src/usr.bin/ssh/sshd_config.5 - diff

Return to sshd_config.5 CVS log

Up to [local] / src / usr.bin / ssh

Diff for /src/usr.bin/ssh/sshd_config.5 between version 1.44.2.2 and 1.45

version 1.44.2.2, 2006/10/06 03:19:33

version 1.45, 2005/09/21 23:36:54

Line 46

.It Pa /etc/ssh/sshd_config

.El

.Sh DESCRIPTION

.Xr sshd 8

.Nm sshd

reads configuration data from

.Pa /etc/ssh/sshd_config

(or the file specified with

Line 56

Lines starting with

.Ql #

and empty lines are interpreted as comments.

Arguments may optionally be enclosed in double quotes

.Pq \&"

in order to represent arguments containing spaces.

.Pp

The possible

keywords and their meanings are as follows (note that

Line 75

Line 72

for how to configure the client.

Note that environment passing is only supported for protocol 2.

Variables are specified by name, which may contain the wildcard characters

.Ql *

.Ql \&*

and

.Ql \&? .

Multiple environment variables may be separated by whitespace or spread

Line 88

Line 85

The default is not to accept any environment variables.

.It Cm AddressFamily

Specifies which address family should be used by

.Xr sshd 8 .

.Nm sshd .

Valid arguments are

.Dq any ,

.Dq inet

(use IPv4 only), or

(use IPv4 only) or

.Dq inet6

(use IPv6 only).

The default is

Line 102

Line 99

by spaces.

If specified, login is allowed only for users whose primary

group or supplementary group list matches one of the patterns.

.Ql \&*

and

.Ql \&?

can be used as

wildcards in the patterns.

Only group names are valid; a numerical group ID is not recognized.

By default, login is allowed for all groups.

The allow/deny directives are processed in the following order:

.Cm DenyUsers ,

.Cm AllowUsers ,

.Cm DenyGroups ,

and finally

.Cm AllowGroups .

.Pp

See

.Sx PATTERNS

.Xr ssh_config 5

for more information on patterns.

.It Cm AllowTcpForwarding

Specifies whether TCP forwarding is permitted.

The default is

Line 128

Line 118

by spaces.

If specified, login is allowed only for user names that

match one of the patterns.

.Ql \&*

and

.Ql \&?

can be used as

wildcards in the patterns.

Only user names are valid; a numerical user ID is not recognized.

By default, login is allowed for all users.

If the pattern takes the form USER@HOST then USER and HOST

are separately checked, restricting logins to particular

users from particular hosts.

The allow/deny directives are processed in the following order:

.Cm DenyUsers ,

.Cm AllowUsers ,

.Cm DenyGroups ,

and finally

.Cm AllowGroups .

.Pp

See

.Sx PATTERNS

.Xr ssh_config 5

for more information on patterns.

.It Cm AuthorizedKeysFile

Specifies the file that contains the public keys that can be used

for user authentication.

.Cm AuthorizedKeysFile

may contain tokens of the form %T which are substituted during connection

setup.

set-up.

The following tokens are defined: %% is replaced by a literal '%',

%h is replaced by the home directory of the user being authenticated, and

%h is replaced by the home directory of the user being authenticated and

%u is replaced by the username of that user.

After expansion,

.Cm AuthorizedKeysFile

Line 168

Line 151

This option is only available for protocol version 2.

By default, no banner is displayed.

.It Cm ChallengeResponseAuthentication

Specifies whether challenge-response authentication is allowed.

Specifies whether challenge response authentication is allowed.

All authentication styles from

.Xr login.conf 5

are supported.

Line 191

Line 174

.Dq blowfish-cbc ,

and

.Dq cast128-cbc .

The default is:

The default is

.Bd -literal -offset 3n

.Bd -literal

aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,

``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,

arcfour256,arcfour,aes192-cbc,aes256-cbc,aes128-ctr,

aes192-ctr,aes256-ctr

aes192-ctr,aes256-ctr''

.Ed

.It Cm ClientAliveCountMax

Sets the number of client alive messages (see below) which may be

Sets the number of client alive messages (see above) which may be

sent without

.Xr sshd 8

.Nm sshd

receiving any messages back from the client.

If this threshold is reached while client alive messages are being sent,

sshd will disconnect the client, terminating the session.

.Nm sshd

will disconnect the client, terminating the session.

It is important to note that the use of client alive messages is very

different from

.Cm TCPKeepAlive

Line 219

Line 203

The default value is 3.

.Cm ClientAliveInterval

(see below) is set to 15, and

(above) is set to 15, and

.Cm ClientAliveCountMax

is left at the default, unresponsive SSH clients

is left at the default, unresponsive ssh clients

will be disconnected after approximately 45 seconds.

