Annotation of src/usr.bin/ssh/sshd_config.5, Revision 1.13
1.1 stevesk 1: .\" -*- nroff -*-
2: .\"
3: .\" Author: Tatu Ylonen <ylo@cs.hut.fi>
4: .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5: .\" All rights reserved
6: .\"
7: .\" As far as I am concerned, the code I have written for this software
8: .\" can be used freely for any purpose. Any derived versions of this
9: .\" software must be clearly marked as such, and if the derived work is
10: .\" incompatible with the protocol description in the RFC file, it must be
11: .\" called by a name other than "ssh" or "Secure Shell".
12: .\"
13: .\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved.
14: .\" Copyright (c) 1999 Aaron Campbell. All rights reserved.
15: .\" Copyright (c) 1999 Theo de Raadt. All rights reserved.
16: .\"
17: .\" Redistribution and use in source and binary forms, with or without
18: .\" modification, are permitted provided that the following conditions
19: .\" are met:
20: .\" 1. Redistributions of source code must retain the above copyright
21: .\" notice, this list of conditions and the following disclaimer.
22: .\" 2. Redistributions in binary form must reproduce the above copyright
23: .\" notice, this list of conditions and the following disclaimer in the
24: .\" documentation and/or other materials provided with the distribution.
25: .\"
26: .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
27: .\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
28: .\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
29: .\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
30: .\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
31: .\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
32: .\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
33: .\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
34: .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35: .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36: .\"
1.13 ! stevesk 37: .\" $OpenBSD: sshd_config.5,v 1.12 2002/09/04 18:52:42 stevesk Exp $
1.1 stevesk 38: .Dd September 25, 1999
39: .Dt SSHD_CONFIG 5
40: .Os
41: .Sh NAME
42: .Nm sshd_config
43: .Nd OpenSSH SSH daemon configuration file
44: .Sh SYNOPSIS
45: .Bl -tag -width Ds -compact
46: .It Pa /etc/ssh/sshd_config
47: .El
48: .Sh DESCRIPTION
49: .Nm sshd
50: reads configuration data from
51: .Pa /etc/ssh/sshd_config
52: (or the file specified with
53: .Fl f
54: on the command line).
55: The file contains keyword-argument pairs, one per line.
56: Lines starting with
57: .Ql #
58: and empty lines are interpreted as comments.
59: .Pp
60: The possible
61: keywords and their meanings are as follows (note that
62: keywords are case-insensitive and arguments are case-sensitive):
63: .Bl -tag -width Ds
64: .It Cm AFSTokenPassing
65: Specifies whether an AFS token may be forwarded to the server.
66: Default is
67: .Dq no .
68: .It Cm AllowGroups
69: This keyword can be followed by a list of group name patterns, separated
70: by spaces.
71: If specified, login is allowed only for users whose primary
72: group or supplementary group list matches one of the patterns.
73: .Ql \&*
74: and
75: .Ql ?
76: can be used as
77: wildcards in the patterns.
78: Only group names are valid; a numerical group ID is not recognized.
79: By default, login is allowed for all groups.
80: .Pp
81: .It Cm AllowTcpForwarding
82: Specifies whether TCP forwarding is permitted.
83: The default is
84: .Dq yes .
85: Note that disabling TCP forwarding does not improve security unless
86: users are also denied shell access, as they can always install their
87: own forwarders.
88: .Pp
89: .It Cm AllowUsers
90: This keyword can be followed by a list of user name patterns, separated
91: by spaces.
92: If specified, login is allowed only for users names that
93: match one of the patterns.
94: .Ql \&*
95: and
96: .Ql ?
97: can be used as
98: wildcards in the patterns.
99: Only user names are valid; a numerical user ID is not recognized.
100: By default, login is allowed for all users.
101: If the pattern takes the form USER@HOST then USER and HOST
102: are separately checked, restricting logins to particular
103: users from particular hosts.
104: .Pp
105: .It Cm AuthorizedKeysFile
106: Specifies the file that contains the public keys that can be used
107: for user authentication.
108: .Cm AuthorizedKeysFile
109: may contain tokens of the form %T which are substituted during connection
110: set-up. The following tokens are defined: %% is replaced by a literal '%',
111: %h is replaced by the home directory of the user being authenticated and
112: %u is replaced by the username of that user.
