version 1.14.2.1, 2003/05/11 12:01:52 |
version 1.14.2.2, 2003/09/16 20:50:44 |
|
|
keywords and their meanings are as follows (note that |
keywords and their meanings are as follows (note that |
keywords are case-insensitive and arguments are case-sensitive): |
keywords are case-insensitive and arguments are case-sensitive): |
.Bl -tag -width Ds |
.Bl -tag -width Ds |
.It Cm AFSTokenPassing |
|
Specifies whether an AFS token may be forwarded to the server. |
|
Default is |
|
.Dq no . |
|
.It Cm AllowGroups |
.It Cm AllowGroups |
This keyword can be followed by a list of group name patterns, separated |
This keyword can be followed by a list of group name patterns, separated |
by spaces. |
by spaces. |
|
|
group or supplementary group list matches one of the patterns. |
group or supplementary group list matches one of the patterns. |
.Ql \&* |
.Ql \&* |
and |
and |
.Ql ? |
.Ql \&? |
can be used as |
can be used as |
wildcards in the patterns. |
wildcards in the patterns. |
Only group names are valid; a numerical group ID is not recognized. |
Only group names are valid; a numerical group ID is not recognized. |
|
|
match one of the patterns. |
match one of the patterns. |
.Ql \&* |
.Ql \&* |
and |
and |
.Ql ? |
.Ql \&? |
can be used as |
can be used as |
wildcards in the patterns. |
wildcards in the patterns. |
Only user names are valid; a numerical user ID is not recognized. |
Only user names are valid; a numerical user ID is not recognized. |
|
|
for user authentication. |
for user authentication. |
.Cm AuthorizedKeysFile |
.Cm AuthorizedKeysFile |
may contain tokens of the form %T which are substituted during connection |
may contain tokens of the form %T which are substituted during connection |
set-up. The following tokens are defined: %% is replaced by a literal '%', |
set-up. |
|
The following tokens are defined: %% is replaced by a literal '%', |
%h is replaced by the home directory of the user being authenticated and |
%h is replaced by the home directory of the user being authenticated and |
%u is replaced by the username of that user. |
%u is replaced by the username of that user. |
After expansion, |
After expansion, |
|
|
.Pp |
.Pp |
.Bd -literal |
.Bd -literal |
``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour, |
``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour, |
aes192-cbc,aes256-cbc'' |
aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr'' |
.Ed |
.Ed |
.It Cm ClientAliveInterval |
.It Cm ClientAliveInterval |
Sets a timeout interval in seconds after which if no data has been received |
Sets a timeout interval in seconds after which if no data has been received |
|
|
Sets the number of client alive messages (see above) which may be |
Sets the number of client alive messages (see above) which may be |
sent without |
sent without |
.Nm sshd |
.Nm sshd |
receiving any messages back from the client. If this threshold is |
receiving any messages back from the client. |
reached while client alive messages are being sent, |
If this threshold is reached while client alive messages are being sent, |
.Nm sshd |
.Nm sshd |
will disconnect the client, terminating the session. It is important |
will disconnect the client, terminating the session. |
to note that the use of client alive messages is very different from |
It is important to note that the use of client alive messages is very |
|
different from |
.Cm KeepAlive |
.Cm KeepAlive |
(below). The client alive messages are sent through the |
(below). |
encrypted channel and therefore will not be spoofable. The TCP keepalive |
The client alive messages are sent through the encrypted channel |
option enabled by |
and therefore will not be spoofable. |
|
The TCP keepalive option enabled by |
.Cm KeepAlive |
.Cm KeepAlive |
is spoofable. The client alive mechanism is valuable when the client or |
is spoofable. |
|
The client alive mechanism is valuable when the client or |
server depend on knowing when a connection has become inactive. |
server depend on knowing when a connection has become inactive. |
.Pp |
.Pp |
The default value is 3. If |
