clients that may expose themselves to attack by unwittingly  protect clients that may expose themselves to attack by unwittingly
 requesting X11 forwarding, which can warrant a  requesting X11 forwarding, which can warrant a
Line 664 
Line 660 
 Specifies whether  Specifies whether
 .Nm sshd  .Nm sshd
 should bind the X11 forwarding server to the loopback address or to  should bind the X11 forwarding server to the loopback address or to
 the wildcard address.  the wildcard address.  By default,
 By default,  
 .Nm sshd  .Nm sshd
 binds the forwarding server to the loopback address and sets the  binds the forwarding server to the loopback address and sets the
 hostname part of the  hostname part of the
Line 694 
Line 689 
 .Pa /usr/X11R6/bin/xauth .  .Pa /usr/X11R6/bin/xauth .
 .El  .El
 .Ss Time Formats  .Ss Time Formats
   .Pp
 .Nm sshd  .Nm sshd
 command-line arguments and configuration file options that specify time  command-line arguments and configuration file options that specify time
 may be expressed using a sequence of the form:  may be expressed using a sequence of the form:
Line 742 
Line 738 
 This file should be writable by root only, but it is recommended  This file should be writable by root only, but it is recommended
 (though not necessary) that it be world-readable.  (though not necessary) that it be world-readable.
 .El  .El
 .Sh SEE ALSO  
 .Xr sshd 8  
 .Sh AUTHORS  .Sh AUTHORS
 OpenSSH is a derivative of the original and free  OpenSSH is a derivative of the original and free
 ssh 1.2.12 release by Tatu Ylonen.  ssh 1.2.12 release by Tatu Ylonen.
Line 755 
Line 749 
 protocol versions 1.5 and 2.0.  protocol versions 1.5 and 2.0.
 Niels Provos and Markus Friedl contributed support  Niels Provos and Markus Friedl contributed support
 for privilege separation.  for privilege separation.
   .Sh SEE ALSO
   .Xr sshd 8
Legend:
Removed from v.1.13.2.3  
changed lines
  Added in v.1.14