113: After expansion,
114: .Cm AuthorizedKeysFile
115: is taken to be an absolute path or one relative to the user's home
116: directory.
117: The default is
118: .Dq .ssh/authorized_keys .
119: .It Cm Banner
120: In some jurisdictions, sending a warning message before authentication
121: may be relevant for getting legal protection.
122: The contents of the specified file are sent to the remote user before
123: authentication is allowed.
124: This option is only available for protocol version 2.
125: By default, no banner is displayed.
126: .Pp
127: .It Cm ChallengeResponseAuthentication
128: Specifies whether challenge response authentication is allowed.
129: All authentication styles from
130: .Xr login.conf 5
131: are supported.
132: The default is
133: .Dq yes .
134: .It Cm Ciphers
135: Specifies the ciphers allowed for protocol version 2.
136: Multiple ciphers must be comma-separated.
137: The default is
138: .Pp
139: .Bd -literal
140: ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
141: aes192-cbc,aes256-cbc''
142: .Ed
143: .It Cm ClientAliveInterval
144: Sets a timeout interval in seconds after which if no data has been received
145: from the client,
146: .Nm sshd
147: will send a message through the encrypted
148: channel to request a response from the client.
149: The default
150: is 0, indicating that these messages will not be sent to the client.
151: This option applies to protocol version 2 only.
152: .It Cm ClientAliveCountMax
153: Sets the number of client alive messages (see above) which may be
154: sent without
155: .Nm sshd
156: receiving any messages back from the client. If this threshold is
157: reached while client alive messages are being sent,
158: .Nm sshd
159: will disconnect the client, terminating the session. It is important
160: to note that the use of client alive messages is very different from
161: .Cm KeepAlive
162: (below). The client alive messages are sent through the
163: encrypted channel and therefore will not be spoofable. The TCP keepalive
164: option enabled by
165: .Cm KeepAlive
166: is spoofable. The client alive mechanism is valuable when the client or
167: server depend on knowing when a connection has become inactive.
168: .Pp
169: The default value is 3. If
170: .Cm ClientAliveInterval
171: (above) is set to 15, and
172: .Cm ClientAliveCountMax
173: is left at the default, unresponsive ssh clients
174: will be disconnected after approximately 45 seconds.
1.3 markus 175: .It Cm Compression
176: Specifies whether compression is allowed.
177: The argument must be
178: .Dq yes
179: or
180: .Dq no .
181: The default is
182: .Dq yes .
1.1 stevesk 183: .It Cm DenyGroups
184: This keyword can be followed by a list of group name patterns, separated
185: by spaces.
186: Login is disallowed for users whose primary group or supplementary
187: group list matches one of the patterns.
188: .Ql \&*
189: and
190: .Ql ?
191: can be used as
192: wildcards in the patterns.
193: Only group names are valid; a numerical group ID is not recognized.
194: By default, login is allowed for all groups.
195: .Pp
196: .It Cm DenyUsers
197: This keyword can be followed by a list of user name patterns, separated
198: by spaces.
199: Login is disallowed for user names that match one of the patterns.
200: .Ql \&*
201: and
202: .Ql ?
203: can be used as wildcards in the patterns.
204: Only user names are valid; a numerical user ID is not recognized.
205: By default, login is allowed for all users.
206: If the pattern takes the form USER@HOST then USER and HOST
207: are separately checked, restricting logins to particular
208: users from particular hosts.
209: .It Cm GatewayPorts
210: Specifies whether remote hosts are allowed to connect to ports
211: forwarded for the client.
212: By default,
213: .Nm sshd
214: binds remote port forwardings to the loopback address. This
215: prevents other remote hosts from connecting to forwarded ports.
216: .Cm GatewayPorts
217: can be used to specify that
218: .Nm sshd
219: should bind remote port forwardings to the wildcard address,
220: thus allowing remote hosts to connect to forwarded ports.
221: The argument must be
222: .Dq yes
223: or
224: .Dq no .
225: The default is
226: .Dq no .
227: .It Cm HostbasedAuthentication
228: Specifies whether rhosts or /etc/hosts.equiv authentication together
229: with successful public key client host authentication is allowed
230: (hostbased authentication).
231: This option is similar to
232: .Cm RhostsRSAAuthentication
233: and applies to protocol version 2 only.
234: The default is
235: .Dq no .
236: .It Cm HostKey
237: Specifies a file containing a private host key
238: used by SSH.