The default value is 3. |
|
If |
.Cm ClientAliveInterval |
.Cm ClientAliveInterval |
(above) is set to 15, and |
(above) is set to 15, and |
.Cm ClientAliveCountMax |
.Cm ClientAliveCountMax |
|
|
group list matches one of the patterns. |
group list matches one of the patterns. |
.Ql \&* |
.Ql \&* |
and |
and |
.Ql ? |
.Ql \&? |
can be used as |
can be used as |
wildcards in the patterns. |
wildcards in the patterns. |
Only group names are valid; a numerical group ID is not recognized. |
Only group names are valid; a numerical group ID is not recognized. |
|
|
Login is disallowed for user names that match one of the patterns. |
Login is disallowed for user names that match one of the patterns. |
.Ql \&* |
.Ql \&* |
and |
and |
.Ql ? |
.Ql \&? |
can be used as wildcards in the patterns. |
can be used as wildcards in the patterns. |
Only user names are valid; a numerical user ID is not recognized. |
Only user names are valid; a numerical user ID is not recognized. |
By default, login is allowed for all users. |
By default, login is allowed for all users. |
|
|
.Dq no . |
.Dq no . |
The default is |
The default is |
.Dq no . |
.Dq no . |
|
.It Cm GSSAPIAuthentication |
|
Specifies whether user authentication based on GSSAPI is allowed. |
|
The default is |
|
.Dq no . |
|
Note that this option applies to protocol version 2 only. |
|
.It Cm GSSAPICleanupCredentials |
|
Specifies whether to automatically destroy the user's credentials cache |
|
on logout. |
|
The default is |
|
.Dq yes . |
|
Note that this option applies to protocol version 2 only. |
.It Cm HostbasedAuthentication |
.It Cm HostbasedAuthentication |
Specifies whether rhosts or /etc/hosts.equiv authentication together |
Specifies whether rhosts or /etc/hosts.equiv authentication together |
with successful public key client host authentication is allowed |
with successful public key client host authentication is allowed |
|
|
and |
and |
.Pa .shosts |
.Pa .shosts |
files will not be used in |
files will not be used in |
.Cm RhostsAuthentication , |
|
.Cm RhostsRSAAuthentication |
.Cm RhostsRSAAuthentication |
or |
or |
.Cm HostbasedAuthentication . |
.Cm HostbasedAuthentication . |
|
|
To disable keepalives, the value should be set to |
To disable keepalives, the value should be set to |
.Dq no . |
.Dq no . |
.It Cm KerberosAuthentication |
.It Cm KerberosAuthentication |
Specifies whether Kerberos authentication is allowed. |
Specifies whether the password provided by the user for |
This can be in the form of a Kerberos ticket, or if |
|
.Cm PasswordAuthentication |
.Cm PasswordAuthentication |
is yes, the password provided by the user will be validated through |
will be validated through the Kerberos KDC. |
the Kerberos KDC. |
|
To use this option, the server needs a |
To use this option, the server needs a |
Kerberos servtab which allows the verification of the KDC's identity. |
Kerberos servtab which allows the verification of the KDC's identity. |
Default is |
Default is |
|
|
.Pa /etc/passwd . |
.Pa /etc/passwd . |
Default is |
Default is |
.Dq yes . |
.Dq yes . |
.It Cm KerberosTgtPassing |
|
Specifies whether a Kerberos TGT may be forwarded to the server. |
|
Default is |
|
.Dq no , |
|
as this only works when the Kerberos KDC is actually an AFS kaserver. |
|
.It Cm KerberosTicketCleanup |
.It Cm KerberosTicketCleanup |
Specifies whether to automatically destroy the user's ticket cache |
Specifies whether to automatically destroy the user's ticket cache |
file on logout. |
file on logout. |
|
|
.Nm sshd |
.Nm sshd |
will listen on the address and all prior |
will listen on the address and all prior |
.Cm Port |
.Cm Port |
options specified. The default is to listen on all local |
options specified. |
addresses. |
The default is to listen on all local addresses. |
Multiple |
Multiple |
.Cm ListenAddress |
.Cm ListenAddress |
options are permitted. Additionally, any |
options are permitted. |
|
Additionally, any |
.Cm Port |
.Cm Port |
options must precede this option for non port qualified addresses. |
options must precede this option for non port qualified addresses. |
