src/usr.bin/ssh/sshd_config.5 - diff

Return to sshd_config.5 CVS log

Up to [local] / src / usr.bin / ssh

Diff for /src/usr.bin/ssh/sshd_config.5 between version 1.236 and 1.237

version 1.236, 2016/09/28 20:32:42

version 1.237, 2016/10/07 14:41:52

Line 90

Specifies which address family should be used by

.Xr sshd 8 .

Valid arguments are

.Dq any ,

.Cm any

.Dq inet

(the default),

.Cm inet

(use IPv4 only), or

.Dq inet6

.Cm inet6

(use IPv6 only).

The default is

.Dq any .

.It Cm AllowAgentForwarding

Specifies whether

.Xr ssh-agent 1

forwarding is permitted.

The default is

.Dq yes .

.Cm yes .

Note that disabling agent forwarding does not improve security

unless users are also denied shell access, as they can always install

their own forwarders.

Line 126

Line 125

.It Cm AllowStreamLocalForwarding

Specifies whether StreamLocal (Unix-domain socket) forwarding is permitted.

The available options are

.Dq yes

.Cm yes

(the default)

.Dq all

.Cm all

to allow StreamLocal forwarding,

.Dq no

.Cm no

to prevent all StreamLocal forwarding,

.Dq local

.Cm local

to allow local (from the perspective of

.Xr ssh 1 )

forwarding only or

.Dq remote

.Cm remote

to allow remote forwarding only.

The default is

.Dq yes .

Note that disabling StreamLocal forwarding does not improve security unless

users are also denied shell access, as they can always install their

own forwarders.

.It Cm AllowTcpForwarding

Specifies whether TCP forwarding is permitted.

The available options are

.Dq yes

.Cm yes

(the default)

.Dq all

.Cm all

to allow TCP forwarding,

.Dq no

.Cm no

to prevent all TCP forwarding,

.Dq local

.Cm local

to allow local (from the perspective of

.Xr ssh 1 )

forwarding only or

.Dq remote

.Cm remote

to allow remote forwarding only.

The default is

.Dq yes .

Note that disabling TCP forwarding does not improve security unless

users are also denied shell access, as they can always install their

own forwarders.

Line 190

Line 187

for a user to be granted access.

This option must be followed by one or more comma-separated lists of

authentication method names, or by the single string

.Dq any

.Cm any

to indicate the default behaviour of accepting any single authentication

method.

if the default is overridden, then successful authentication requires

If the default is overridden, then successful authentication requires

completion of every method in at least one of these lists.

.Pp

For example, an argument of

For example,

.Dq publickey,password publickey,keyboard-interactive

.Qq publickey,password publickey,keyboard-interactive

would require the user to complete public key authentication, followed by

either password or keyboard interactive authentication.

Only methods that are next in one or more lists are offered at each stage,

so for this example, it would not be possible to attempt password or

so for this example it would not be possible to attempt password or

keyboard-interactive authentication before public key.

.Pp

For keyboard interactive authentication it is also possible to

restrict authentication to a specific device by appending a

colon followed by the device identifier

.Dq bsdauth ,

.Cm bsdauth ,

.Dq pam ,

.Cm pam ,

.Dq skey ,

.Cm skey ,

depending on the server configuration.

For example,

.Dq keyboard-interactive:bsdauth

.Qq keyboard-interactive:bsdauth

would restrict keyboard interactive authentication to the

.Dq bsdauth

.Cm bsdauth

device.

.Pp

If the

If the publickey method is listed more than once,

.Dq publickey

method is listed more than once,

.Xr sshd 8

verifies that keys that have been used successfully are not reused for

subsequent authentications.

For example, an

For example,

.Cm AuthenticationMethods

.Qq publickey,publickey

requires successful authentication using two different public keys.

.Dq publickey,publickey

will require successful authentication using two different public keys.

.Pp

Note that each authentication method listed should also be explicitly enabled

in the configuration.

The default

.Dq any

is not to require multiple authentication; successful completion

of a single authentication method is sufficient.

