Annotation of src/usr.bin/ssh/sshd_config.5, Revision 1.14.2.2
1.1 stevesk 1: .\" -*- nroff -*-
2: .\"
3: .\" Author: Tatu Ylonen <ylo@cs.hut.fi>
4: .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5: .\" All rights reserved
6: .\"
7: .\" As far as I am concerned, the code I have written for this software
8: .\" can be used freely for any purpose. Any derived versions of this
9: .\" software must be clearly marked as such, and if the derived work is
10: .\" incompatible with the protocol description in the RFC file, it must be
11: .\" called by a name other than "ssh" or "Secure Shell".
12: .\"
13: .\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved.
14: .\" Copyright (c) 1999 Aaron Campbell. All rights reserved.
15: .\" Copyright (c) 1999 Theo de Raadt. All rights reserved.
16: .\"
17: .\" Redistribution and use in source and binary forms, with or without
18: .\" modification, are permitted provided that the following conditions
19: .\" are met:
20: .\" 1. Redistributions of source code must retain the above copyright
21: .\" notice, this list of conditions and the following disclaimer.
22: .\" 2. Redistributions in binary form must reproduce the above copyright
23: .\" notice, this list of conditions and the following disclaimer in the
24: .\" documentation and/or other materials provided with the distribution.
25: .\"
26: .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
27: .\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
28: .\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
29: .\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
30: .\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
31: .\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
32: .\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
33: .\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
34: .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35: .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36: .\"
1.14.2.2! brad 37: .\" $OpenBSD: sshd_config.5,v 1.25 2003/09/01 09:50:04 markus Exp $
1.1 stevesk 38: .Dd September 25, 1999
39: .Dt SSHD_CONFIG 5
40: .Os
41: .Sh NAME
42: .Nm sshd_config
43: .Nd OpenSSH SSH daemon configuration file
44: .Sh SYNOPSIS
45: .Bl -tag -width Ds -compact
46: .It Pa /etc/ssh/sshd_config
47: .El
48: .Sh DESCRIPTION
49: .Nm sshd
50: reads configuration data from
51: .Pa /etc/ssh/sshd_config
52: (or the file specified with
53: .Fl f
54: on the command line).
55: The file contains keyword-argument pairs, one per line.
56: Lines starting with
57: .Ql #
58: and empty lines are interpreted as comments.
59: .Pp
60: The possible
61: keywords and their meanings are as follows (note that
62: keywords are case-insensitive and arguments are case-sensitive):
63: .Bl -tag -width Ds
64: .It Cm AllowGroups
65: This keyword can be followed by a list of group name patterns, separated
66: by spaces.
67: If specified, login is allowed only for users whose primary
68: group or supplementary group list matches one of the patterns.
69: .Ql \&*
70: and
1.14.2.2! brad 71: .Ql \&?
1.1 stevesk 72: can be used as
73: wildcards in the patterns.
74: Only group names are valid; a numerical group ID is not recognized.
75: By default, login is allowed for all groups.
76: .Pp
77: .It Cm AllowTcpForwarding
78: Specifies whether TCP forwarding is permitted.
79: The default is
80: .Dq yes .
81: Note that disabling TCP forwarding does not improve security unless
82: users are also denied shell access, as they can always install their
83: own forwarders.
84: .Pp
85: .It Cm AllowUsers
86: This keyword can be followed by a list of user name patterns, separated
87: by spaces.
1.14 jmc 88: If specified, login is allowed only for user names that
1.1 stevesk 89: match one of the patterns.
90: .Ql \&*
91: and
1.14.2.2! brad 92: .Ql \&?
1.1 stevesk 93: can be used as
94: wildcards in the patterns.
95: Only user names are valid; a numerical user ID is not recognized.
96: By default, login is allowed for all users.
97: If the pattern takes the form USER@HOST then USER and HOST
98: are separately checked, restricting logins to particular
99: users from particular hosts.
100: .Pp
101: .It Cm AuthorizedKeysFile
102: Specifies the file that contains the public keys that can be used
103: for user authentication.
104: .Cm AuthorizedKeysFile
105: may contain tokens of the form %T which are substituted during connection
1.14.2.2! brad 106: set-up.
! 107: The following tokens are defined: %% is replaced by a literal '%',
1.1 stevesk 108: %h is replaced by the home directory of the user being authenticated and
109: %u is replaced by the username of that user.
110: After expansion,
111: .Cm AuthorizedKeysFile
112: is taken to be an absolute path or one relative to the user's home
113: directory.
114: The default is
115: .Dq .ssh/authorized_keys .
116: .It Cm Banner
117: In some jurisdictions, sending a warning message before authentication
118: may be relevant for getting legal protection.
119: The contents of the specified file are sent to the remote user before
120: authentication is allowed.
121: This option is only available for protocol version 2.
122: By default, no banner is displayed.
123: .Pp
124: .It Cm ChallengeResponseAuthentication
125: Specifies whether challenge response authentication is allowed.
126: All authentication styles from
127: .Xr login.conf 5
128: are supported.