.It Cm LoginGraceTime |
.It Cm LoginGraceTime |
|
|
.Ar command |
.Ar command |
option has been specified |
option has been specified |
(which may be useful for taking remote backups even if root login is |
(which may be useful for taking remote backups even if root login is |
normally not allowed). All other authentication methods are disabled |
normally not allowed). |
for root. |
All other authentication methods are disabled for root. |
.Pp |
.Pp |
If this option is set to |
If this option is set to |
.Dq no |
.Dq no |
|
|
The default is |
The default is |
.Dq yes . |
.Dq yes . |
Note that this option applies to protocol version 2 only. |
Note that this option applies to protocol version 2 only. |
.It Cm RhostsAuthentication |
|
Specifies whether authentication using rhosts or /etc/hosts.equiv |
|
files is sufficient. |
|
Normally, this method should not be permitted because it is insecure. |
|
.Cm RhostsRSAAuthentication |
.Cm RhostsRSAAuthentication |
should be used |
should be used |
instead, because it performs RSA-based host authentication in addition |
instead, because it performs RSA-based host authentication in addition |
|
|
The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2, |
The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2, |
LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. |
LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. |
The default is AUTH. |
The default is AUTH. |
|
.It Cm UseDNS |
|
Specifies whether |
|
.Nm sshd |
|
should lookup the remote host name and check that |
|
the resolved host name for the remote IP address maps back to the |
|
very same IP address. |
|
The default is |
|
.Dq yes . |
.It Cm UseLogin |
.It Cm UseLogin |
Specifies whether |
Specifies whether |
.Xr login 1 |
.Xr login 1 |
|
|
escalation by containing any corruption within the unprivileged processes. |
escalation by containing any corruption within the unprivileged processes. |
The default is |
The default is |
.Dq yes . |
.Dq yes . |
.It Cm VerifyReverseMapping |
|
Specifies whether |
|
.Nm sshd |
|
should try to verify the remote host name and check that |
|
the resolved host name for the remote IP address maps back to the |
|
very same IP address. |
|
The default is |
|
.Dq no . |
|
.It Cm X11DisplayOffset |
.It Cm X11DisplayOffset |
Specifies the first display number available for |
Specifies the first display number available for |
.Nm sshd Ns 's |
.Nm sshd Ns 's |
|
|
forwarding (see the warnings for |
forwarding (see the warnings for |
.Cm ForwardX11 |
.Cm ForwardX11 |
in |
in |
.Xr ssh_config 5 ). |
.Xr ssh_config 5 ) . |
A system administrator may have a stance in which they want to |
A system administrator may have a stance in which they want to |
protect clients that may expose themselves to attack by unwittingly |
protect clients that may expose themselves to attack by unwittingly |
requesting X11 forwarding, which can warrant a |
requesting X11 forwarding, which can warrant a |
|
|
.Pa /usr/X11R6/bin/xauth . |
.Pa /usr/X11R6/bin/xauth . |
.El |
.El |
.Ss Time Formats |
.Ss Time Formats |
.Pp |
|
.Nm sshd |
.Nm sshd |
command-line arguments and configuration file options that specify time |
command-line arguments and configuration file options that specify time |
may be expressed using a sequence of the form: |
may be expressed using a sequence of the form: |
|
|
This file should be writable by root only, but it is recommended |
This file should be writable by root only, but it is recommended |
(though not necessary) that it be world-readable. |
(though not necessary) that it be world-readable. |
.El |
.El |
|
.Sh SEE ALSO |
|
.Xr sshd 8 |
.Sh AUTHORS |
.Sh AUTHORS |
OpenSSH is a derivative of the original and free |
OpenSSH is a derivative of the original and free |
ssh 1.2.12 release by Tatu Ylonen. |
ssh 1.2.12 release by Tatu Ylonen. |
|
|
protocol versions 1.5 and 2.0. |
protocol versions 1.5 and 2.0. |
Niels Provos and Markus Friedl contributed support |
Niels Provos and Markus Friedl contributed support |
for privilege separation. |
for privilege separation. |
.Sh SEE ALSO |
|
.Xr sshd 8 |
|