.It Cm AuthorizedKeysCommand

Specifies a program to be used to look up the user's public keys.

The program must be owned by root, not writable by group or others and

Line 258

Line 247

and authorize the user then public key authentication continues using the usual

.Cm AuthorizedKeysFile

files.

By default, no AuthorizedKeysCommand is run.

By default, no

.Cm AuthorizedKeysCommand

is run.

.It Cm AuthorizedKeysCommandUser

Specifies the user under whose account the AuthorizedKeysCommand is run.

Specifies the user under whose account the

.Cm AuthorizedKeysCommand

is run.

It is recommended to use a dedicated user that has no other role on the host

than running authorized keys commands.

Line 287

Line 280

directory.

Multiple files may be listed, separated by whitespace.

Alternately this option may be set to

.Dq none

.Cm none

to skip checking for user keys in files.

The default is

.Dq .ssh/authorized_keys .ssh/authorized_keys2 .

.Qq .ssh/authorized_keys .ssh/authorized_keys2 .

.It Cm AuthorizedPrincipalsCommand

Specifies a program to be used to generate the list of allowed

certificate principals as per

Line 354

Line 347

.Cm AuthorizedPrincipalsFile

is taken to be an absolute path or one relative to the user's home directory.

The default is

.Dq none ,

.Cm none ,

i.e. not to use a principals file \(en in this case, the username

of the user must appear in a certificate's principals list for it to be

accepted.

Line 374

Line 367

The contents of the specified file are sent to the remote user before

authentication is allowed.

If the argument is

.Dq none

.Cm none

then no banner is displayed.

By default, no banner is displayed.

.It Cm ChallengeResponseAuthentication

Line 383

Line 376

.Xr login.conf 5

are supported.

The default is

.Dq yes .

.Cm yes .

.It Cm ChrootDirectory

Specifies the pathname of a directory to

.Xr chroot 2

Line 418

Line 411

and

.Xr tty 4

devices.

For file transfer sessions using

For file transfer sessions using SFTP

.Dq sftp ,

no additional configuration of the environment is necessary if the in-process

no additional configuration of the environment is necessary if the

sftp-server is used,

in-process sftp server is used,

though sessions which use logging may require

.Pa /dev/log

inside the chroot directory on some operating systems (see

Line 436

Line 428

cannot detect.

.Pp

The default is

.Dq none ,

.Cm none ,

indicating not to

.Xr chroot 2 .

.It Cm Ciphers

Line 489

Line 481

aes128-gcm@openssh.com,aes256-gcm@openssh.com

.Ed

.Pp

The list of available ciphers may also be obtained using the

The list of available ciphers may also be obtained using

.Fl Q

.Qq ssh -Q cipher .

option of

.Xr ssh 1

with an argument of

.Dq cipher .

.It Cm ClientAliveCountMax

Sets the number of client alive messages (see below) which may be

Sets the number of client alive messages which may be sent without

sent without

.Xr sshd 8

receiving any messages back from the client.

If this threshold is reached while client alive messages are being sent,

sshd will disconnect the client, terminating the session.

It is important to note that the use of client alive messages is very

different from

.Cm TCPKeepAlive

.Cm TCPKeepAlive .

(below).

The client alive messages are sent through the encrypted channel

and therefore will not be spoofable.

The TCP keepalive option enabled by

Line 517

Line 503

The default value is 3.

.Cm ClientAliveInterval

(see below) is set to 15, and

is set to 15, and

.Cm ClientAliveCountMax

is left at the default, unresponsive SSH clients

will be disconnected after approximately 45 seconds.

Line 533

Line 519

Specifies whether compression is enabled after

the user has authenticated successfully.

The argument must be

.Dq yes ,

.Cm yes ,

.Dq delayed

.Cm delayed

(a legacy synonym for

.Dq yes )

.Cm yes )

.Dq no .

.Cm no .

The default is

.Dq yes .

.Cm yes .

.It Cm DenyGroups

This keyword can be followed by a list of group name patterns, separated

by spaces.

