src/usr.bin/ssh/sshd_config.5 - diff

Return to sshd_config.5 CVS log

Up to [local] / src / usr.bin / ssh

Diff for /src/usr.bin/ssh/sshd_config.5 between version 1.3.2.3 and 1.4

version 1.3.2.3, 2002/10/11 14:53:07

version 1.4, 2002/06/22 16:45:29

Line 43

.Nd OpenSSH SSH daemon configuration file

.Sh SYNOPSIS

.Bl -tag -width Ds -compact

.It Pa /etc/sshd_config

.It Pa /etc/ssh/sshd_config

.El

.Sh DESCRIPTION

.Nm sshd

reads configuration data from

.Pa /etc/sshd_config

.Pa /etc/ssh/sshd_config

(or the file specified with

.Fl f

on the command line).

Line 237

Specifies a file containing a private host key

used by SSH.

The default is

.Pa /etc/ssh_host_key

.Pa /etc/ssh/ssh_host_key

for protocol version 1, and

.Pa /etc/ssh_host_rsa_key

.Pa /etc/ssh/ssh_host_rsa_key

and

.Pa /etc/ssh_host_dsa_key

.Pa /etc/ssh/ssh_host_dsa_key

for protocol version 2.

Note that

.Nm sshd

Line 379

The server disconnects after this time if the user has not

successfully logged in.

If the value is 0, there is no time limit.

The default is 120 seconds.

The default is 600 (seconds).

.It Cm LogLevel

Gives the verbosity level that is used when logging messages from

.Nm sshd .

Line 459

If this option is set to

.Dq no

root is not allowed to login.

.It Cm PermitUserEnvironment

Specifies whether

.Pa ~/.ssh/environment

and

.Cm environment=

options in

.Pa ~/.ssh/authorized_keys

are processed by

.Nm sshd .

The default is

.Dq no .

Enabling environment processing may enable users to bypass access

restrictions in some configurations using mechanisms such as

.Ev LD_PRELOAD .

.It Cm PidFile

Specifies the file that contains the process ID of the

.Nm sshd

Line 507

Line 493

.It Cm Protocol

Specifies the protocol versions

.Nm sshd

supports.

should support.

The possible values are

.Dq 1

and

Line 515

Line 501

Multiple versions must be comma-separated.

The default is

.Dq 2,1 .

Note that the order of the protocol list does not indicate preference,

because the client selects among multiple protocol versions offered

by the server.

Specifying

.Dq 2,1

is identical to

.Dq 1,2 .

.It Cm PubkeyAuthentication

Specifies whether public key authentication is allowed.

The default is

Line 624

Line 603

The default is 10.

.It Cm X11Forwarding

Specifies whether X11 forwarding is permitted.

The argument must be

.Dq yes

.Dq no .

The default is

.Dq no .

.Pp

Note that disabling X11 forwarding does not improve security in any

When X11 forwarding is enabled, there may be additional exposure to

way, as users can always install their own forwarders.

the server and to client displays if the

.Nm sshd

proxy display is configured to listen on the wildcard address (see

.Cm X11UseLocalhost

below), however this is not the default.

Additionally, the authentication spoofing and authentication data

verification and substitution occur on the client side.

The security risk of using X11 forwarding is that the client's X11

display server may be exposed to attack when the ssh client requests

forwarding (see the warnings for

.Cm ForwardX11

.Xr ssh_config 5 ).

A system administrator may have a stance in which they want to

protect clients that may expose themselves to attack by unwittingly

requesting X11 forwarding, which can warrant a

.Dq no

setting.

.Pp

Note that disabling X11 forwarding does not prevent users from

forwarding X11 traffic, as users can always install their own forwarders.

X11 forwarding is automatically disabled if

.Cm UseLogin

is enabled.

Line 667

Line 621

.Ev DISPLAY

environment variable to

.Dq localhost .

This prevents remote hosts from connecting to the proxy display.

This prevents remote hosts from connecting to the fake display.

However, some older X11 clients may not function with this

configuration.

.Cm X11UseLocalhost

Line 682

Line 636

The default is

.Dq yes .

.It Cm XAuthLocation

Specifies the full pathname of the

Specifies the location of the

.Xr xauth 1

program.

The default is

Line 694

Line 648

command-line arguments and configuration file options that specify time

may be expressed using a sequence of the form:

.Sm off

.Ar time Op Ar qualifier ,

.Ar time Oo Ar qualifier Oc ,

.Sm on

where

.Ar time

Line 732

Line 686

.El

.Sh FILES

.Bl -tag -width Ds

.It Pa /etc/sshd_config

.It Pa /etc/ssh/sshd_config

Contains configuration data for

.Nm sshd .

This file should be writable by root only, but it is recommended