src/usr.bin/ssh/sshd_config.5 - diff

Return to sshd_config.5 CVS log

Up to [local] / src / usr.bin / ssh

Diff for /src/usr.bin/ssh/sshd_config.5 between version 1.84 and 1.85

version 1.84, 2008/03/25 11:58:02

version 1.85, 2008/04/04 05:14:38

Line 210

.Cm Subsystem

for details).

.Pp

Please note that there are many ways to misconfigure a chroot environment

in ways that compromise security.

These include:

.Pp

.Bl -dash -offset indent -compact

.It

Making unsafe setuid binaries available;

.It

Having missing or incorrect configuration files in the chroot's

.Pa /etc

directory;

.It

Hard-linking files between the chroot and outside;

.It

Leaving unnecessary

.Pa /dev

nodes accessible inside the chroot (especially those for physical drives);

.It

Executing scripts or binaries inside the chroot from outside, either

directly or through facilities such as

.Xr cron 8 .

.El

.Pp

The default is not to

.Xr chroot 2 .

.It Cm Ciphers

Line 340

Line 363

will force the use of an in-process sftp server that requires no support

files when used with

.Cm ChrootDirectory .

Note that

.Dq internal-sftp

is only supported when

.Cm UsePrivilegeSeparation

is enabled.

.It Cm GatewayPorts

Specifies whether remote hosts are allowed to connect to ports

forwarded for the client.

Line 563

Line 591

Available keywords are

.Cm AllowTcpForwarding ,

.Cm Banner ,

.Cm ChrootDirectory ,

.Cm ForceCommand ,

.Cm GatewayPorts ,

.Cm GSSApiAuthentication ,

Line 801

Line 830

This may simplify configurations using

.Cm ChrootDirectory

to force a different filesystem root on clients.

Note that

.Dq internal-sftp

is only supported when

.Cm UsePrivilegeSeparation

is enabled.

.Pp

By default no subsystems are defined.

Note that this option applies to protocol version 2 only.