Line 582

Line 568

.It Cm FingerprintHash

Specifies the hash algorithm used when logging key fingerprints.

Valid options are:

.Dq md5

.Cm md5

and

.Dq sha256 .

.Cm sha256 .

The default is

.Dq sha256 .

.Cm sha256 .

.It Cm ForceCommand

Forces the execution of the command specified by

.Cm ForceCommand ,

Line 602

Line 588

.Ev SSH_ORIGINAL_COMMAND

environment variable.

Specifying a command of

.Dq internal-sftp

.Cm internal-sftp

will force the use of an in-process sftp server that requires no support

will force the use of an in-process SFTP server that requires no support

files when used with

.Cm ChrootDirectory .

The default is

.Dq none .

.Cm none .

.It Cm GatewayPorts

Specifies whether remote hosts are allowed to connect to ports

forwarded for the client.

Line 620

Line 606

should allow remote port forwardings to bind to non-loopback addresses, thus

allowing other hosts to connect.

The argument may be

.Dq no

.Cm no

to force remote port forwardings to be available to the local host only,

.Dq yes

.Cm yes

to force remote port forwardings to bind to the wildcard address, or

.Dq clientspecified

.Cm clientspecified

to allow the client to select the address to which the forwarding is bound.

The default is

.Dq no .

.Cm no .

.It Cm GSSAPIAuthentication

Specifies whether user authentication based on GSSAPI is allowed.

The default is

.Dq no .

.Cm no .

.It Cm GSSAPICleanupCredentials

Specifies whether to automatically destroy the user's credentials cache

on logout.

The default is

.Dq yes .

.Cm yes .

.It Cm GSSAPIStrictAcceptorCheck

Determines whether to be strict about the identity of the GSSAPI acceptor

a client authenticates against.

If set to

.Dq yes

.Cm yes

then the client must authenticate against the

then the client must authenticate against the host

.Pa host

service on the current hostname.

If set to

.Dq no

.Cm no

then the client may authenticate against any service key stored in the

machine's default store.

This facility is provided to assist with operation on multi homed machines.

The default is

.Dq yes .

.Cm yes .

.It Cm HostbasedAcceptedKeyTypes

Specifies the key types that will be accepted for hostbased authentication

as a comma-separated pattern list.

Line 670

Line 655

ssh-ed25519,ssh-rsa

.Ed

.Pp

The

The list of available key types may also be obtained using

.Fl Q

.Qq ssh -Q key .

option of

.Xr ssh 1

may be used to list supported key types.

.It Cm HostbasedAuthentication

Specifies whether rhosts or /etc/hosts.equiv authentication together

with successful public key client host authentication is allowed

(host-based authentication).

The default is

.Dq no .

.Cm no .

.It Cm HostbasedUsesNameFromPacketOnly

Specifies whether or not the server will attempt to perform a reverse

name lookup when matching the name in the

Line 691

Line 673

files during

.Cm HostbasedAuthentication .

A setting of

.Dq yes

.Cm yes

means that

.Xr sshd 8

uses the name supplied by the client rather than

attempting to resolve the name from the TCP connection itself.

The default is

.Dq no .

.Cm no .

.It Cm HostCertificate

Specifies a file containing a public host certificate.

The certificate's public key must match a private host key already specified

Line 733

Line 715

Identifies the UNIX-domain socket used to communicate

with an agent that has access to the private host keys.

If the string

.Dq SSH_AUTH_SOCK

.Qq SSH_AUTH_SOCK

is specified, the location of the socket will be read from the

.Ev SSH_AUTH_SOCK

environment variable.

Line 751

Line 733

ssh-ed25519,ssh-rsa

.Ed

.Pp

The list of available key types may also be obtained using the

The list of available key types may also be obtained using

.Fl Q

.Qq ssh -Q key .

option of

.Xr ssh 1

with an argument of

.Dq key .

.It Cm IgnoreRhosts

Specifies that

.Pa .rhosts

Line 770

Line 748

.Pa /etc/shosts.equiv

are still used.