239: The default is
240: .Pa /etc/ssh/ssh_host_key
241: for protocol version 1, and
242: .Pa /etc/ssh/ssh_host_rsa_key
243: and
244: .Pa /etc/ssh/ssh_host_dsa_key
245: for protocol version 2.
246: Note that
247: .Nm sshd
248: will refuse to use a file if it is group/world-accessible.
249: It is possible to have multiple host key files.
250: .Dq rsa1
251: keys are used for version 1 and
252: .Dq dsa
253: or
254: .Dq rsa
255: are used for version 2 of the SSH protocol.
256: .It Cm IgnoreRhosts
257: Specifies that
258: .Pa .rhosts
259: and
260: .Pa .shosts
261: files will not be used in
262: .Cm RhostsAuthentication ,
263: .Cm RhostsRSAAuthentication
264: or
265: .Cm HostbasedAuthentication .
266: .Pp
267: .Pa /etc/hosts.equiv
268: and
269: .Pa /etc/shosts.equiv
270: are still used.
271: The default is
272: .Dq yes .
273: .It Cm IgnoreUserKnownHosts
274: Specifies whether
275: .Nm sshd
276: should ignore the user's
277: .Pa $HOME/.ssh/known_hosts
278: during
279: .Cm RhostsRSAAuthentication
280: or
281: .Cm HostbasedAuthentication .
282: The default is
283: .Dq no .
284: .It Cm KeepAlive
285: Specifies whether the system should send TCP keepalive messages to the
286: other side.
287: If they are sent, death of the connection or crash of one
288: of the machines will be properly noticed.
289: However, this means that
290: connections will die if the route is down temporarily, and some people
291: find it annoying.
292: On the other hand, if keepalives are not sent,
293: sessions may hang indefinitely on the server, leaving
294: .Dq ghost
295: users and consuming server resources.
296: .Pp
297: The default is
298: .Dq yes
299: (to send keepalives), and the server will notice
300: if the network goes down or the client host crashes.
301: This avoids infinitely hanging sessions.
302: .Pp
303: To disable keepalives, the value should be set to
304: .Dq no .
305: .It Cm KerberosAuthentication
306: Specifies whether Kerberos authentication is allowed.
307: This can be in the form of a Kerberos ticket, or if
308: .Cm PasswordAuthentication
309: is yes, the password provided by the user will be validated through
310: the Kerberos KDC.
311: To use this option, the server needs a
312: Kerberos servtab which allows the verification of the KDC's identity.
313: Default is
314: .Dq no .
315: .It Cm KerberosOrLocalPasswd
316: If set then if password authentication through Kerberos fails then
317: the password will be validated via any additional local mechanism
318: such as
319: .Pa /etc/passwd .
320: Default is
321: .Dq yes .
322: .It Cm KerberosTgtPassing
323: Specifies whether a Kerberos TGT may be forwarded to the server.
324: Default is
325: .Dq no ,
326: as this only works when the Kerberos KDC is actually an AFS kaserver.
327: .It Cm KerberosTicketCleanup
328: Specifies whether to automatically destroy the user's ticket cache
329: file on logout.
330: Default is
331: .Dq yes .
332: .It Cm KeyRegenerationInterval
333: In protocol version 1, the ephemeral server key is automatically regenerated
334: after this many seconds (if it has been used).
335: The purpose of regeneration is to prevent
336: decrypting captured sessions by later breaking into the machine and
337: stealing the keys.
338: The key is never stored anywhere.
339: If the value is 0, the key is never regenerated.
340: The default is 3600 (seconds).
341: .It Cm ListenAddress
342: Specifies the local addresses
343: .Nm sshd
344: should listen on.
345: The following forms may be used:
346: .Pp
347: .Bl -item -offset indent -compact
348: .It
349: .Cm ListenAddress
350: .Sm off
351: .Ar host No | Ar IPv4_addr No | Ar IPv6_addr
352: .Sm on
353: .It
354: .Cm ListenAddress
355: .Sm off
356: .Ar host No | Ar IPv4_addr No : Ar port
357: .Sm on
358: .It
359: .Cm ListenAddress
360: .Sm off
361: .Oo
362: .Ar host No | Ar IPv6_addr Oc : Ar port
363: .Sm on
364: .El
365: .Pp
366: If
367: .Ar port
368: is not specified,
369: .Nm sshd
370: will listen on the address and all prior
371: .Cm Port
372: options specified. The default is to listen on all local
373: addresses. Multiple
374: .Cm ListenAddress
375: options are permitted. Additionally, any
376: .Cm Port
377: options must precede this option for non port qualified addresses.