This option applies to protocol version 2 only.

.It Cm ClientAliveInterval

Sets a timeout interval in seconds after which if no data has been received

from the client,

.Xr sshd 8

.Nm sshd

will send a message through the encrypted

channel to request a response from the client.

The default

Line 248

Line 231

by spaces.

group list matches one of the patterns.

.Ql \&*

and

.Ql \&?

can be used as

wildcards in the patterns.

Only group names are valid; a numerical group ID is not recognized.

By default, login is allowed for all groups.

The allow/deny directives are processed in the following order:

.Cm DenyUsers ,

.Cm AllowUsers ,

.Cm DenyGroups ,

and finally

.Cm AllowGroups .

.Pp

See

.Sx PATTERNS

.Xr ssh_config 5

for more information on patterns.

.It Cm DenyUsers

This keyword can be followed by a list of user name patterns, separated

by spaces.

.Ql \&*

and

.Ql \&?

can be used as wildcards in the patterns.

Only user names are valid; a numerical user ID is not recognized.

By default, login is allowed for all users.

If the pattern takes the form USER@HOST then USER and HOST

are separately checked, restricting logins to particular

users from particular hosts.

The allow/deny directives are processed in the following order:

.Cm DenyUsers ,

.Cm AllowUsers ,

.Cm DenyGroups ,

and finally

.Cm AllowGroups .

.Pp

See

.Sx PATTERNS

.Xr ssh_config 5

for more information on patterns.

.It Cm ForceCommand

Forces the execution of the command specified by

.Cm ForceCommand ,

ignoring any command supplied by the client.

The command is invoked by using the user's login shell with the -c option.

This applies to shell, command, or subsystem execution.

It is most useful inside a

.Cm Match

block.

The command originally supplied by the client is available in the

.Ev SSH_ORIGINAL_COMMAND

environment variable.

.It Cm GatewayPorts

Specifies whether remote hosts are allowed to connect to ports

forwarded for the client.

By default,

.Xr sshd 8

.Nm sshd

binds remote port forwardings to the loopback address.

This prevents other remote hosts from connecting to forwarded ports.

.Cm GatewayPorts

can be used to specify that sshd

can be used to specify that

.Nm sshd

should allow remote port forwardings to bind to non-loopback addresses, thus

allowing other hosts to connect.

The argument may be

Line 329

Line 286

.It Cm HostbasedAuthentication

Specifies whether rhosts or /etc/hosts.equiv authentication together

with successful public key client host authentication is allowed

(host-based authentication).

(hostbased authentication).

This option is similar to

.Cm RhostsRSAAuthentication

and applies to protocol version 2 only.

The default is

.Dq no .

.It Cm HostbasedUsesNameFromPacketOnly

Specifies whether or not the server will attempt to perform a reverse

name lookup when matching the name in the

.Pa ~/.shosts ,

.Pa ~/.rhosts ,

and

.Pa /etc/hosts.equiv

files during

.Cm HostbasedAuthentication .

A setting of

.Dq yes

means that

.Xr sshd 8

uses the name supplied by the client rather than

attempting to resolve the name from the TCP connection itself.

The default is

.Dq no .

.It Cm HostKey

Specifies a file containing a private host key

used by SSH.

Line 363

Line 303

.Pa /etc/ssh/ssh_host_dsa_key

for protocol version 2.

Note that

.Xr sshd 8

.Nm sshd

will refuse to use a file if it is group/world-accessible.

It is possible to have multiple host key files.

.Dq rsa1

Line 390

Line 330

.Dq yes .

.It Cm IgnoreUserKnownHosts

Specifies whether

.Xr sshd 8

.Nm sshd

should ignore the user's

.Pa ~/.ssh/known_hosts

during

Line 405

Line 345

will be validated through the Kerberos KDC.

To use this option, the server needs a

Kerberos servtab which allows the verification of the KDC's identity.

The default is

Default is

.Dq no .

.It Cm KerberosGetAFSToken

If AFS is active and the user has a Kerberos 5 TGT, attempt to acquire

an AFS token before accessing the user's home directory.

The default is

Default is

.Dq no .

.It Cm KerberosOrLocalPasswd

If password authentication through Kerberos fails then

If set then if password authentication through Kerberos fails then

the password will be validated via any additional local mechanism

such as

.Pa /etc/passwd .

The default is

Default is

.Dq yes .

.It Cm KerberosTicketCleanup

Specifies whether to automatically destroy the user's ticket cache

file on logout.

The default is

Default is

.Dq yes .

.It Cm KeyRegenerationInterval

In protocol version 1, the ephemeral server key is automatically regenerated

Line 435

Line 375

The default is 3600 (seconds).

.It Cm ListenAddress

Specifies the local addresses

.Xr sshd 8

.Nm sshd

should listen on.