The default is

.Dq yes .

.Cm yes .

.It Cm IgnoreUserKnownHosts

Specifies whether

.Xr sshd 8

Line 779

Line 757

during

.Cm HostbasedAuthentication .

The default is

.Dq no .

.Cm no .

.It Cm IPQoS

Specifies the IPv4 type-of-service or DSCP class for the connection.

Accepted values are

.Dq af11 ,

.Cm af11 ,

.Dq af12 ,

.Cm af12 ,

.Dq af13 ,

.Cm af13 ,

.Dq af21 ,

.Cm af21 ,

.Dq af22 ,

.Cm af22 ,

.Dq af23 ,

.Cm af23 ,

.Dq af31 ,

.Cm af31 ,

.Dq af32 ,

.Cm af32 ,

.Dq af33 ,

.Cm af33 ,

.Dq af41 ,

.Cm af41 ,

.Dq af42 ,

.Cm af42 ,

.Dq af43 ,

.Cm af43 ,

.Dq cs0 ,

.Cm cs0 ,

.Dq cs1 ,

.Cm cs1 ,

.Dq cs2 ,

.Cm cs2 ,

.Dq cs3 ,

.Cm cs3 ,

.Dq cs4 ,

.Cm cs4 ,

.Dq cs5 ,

.Cm cs5 ,

.Dq cs6 ,

.Cm cs6 ,

.Dq cs7 ,

.Cm cs7 ,

.Dq ef ,

.Cm ef ,

.Dq lowdelay ,

.Cm lowdelay ,

.Dq throughput ,

.Cm throughput ,

.Dq reliability ,

.Cm reliability ,

or a numeric value.

This option may take one or two arguments, separated by whitespace.

If one argument is specified, it is used as the packet class unconditionally.

If two values are specified, the first is automatically selected for

interactive sessions and the second for non-interactive sessions.

The default is

.Dq lowdelay

.Cm lowdelay

for interactive sessions and

.Dq throughput

.Cm throughput

for non-interactive sessions.

.It Cm KbdInteractiveAuthentication

Specifies whether to allow keyboard-interactive authentication.

The argument to this keyword must be

.Dq yes

.Cm yes

.Dq no .

.Cm no .

The default is to use whatever value

.Cm ChallengeResponseAuthentication

is set to

(by default

.Dq yes ) .

.Cm yes ) .

.It Cm KerberosAuthentication

Specifies whether the password provided by the user for

.Cm PasswordAuthentication

Line 835

Line 813

To use this option, the server needs a

Kerberos servtab which allows the verification of the KDC's identity.

The default is

.Dq no .

.Cm no .

.It Cm KerberosGetAFSToken

If AFS is active and the user has a Kerberos 5 TGT, attempt to acquire

an AFS token before accessing the user's home directory.

The default is

.Dq no .

.Cm no .

.It Cm KerberosOrLocalPasswd

If password authentication through Kerberos fails then

the password will be validated via any additional local mechanism

such as

.Pa /etc/passwd .

The default is

.Dq yes .

.Cm yes .

.It Cm KerberosTicketCleanup

Specifies whether to automatically destroy the user's ticket cache

file on logout.

The default is

.Dq yes .

.Cm yes .

.It Cm KexAlgorithms

Specifies the available KEX (Key Exchange) algorithms.

Multiple algorithms must be comma-separated.

Line 891

Line 869

diffie-hellman-group14-sha1

.Ed

.Pp

The list of available key exchange algorithms may also be obtained using the

The list of available key exchange algorithms may also be obtained using

.Fl Q

.Qq ssh -Q kex .

option of

.Xr ssh 1

with an argument of

.Dq kex .

.It Cm ListenAddress

Specifies the local addresses

.Xr sshd 8

Line 956

Line 930

instead of replacing them.

.Pp

The algorithms that contain

.Dq -etm

.Qq -etm

calculate the MAC after encryption (encrypt-then-mac).

These are considered safer and their use recommended.