378: .It Cm LoginGraceTime
379: The server disconnects after this time if the user has not
380: successfully logged in.
381: If the value is 0, there is no time limit.
1.12 stevesk 382: The default is 120 seconds.
1.1 stevesk 383: .It Cm LogLevel
384: Gives the verbosity level that is used when logging messages from
385: .Nm sshd .
386: The possible values are:
387: QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3.
388: The default is INFO. DEBUG and DEBUG1 are equivalent. DEBUG2
389: and DEBUG3 each specify higher levels of debugging output.
390: Logging with a DEBUG level violates the privacy of users
391: and is not recommended.
392: .It Cm MACs
393: Specifies the available MAC (message authentication code) algorithms.
394: The MAC algorithm is used in protocol version 2
395: for data integrity protection.
396: Multiple algorithms must be comma-separated.
397: The default is
398: .Dq hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96 .
399: .It Cm MaxStartups
400: Specifies the maximum number of concurrent unauthenticated connections to the
401: .Nm sshd
402: daemon.
403: Additional connections will be dropped until authentication succeeds or the
404: .Cm LoginGraceTime
405: expires for a connection.
406: The default is 10.
407: .Pp
408: Alternatively, random early drop can be enabled by specifying
409: the three colon separated values
410: .Dq start:rate:full
411: (e.g., "10:30:60").
412: .Nm sshd
413: will refuse connection attempts with a probability of
414: .Dq rate/100
415: (30%)
416: if there are currently
417: .Dq start
418: (10)
419: unauthenticated connections.
420: The probability increases linearly and all connection attempts
421: are refused if the number of unauthenticated connections reaches
422: .Dq full
423: (60).
424: .It Cm PasswordAuthentication
425: Specifies whether password authentication is allowed.
426: The default is
427: .Dq yes .
428: .It Cm PermitEmptyPasswords
429: When password authentication is allowed, it specifies whether the
430: server allows login to accounts with empty password strings.
431: The default is
432: .Dq no .
433: .It Cm PermitRootLogin
434: Specifies whether root can login using
435: .Xr ssh 1 .
436: The argument must be
437: .Dq yes ,
438: .Dq without-password ,
439: .Dq forced-commands-only
440: or
441: .Dq no .
442: The default is
443: .Dq yes .
444: .Pp
445: If this option is set to
446: .Dq without-password
447: password authentication is disabled for root.
448: .Pp
449: If this option is set to
450: .Dq forced-commands-only
451: root login with public key authentication will be allowed,
452: but only if the
453: .Ar command
454: option has been specified
455: (which may be useful for taking remote backups even if root login is
456: normally not allowed). All other authentication methods are disabled
457: for root.
458: .Pp
459: If this option is set to
460: .Dq no
461: root is not allowed to login.
1.6 markus 462: .It Cm PermitUserEnvironment
463: Specifies whether
464: .Pa ~/.ssh/environment
1.9 stevesk 465: and
1.6 markus 466: .Cm environment=
467: options in
468: .Pa ~/.ssh/authorized_keys
1.9 stevesk 469: are processed by
470: .Nm sshd .
1.6 markus 471: The default is
472: .Dq no .
1.9 stevesk 473: Enabling environment processing may enable users to bypass access
474: restrictions in some configurations using mechanisms such as
475: .Ev LD_PRELOAD .
1.1 stevesk 476: .It Cm PidFile
1.4 stevesk 477: Specifies the file that contains the process ID of the
1.1 stevesk 478: .Nm sshd
479: daemon.
480: The default is
481: .Pa /var/run/sshd.pid .
482: .It Cm Port
483: Specifies the port number that
484: .Nm sshd
485: listens on.
486: The default is 22.
487: Multiple options of this type are permitted.
488: See also
489: .Cm ListenAddress .
490: .It Cm PrintLastLog
491: Specifies whether
492: .Nm sshd
493: should print the date and time when the user last logged in.
494: The default is
495: .Dq yes .
496: .It Cm PrintMotd
497: Specifies whether
498: .Nm sshd
499: should print
500: .Pa /etc/motd
501: when a user logs in interactively.