The following forms may be used:

.Pp

Line 461

Line 401

.Ar port

is not specified,

sshd will listen on the address and all prior

.Nm sshd

will listen on the address and all prior

.Cm Port

options specified.

The default is to listen on all local addresses.

Line 470

Line 411

options are permitted.

Additionally, any

.Cm Port

options must precede this option for non-port qualified addresses.

options must precede this option for non port qualified addresses.

.It Cm LoginGraceTime

The server disconnects after this time if the user has not

successfully logged in.

Line 478

Line 419

The default is 120 seconds.

.It Cm LogLevel

Gives the verbosity level that is used when logging messages from

.Xr sshd 8 .

.Nm sshd .

The possible values are:

QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3.

QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3.

The default is INFO.

DEBUG and DEBUG1 are equivalent.

DEBUG2 and DEBUG3 each specify higher levels of debugging output.

Line 490

Line 431

The MAC algorithm is used in protocol version 2

for data integrity protection.

Multiple algorithms must be comma-separated.

The default is:

The default is

.Dq hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96 .

.It Cm Match

Introduces a conditional block.

If all of the criteria on the

.Cm Match

line are satisfied, the keywords on the following lines override those

set in the global section of the config file, until either another

.Cm Match

line or the end of the file.

The arguments to

.Cm Match

are one or more criteria-pattern pairs.

The available criteria are

.Cm User ,

.Cm Group ,

.Cm Host ,

and

.Cm Address .

Only a subset of keywords may be used on the lines following a

.Cm Match

keyword.

Available keywords are

.Cm AllowTcpForwarding ,

.Cm ForceCommand ,

.Cm GatewayPorts ,

.Cm PermitOpen ,

.Cm X11DisplayOffset ,

.Cm X11Forwarding ,

and

.Cm X11UseLocalHost .

.It Cm MaxAuthTries

Specifies the maximum number of authentication attempts permitted per

connection.

Line 529

Line 441

The default is 6.

.It Cm MaxStartups

Specifies the maximum number of concurrent unauthenticated connections to the

SSH daemon.

.Nm sshd

daemon.

Additional connections will be dropped until authentication succeeds or the

.Cm LoginGraceTime

expires for a connection.

Line 538

Line 451

Alternatively, random early drop can be enabled by specifying

the three colon separated values

.Dq start:rate:full

(e.g. "10:30:60").

(e.g., "10:30:60").

.Xr sshd 8

.Nm sshd

will refuse connection attempts with a probability of

.Dq rate/100

(30%)

Line 560

Line 473

server allows login to accounts with empty password strings.

The default is

.Dq no .

.It Cm PermitOpen

Specifies the destinations to which TCP port forwarding is permitted.

The forwarding specification must be one of the following forms:

.Pp

.Bl -item -offset indent -compact

.It

.Cm PermitOpen

.Sm off

.Ar host : port

.Sm on

.It

.Cm PermitOpen

.Sm off

.Ar IPv4_addr : port

.Sm on

.It

.Cm PermitOpen

.Sm off

.Ar \&[ IPv6_addr \&] : port

.Sm on

.El

.Pp

Multiple forwards may be specified by separating them with whitespace.

An argument of

.Dq any

can be used to remove all restrictions and permit any forwarding requests.

By default all port forwarding requests are permitted.

.It Cm PermitRootLogin

Specifies whether root can log in using

.Xr ssh 1 .

The argument must be

.Dq yes ,

.Dq without-password ,

.Dq forced-commands-only ,

.Dq forced-commands-only

.Dq no .

The default is

.Dq yes .

.Pp

If this option is set to

.Dq without-password ,

.Dq without-password

password authentication is disabled for root.

.Pp

If this option is set to

.Dq forced-commands-only ,

.Dq forced-commands-only

root login with public key authentication will be allowed,

but only if the

.Ar command

Line 614

Line 500

All other authentication methods are disabled for root.

.Pp

If this option is set to

.Dq no ,

.Dq no

root is not allowed to log in.

.It Cm PermitTunnel

Specifies whether

.Xr tun 4

device forwarding is allowed.

The argument must be

.Dq yes ,

.Dq point-to-point

(layer 3),

.Dq ethernet

(layer 2), or

.Dq no .

Specifying

.Dq yes

permits both

.Dq point-to-point

and

.Dq ethernet .

The default is

.Dq no .

.It Cm PermitUserEnvironment

Specifies whether

.Pa ~/.ssh/environment

Line 643

Line 510

options in

.Pa ~/.ssh/authorized_keys

are processed by

.Xr sshd 8 .

.Nm sshd .

The default is

.Dq no .

Enabling environment processing may enable users to bypass access

Line 651

Line 518

.Ev LD_PRELOAD .