The supported MACs are:

Line 1009

Line 983

hmac-sha2-256,hmac-sha2-512,hmac-sha1

.Ed

.Pp

The list of available MAC algorithms may also be obtained using the

The list of available MAC algorithms may also be obtained using

.Fl Q

.Qq ssh -Q mac .

option of

.Xr ssh 1

with an argument of

.Dq mac .

.It Cm Match

Introduces a conditional block.

If all of the criteria on the

Line 1043

Line 1013

.Cm Address .

The match patterns may consist of single entries or comma-separated

lists and may use the wildcard and negation operators described in the

PATTERNS section of

.Sx PATTERNS

section of

.Xr ssh_config 5 .

.Pp

The patterns in an

.Cm Address

criteria may additionally contain addresses to match in CIDR

address/masklen format, e.g.\&

address/masklen format,

.Dq 192.0.2.0/24

such as 192.0.2.0/24 or 2001:db8::/32.

.Dq 2001:db8::/32 .

Note that the mask length provided must be consistent with the address -

it is an error to specify a mask length that is too long for the address

or one with bits set in this host portion of the address.

For example,

For example, 192.0.2.0/33 and 192.0.2.0/8, respectively.

.Dq 192.0.2.0/33

and

.Dq 192.0.2.0/8

respectively.

.Pp

Only a subset of keywords may be used on the lines following a

.Cm Match

Line 1139

Line 1104

.Pp

Alternatively, random early drop can be enabled by specifying

the three colon separated values

.Dq start:rate:full

start:rate:full (e.g. "10:30:60").

(e.g. "10:30:60").

.Xr sshd 8

will refuse connection attempts with a probability of

will refuse connection attempts with a probability of rate/100 (30%)

.Dq rate/100

if there are currently start (10) unauthenticated connections.

(30%)

if there are currently

.Dq start

(10)

unauthenticated connections.

The probability increases linearly and all connection attempts

are refused if the number of unauthenticated connections reaches

are refused if the number of unauthenticated connections reaches full (60).

.Dq full

(60).

.It Cm PasswordAuthentication

Specifies whether password authentication is allowed.

The default is

.Dq yes .

.Cm yes .

.It Cm PermitEmptyPasswords

When password authentication is allowed, it specifies whether the

server allows login to accounts with empty password strings.

The default is

.Dq no .

.Cm no .

.It Cm PermitOpen

Specifies the destinations to which TCP port forwarding is permitted.

The forwarding specification must be one of the following forms:

Line 1186

Line 1143

.Pp

Multiple forwards may be specified by separating them with whitespace.

An argument of

.Dq any

.Cm any

can be used to remove all restrictions and permit any forwarding requests.

An argument of

.Dq none

.Cm none

can be used to prohibit all forwarding requests.

The wildcard

.Dq *

.Sq *

can be used for host or port to allow all hosts or ports, respectively.

By default all port forwarding requests are permitted.

.It Cm PermitRootLogin

Specifies whether root can log in using

.Xr ssh 1 .

The argument must be

.Dq yes ,

.Cm yes ,

.Dq prohibit-password ,

.Cm prohibit-password ,

.Dq without-password ,

.Cm without-password ,

.Dq forced-commands-only ,

.Cm forced-commands-only ,

.Dq no .

.Cm no .

The default is

.Dq prohibit-password .

.Cm prohibit-password .

.Pp

If this option is set to

.Dq prohibit-password

.Cm prohibit-password

.Dq without-password ,

.Cm without-password ,

password and keyboard-interactive authentication are disabled for root.

.Pp

If this option is set to

.Dq forced-commands-only ,

.Cm forced-commands-only ,

root login with public key authentication will be allowed,

but only if the

.Ar command

Line 1225

Line 1182

All other authentication methods are disabled for root.

.Pp

If this option is set to

.Dq no ,

.Cm no ,

root is not allowed to log in.

.It Cm PermitTTY

Specifies whether

.Xr pty 4

allocation is permitted.

The default is

.Dq yes .

.Cm yes .