502: (On some systems it is also printed by the shell,
503: .Pa /etc/profile ,
504: or equivalent.)
505: The default is
506: .Dq yes .
507: .It Cm Protocol
508: Specifies the protocol versions
509: .Nm sshd
1.5 stevesk 510: supports.
1.1 stevesk 511: The possible values are
512: .Dq 1
513: and
514: .Dq 2 .
515: Multiple versions must be comma-separated.
516: The default is
517: .Dq 2,1 .
1.5 stevesk 518: Note that the order of the protocol list does not indicate preference,
519: because the client selects among multiple protocol versions offered
520: by the server.
521: Specifying
522: .Dq 2,1
523: is identical to
524: .Dq 1,2 .
1.1 stevesk 525: .It Cm PubkeyAuthentication
526: Specifies whether public key authentication is allowed.
527: The default is
528: .Dq yes .
529: Note that this option applies to protocol version 2 only.
530: .It Cm RhostsAuthentication
531: Specifies whether authentication using rhosts or /etc/hosts.equiv
532: files is sufficient.
533: Normally, this method should not be permitted because it is insecure.
534: .Cm RhostsRSAAuthentication
535: should be used
536: instead, because it performs RSA-based host authentication in addition
537: to normal rhosts or /etc/hosts.equiv authentication.
538: The default is
539: .Dq no .
540: This option applies to protocol version 1 only.
541: .It Cm RhostsRSAAuthentication
542: Specifies whether rhosts or /etc/hosts.equiv authentication together
543: with successful RSA host authentication is allowed.
544: The default is
545: .Dq no .
546: This option applies to protocol version 1 only.
547: .It Cm RSAAuthentication
548: Specifies whether pure RSA authentication is allowed.
549: The default is
550: .Dq yes .
551: This option applies to protocol version 1 only.
552: .It Cm ServerKeyBits
553: Defines the number of bits in the ephemeral protocol version 1 server key.
554: The minimum value is 512, and the default is 768.
555: .It Cm StrictModes
556: Specifies whether
557: .Nm sshd
558: should check file modes and ownership of the
559: user's files and home directory before accepting login.
560: This is normally desirable because novices sometimes accidentally leave their
561: directory or files world-writable.
562: The default is
563: .Dq yes .
564: .It Cm Subsystem
565: Configures an external subsystem (e.g., file transfer daemon).
566: Arguments should be a subsystem name and a command to execute upon subsystem
567: request.
568: The command
569: .Xr sftp-server 8
570: implements the
571: .Dq sftp
572: file transfer subsystem.
573: By default no subsystems are defined.
574: Note that this option applies to protocol version 2 only.
575: .It Cm SyslogFacility
576: Gives the facility code that is used when logging messages from
577: .Nm sshd .
578: The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2,
579: LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
580: The default is AUTH.
581: .It Cm UseLogin
582: Specifies whether
583: .Xr login 1
584: is used for interactive login sessions.
585: The default is
586: .Dq no .
587: Note that
588: .Xr login 1
589: is never used for remote command execution.
590: Note also, that if this is enabled,
591: .Cm X11Forwarding
592: will be disabled because
593: .Xr login 1
594: does not know how to handle
595: .Xr xauth 1
596: cookies. If
597: .Cm UsePrivilegeSeparation
598: is specified, it will be disabled after authentication.
599: .It Cm UsePrivilegeSeparation
600: Specifies whether
601: .Nm sshd
1.2 stevesk 602: separates privileges by creating an unprivileged child process
1.1 stevesk 603: to deal with incoming network traffic. After successful authentication,
604: another process will be created that has the privilege of the authenticated
605: user. The goal of privilege separation is to prevent privilege
606: escalation by containing any corruption within the unprivileged processes.
607: The default is
608: .Dq yes .
609: .It Cm VerifyReverseMapping
610: Specifies whether
611: .Nm sshd
612: should try to verify the remote host name and check that
613: the resolved host name for the remote IP address maps back to the
614: very same IP address.
615: The default is
616: .Dq no .
617: .It Cm X11DisplayOffset
618: Specifies the first display number available for
619: .Nm sshd Ns 's
620: X11 forwarding.
621: This prevents
622: .Nm sshd
623: from interfering with real X11 servers.
624: The default is 10.
625: .It Cm X11Forwarding
626: Specifies whether X11 forwarding is permitted.