.It Cm PidFile

Specifies the file that contains the process ID of the

SSH daemon.

.Nm sshd

daemon.

The default is

.Pa /var/run/sshd.pid .

.It Cm Port

Specifies the port number that

.Xr sshd 8

.Nm sshd

listens on.

The default is 22.

Multiple options of this type are permitted.

Line 664

Line 532

.Cm ListenAddress .

.It Cm PrintLastLog

Specifies whether

.Xr sshd 8

.Nm sshd

should print the date and time of the last user login when a user logs

in interactively.

The default is

.Dq yes .

.It Cm PrintMotd

Specifies whether

.Xr sshd 8

.Nm sshd

should print

.Pa /etc/motd

when a user logs in interactively.

Line 682

Line 550

.Dq yes .

.It Cm Protocol

Specifies the protocol versions

.Xr sshd 8

.Nm sshd

supports.

The possible values are

.Sq 1

.Dq 1

and

.Sq 2 .

.Dq 2 .

Multiple versions must be comma-separated.

The default is

.Dq 2,1 .

Line 719

Line 587

The minimum value is 512, and the default is 768.

.It Cm StrictModes

Specifies whether

.Xr sshd 8

.Nm sshd

should check file modes and ownership of the

user's files and home directory before accepting login.

This is normally desirable because novices sometimes accidentally leave their

Line 727

Line 595

The default is

.Dq yes .

.It Cm Subsystem

Configures an external subsystem (e.g. file transfer daemon).

Configures an external subsystem (e.g., file transfer daemon).

Arguments should be a subsystem name and a command (with optional arguments)

Arguments should be a subsystem name and a command to execute upon subsystem

to execute upon subsystem request.

request.

The command

.Xr sftp-server 8

implements the

Line 739

Line 607

Note that this option applies to protocol version 2 only.

.It Cm SyslogFacility

Gives the facility code that is used when logging messages from

.Xr sshd 8 .

.Nm sshd .

The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2,

LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.

The default is AUTH.

Line 766

Line 634

.Dq no .

.It Cm UseDNS

Specifies whether

.Xr sshd 8

.Nm sshd

should look up the remote host name and check that

the resolved host name for the remote IP address maps back to the

very same IP address.

Line 793

Line 661

is specified, it will be disabled after authentication.

.It Cm UsePrivilegeSeparation

Specifies whether

.Xr sshd 8

.Nm sshd

separates privileges by creating an unprivileged child process

to deal with incoming network traffic.

After successful authentication, another process will be created that has

Line 804

Line 672

.Dq yes .

.It Cm X11DisplayOffset

Specifies the first display number available for

.Xr sshd 8 Ns 's

.Nm sshd Ns 's

X11 forwarding.

This prevents sshd from interfering with real X11 servers.

This prevents

.Nm sshd

from interfering with real X11 servers.

The default is 10.

.It Cm X11Forwarding

Specifies whether X11 forwarding is permitted.

Line 819

Line 689

.Pp

When X11 forwarding is enabled, there may be additional exposure to

the server and to client displays if the

.Xr sshd 8

.Nm sshd

proxy display is configured to listen on the wildcard address (see

.Cm X11UseLocalhost

below), though this is not the default.

below), however this is not the default.

Additionally, the authentication spoofing and authentication data

verification and substitution occur on the client side.

The security risk of using X11 forwarding is that the client's X11

display server may be exposed to attack when the SSH client requests

display server may be exposed to attack when the ssh client requests

forwarding (see the warnings for

.Cm ForwardX11

Line 844

Line 714

is enabled.

.It Cm X11UseLocalhost

Specifies whether

.Xr sshd 8

.Nm sshd

should bind the X11 forwarding server to the loopback address or to

the wildcard address.

By default,

sshd binds the forwarding server to the loopback address and sets the

.Nm sshd

binds the forwarding server to the loopback address and sets the

hostname part of the

.Ev DISPLAY

environment variable to

Line 874

Line 745

The default is

.Pa /usr/X11R6/bin/xauth .

.El

.Sh TIME FORMATS

.Ss Time Formats

.Xr sshd 8

.Nm sshd

command-line arguments and configuration file options that specify time

may be expressed using a sequence of the form:

.Sm off

Line 888

Line 759

is one of the following:

.Pp

.Bl -tag -width Ds -compact -offset indent

.It Aq Cm none

.It Cm <none>

seconds

.It Cm s | Cm S

seconds

Line 919

Line 790

.Bl -tag -width Ds

.It Pa /etc/ssh/sshd_config

Contains configuration data for

.Xr sshd 8 .

.Nm sshd .

This file should be writable by root only, but it is recommended

(though not necessary) that it be world-readable.

.El