.It Cm PermitTunnel

Specifies whether

.Xr tun 4

device forwarding is allowed.

The argument must be

.Dq yes ,

.Cm yes ,

.Dq point-to-point

.Cm point-to-point

(layer 3),

.Dq ethernet

.Cm ethernet

(layer 2), or

.Dq no .

.Cm no .

Specifying

.Dq yes

.Cm yes

permits both

.Dq point-to-point

.Cm point-to-point

and

.Dq ethernet .

.Cm ethernet .

The default is

.Dq no .

.Cm no .

.Pp

Independent of this setting, the permissions of the selected

.Xr tun 4

Line 1266

Line 1223

are processed by

.Xr sshd 8 .

The default is

.Dq no .

.Cm no .

Enabling environment processing may enable users to bypass access

restrictions in some configurations using mechanisms such as

.Ev LD_PRELOAD .

Line 1275

Line 1232

.Pa ~/.ssh/rc

file is executed.

The default is

.Dq yes .

.Cm yes .

.It Cm PidFile

Specifies the file that contains the process ID of the

SSH daemon, or

.Dq none

.Cm none

to not write one.

The default is

.Pa /var/run/sshd.pid .

Line 1297

Line 1254

should print the date and time of the last user login when a user logs

in interactively.

The default is

.Dq yes .

.Cm yes .

.It Cm PrintMotd

Specifies whether

.Xr sshd 8

Line 1308

Line 1265

.Pa /etc/profile ,

or equivalent.)

The default is

.Dq yes .

.Cm yes .

.It Cm PubkeyAcceptedKeyTypes

Specifies the key types that will be accepted for public key authentication

as a comma-separated pattern list.

Line 1327

Line 1284

ssh-ed25519,ssh-rsa

.Ed

.Pp

The

The list of available key types may also be obtained using

.Fl Q

.Qq ssh -Q key .

option of

.Xr ssh 1

may be used to list supported key types.

.It Cm PubkeyAuthentication

Specifies whether public key authentication is allowed.

The default is

.Dq yes .

.Cm yes .

.It Cm RekeyLimit

Specifies the maximum amount of data that may be transmitted before the

session key is renegotiated, optionally followed a maximum amount of

Line 1358

Line 1312

The default value for

.Cm RekeyLimit

.Dq default none ,

.Cm default none ,

which means that rekeying is performed after the cipher's default amount

of data has been sent or received and no time based rekeying is done.

.It Cm RevokedKeys

Specifies revoked public keys file, or

.Dq none

.Cm none

to not use one.

Keys listed in this file will be refused for public key authentication.

Note that if this file is not readable, then public key authentication will

Line 1395

Line 1349

This option is only used for port forwarding to a Unix-domain socket file.

.Pp

The argument must be

.Dq yes

.Cm yes

.Dq no .

.Cm no .

The default is

.Dq no .

.Cm no .

.It Cm StrictModes

Specifies whether

.Xr sshd 8

Line 1408

Line 1362

This is normally desirable because novices sometimes accidentally leave their

directory or files world-writable.

The default is

.Dq yes .

.Cm yes .

Note that this does not apply to

.Cm ChrootDirectory ,

whose permissions and ownership are checked unconditionally.

Line 1418

Line 1372

to execute upon subsystem request.

.Pp

The command

.Xr sftp-server 8

.Cm sftp-server

implements the

implements the SFTP file transfer subsystem.

.Dq sftp

file transfer subsystem.

.Pp

Alternately the name

.Dq internal-sftp

.Cm internal-sftp

implements an in-process

implements an in-process SFTP server.

.Dq sftp

server.

This may simplify configurations using

.Cm ChrootDirectory

to force a different filesystem root on clients.

Line 1449

Line 1399

find it annoying.

On the other hand, if TCP keepalives are not sent,

sessions may hang indefinitely on the server, leaving

.Dq ghost

.Qq ghost

users and consuming server resources.

.Pp

The default is

.Dq yes

.Cm yes

(to send TCP keepalive messages), and the server will notice

if the network goes down or the client host crashes.