1.13 ! stevesk 627: The argument must be
! 628: .Dq yes
! 629: or
! 630: .Dq no .
1.1 stevesk 631: The default is
632: .Dq no .
1.13 ! stevesk 633: .Pp
! 634: When X11 forwarding is enabled, there may be additional exposure to
! 635: the server and to client displays if the
! 636: .Nm sshd
! 637: proxy display is configured to listen on the wildcard address (see
! 638: .Cm X11UseLocalhost
! 639: below), however this is not the default.
! 640: Additionally, the authentication spoofing and authentication data
! 641: verification and substitution occur on the client side.
! 642: The security risk of using X11 forwarding is that the client's X11
! 643: display server may be exposed to attack when the ssh client requests
! 644: forwarding (see the warnings for
! 645: .Cm ForwardX11
! 646: in
! 647: .Xr ssh_config 5 ).
! 648: A system administrator may have a stance in which they want to
! 649: protect clients that may expose themselves to attack by unwittingly
! 650: requesting X11 forwarding, which can warrant a
! 651: .Dq no
! 652: setting.
! 653: .Pp
! 654: Note that disabling X11 forwarding does not prevent users from
! 655: forwarding X11 traffic, as users can always install their own forwarders.
1.1 stevesk 656: X11 forwarding is automatically disabled if
657: .Cm UseLogin
658: is enabled.
659: .It Cm X11UseLocalhost
660: Specifies whether
661: .Nm sshd
662: should bind the X11 forwarding server to the loopback address or to
663: the wildcard address. By default,
664: .Nm sshd
665: binds the forwarding server to the loopback address and sets the
666: hostname part of the
667: .Ev DISPLAY
668: environment variable to
669: .Dq localhost .
1.8 stevesk 670: This prevents remote hosts from connecting to the proxy display.
1.1 stevesk 671: However, some older X11 clients may not function with this
672: configuration.
673: .Cm X11UseLocalhost
674: may be set to
675: .Dq no
676: to specify that the forwarding server should be bound to the wildcard
677: address.
678: The argument must be
679: .Dq yes
680: or
681: .Dq no .
682: The default is
683: .Dq yes .
684: .It Cm XAuthLocation
1.11 stevesk 685: Specifies the full pathname of the
1.1 stevesk 686: .Xr xauth 1
687: program.
688: The default is
689: .Pa /usr/X11R6/bin/xauth .
690: .El
691: .Ss Time Formats
692: .Pp
693: .Nm sshd
694: command-line arguments and configuration file options that specify time
695: may be expressed using a sequence of the form:
696: .Sm off
1.7 stevesk 697: .Ar time Op Ar qualifier ,
1.1 stevesk 698: .Sm on
699: where
700: .Ar time
701: is a positive integer value and
702: .Ar qualifier
703: is one of the following:
704: .Pp
705: .Bl -tag -width Ds -compact -offset indent
706: .It Cm <none>
707: seconds
708: .It Cm s | Cm S
709: seconds
710: .It Cm m | Cm M
711: minutes
712: .It Cm h | Cm H
713: hours
714: .It Cm d | Cm D
715: days
716: .It Cm w | Cm W
717: weeks
718: .El
719: .Pp
720: Each member of the sequence is added together to calculate
721: the total time value.
722: .Pp
723: Time format examples:
724: .Pp
725: .Bl -tag -width Ds -compact -offset indent
726: .It 600
727: 600 seconds (10 minutes)
728: .It 10m
729: 10 minutes
730: .It 1h30m
731: 1 hour 30 minutes (90 minutes)
732: .El
733: .Sh FILES
734: .Bl -tag -width Ds
735: .It Pa /etc/ssh/sshd_config
736: Contains configuration data for
737: .Nm sshd .
738: This file should be writable by root only, but it is recommended
739: (though not necessary) that it be world-readable.
740: .El
741: .Sh AUTHORS
742: OpenSSH is a derivative of the original and free
743: ssh 1.2.12 release by Tatu Ylonen.
744: Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos,
745: Theo de Raadt and Dug Song
746: removed many bugs, re-added newer features and
747: created OpenSSH.
748: Markus Friedl contributed the support for SSH
749: protocol versions 1.5 and 2.0.
750: Niels Provos and Markus Friedl contributed support
751: for privilege separation.
752: .Sh SEE ALSO
753: .Xr sshd 8