This avoids infinitely hanging sessions.

.Pp

To disable TCP keepalive messages, the value should be set to

.Dq no .

.Cm no .

.It Cm TrustedUserCAKeys

Specifies a file containing public keys of certificate authorities that are

trusted to sign user certificates for authentication, or

.Dq none

.Cm none

to not use one.

Keys are listed one per line; empty lines and comments starting with

.Ql #

Line 1484

Line 1434

very same IP address.

.Pp

If this option is set to

.Dq no

.Cm no

(the default) then only addresses and not host names may be used in

.Pa ~/.ssh/authorized_keys

.Cm from

Line 1503

Line 1453

The goal of privilege separation is to prevent privilege

escalation by containing any corruption within the unprivileged processes.

The argument must be

.Dq yes ,

.Cm yes ,

.Dq no ,

.Cm no ,

.Dq sandbox .

.Cm sandbox .

.Cm UsePrivilegeSeparation

is set to

.Dq sandbox

.Cm sandbox

then the pre-authentication unprivileged process is subject to additional

restrictions.

The default is

.Dq sandbox .

.Cm sandbox .

.It Cm VersionAddendum

Optionally specifies additional text to append to the SSH protocol banner

sent by the server upon connection.

The default is

.Dq none .

.Cm none .

.It Cm X11DisplayOffset

Specifies the first display number available for

.Xr sshd 8 Ns 's

Line 1529

Line 1479

.It Cm X11Forwarding

Specifies whether X11 forwarding is permitted.

The argument must be

.Dq yes

.Cm yes

.Dq no .

.Cm no .

The default is

.Dq no .

.Cm no .

.Pp

When X11 forwarding is enabled, there may be additional exposure to

the server and to client displays if the

.Xr sshd 8

proxy display is configured to listen on the wildcard address (see

.Cm X11UseLocalhost

.Cm X11UseLocalhost ) ,

below), though this is not the default.

though this is not the default.

Additionally, the authentication spoofing and authentication data

verification and substitution occur on the client side.

The security risk of using X11 forwarding is that the client's X11

Line 1552

Line 1502

A system administrator may have a stance in which they want to

protect clients that may expose themselves to attack by unwittingly

requesting X11 forwarding, which can warrant a

.Dq no

.Cm no

setting.

.Pp

Note that disabling X11 forwarding does not prevent users from

Line 1567

Line 1517

hostname part of the

.Ev DISPLAY

environment variable to

.Dq localhost .

.Cm localhost .

This prevents remote hosts from connecting to the proxy display.

However, some older X11 clients may not function with this

configuration.

.Cm X11UseLocalhost

may be set to

.Dq no

.Cm no

to specify that the forwarding server should be bound to the wildcard

address.

The argument must be

.Dq yes

.Cm yes

.Dq no .

.Cm no .

The default is

.Dq yes .

.Cm yes .

.It Cm XAuthLocation

Specifies the full pathname of the

.Xr xauth 1

program, or

.Dq none

.Cm none

to not use one.

The default is

.Pa /usr/X11R6/bin/xauth .

Line 1685

Line 1635

(though not necessary) that it be world-readable.

.El

.Sh SEE ALSO

.Xr sftp-server 8 ,

.Xr sshd 8

.Sh AUTHORS

.An -nosplit

OpenSSH is a derivative of the original and free

ssh 1.2.12 release by Tatu Ylonen.

ssh 1.2.12 release by

Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos,

.An Tatu Ylonen .

Theo de Raadt and Dug Song

.An Aaron Campbell , Bob Beck , Markus Friedl , Niels Provos ,

.An Theo de Raadt

and

.An Dug Song

removed many bugs, re-added newer features and

created OpenSSH.

Markus Friedl contributed the support for SSH

.An Markus Friedl

protocol versions 1.5 and 2.0.

contributed the support for SSH protocol versions 1.5 and 2.0.

Niels Provos and Markus Friedl contributed support

.An Niels Provos

for privilege separation.

and

.An Markus Friedl

contributed support for privilege separation.