129: The default is
130: .Dq yes .
131: .It Cm Ciphers
132: Specifies the ciphers allowed for protocol version 2.
133: Multiple ciphers must be comma-separated.
134: The default is
135: .Pp
136: .Bd -literal
137: ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
1.14.2.2! brad 138: aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr''
1.1 stevesk 139: .Ed
140: .It Cm ClientAliveInterval
141: Sets a timeout interval in seconds after which if no data has been received
142: from the client,
143: .Nm sshd
144: will send a message through the encrypted
145: channel to request a response from the client.
146: The default
147: is 0, indicating that these messages will not be sent to the client.
148: This option applies to protocol version 2 only.
149: .It Cm ClientAliveCountMax
150: Sets the number of client alive messages (see above) which may be
151: sent without
152: .Nm sshd
1.14.2.2! brad 153: receiving any messages back from the client.
! 154: If this threshold is reached while client alive messages are being sent,
1.1 stevesk 155: .Nm sshd
1.14.2.2! brad 156: will disconnect the client, terminating the session.
! 157: It is important to note that the use of client alive messages is very
! 158: different from
1.1 stevesk 159: .Cm KeepAlive
1.14.2.2! brad 160: (below).
! 161: The client alive messages are sent through the encrypted channel
! 162: and therefore will not be spoofable.
! 163: The TCP keepalive option enabled by
1.1 stevesk 164: .Cm KeepAlive
1.14.2.2! brad 165: is spoofable.
! 166: The client alive mechanism is valuable when the client or
1.1 stevesk 167: server depend on knowing when a connection has become inactive.
168: .Pp
1.14.2.2! brad 169: The default value is 3.
! 170: If
1.1 stevesk 171: .Cm ClientAliveInterval
172: (above) is set to 15, and
173: .Cm ClientAliveCountMax
174: is left at the default, unresponsive ssh clients
175: will be disconnected after approximately 45 seconds.
1.3 markus 176: .It Cm Compression
177: Specifies whether compression is allowed.
178: The argument must be
179: .Dq yes
180: or
181: .Dq no .
182: The default is
183: .Dq yes .
1.1 stevesk 184: .It Cm DenyGroups
185: This keyword can be followed by a list of group name patterns, separated
186: by spaces.
187: Login is disallowed for users whose primary group or supplementary
188: group list matches one of the patterns.
189: .Ql \&*
190: and
1.14.2.2! brad 191: .Ql \&?
1.1 stevesk 192: can be used as
193: wildcards in the patterns.
194: Only group names are valid; a numerical group ID is not recognized.
195: By default, login is allowed for all groups.
196: .Pp
197: .It Cm DenyUsers
198: This keyword can be followed by a list of user name patterns, separated
199: by spaces.
200: Login is disallowed for user names that match one of the patterns.
201: .Ql \&*
202: and
1.14.2.2! brad 203: .Ql \&?
1.1 stevesk 204: can be used as wildcards in the patterns.
205: Only user names are valid; a numerical user ID is not recognized.
206: By default, login is allowed for all users.
207: If the pattern takes the form USER@HOST then USER and HOST
208: are separately checked, restricting logins to particular
209: users from particular hosts.
210: .It Cm GatewayPorts
211: Specifies whether remote hosts are allowed to connect to ports
212: forwarded for the client.
213: By default,
214: .Nm sshd
1.14.2.1 margarid 215: binds remote port forwardings to the loopback address.
216: This prevents other remote hosts from connecting to forwarded ports.
1.1 stevesk 217: .Cm GatewayPorts
218: can be used to specify that
219: .Nm sshd
220: should bind remote port forwardings to the wildcard address,
221: thus allowing remote hosts to connect to forwarded ports.
222: The argument must be
223: .Dq yes
224: or
225: .Dq no .
226: The default is
227: .Dq no .
1.14.2.2! brad 228: .It Cm GSSAPIAuthentication
! 229: Specifies whether user authentication based on GSSAPI is allowed.
! 230: The default is
! 231: .Dq no .
! 232: Note that this option applies to protocol version 2 only.
! 233: .It Cm GSSAPICleanupCredentials
! 234: Specifies whether to automatically destroy the user's credentials cache
! 235: on logout.
! 236: The default is
! 237: .Dq yes .
! 238: Note that this option applies to protocol version 2 only.
1.1 stevesk 239: .It Cm HostbasedAuthentication
240: Specifies whether rhosts or /etc/hosts.equiv authentication together
241: with successful public key client host authentication is allowed
242: (hostbased authentication).
243: This option is similar to
244: .Cm RhostsRSAAuthentication
245: and applies to protocol version 2 only.
246: The default is
247: .Dq no .
248: .It Cm HostKey
249: Specifies a file containing a private host key
250: used by SSH.
251: The default is
252: .Pa /etc/ssh/ssh_host_key
253: for protocol version 1, and
254: .Pa /etc/ssh/ssh_host_rsa_key
255: and
256: .Pa /etc/ssh/ssh_host_dsa_key
257: for protocol version 2.
258: Note that
259: .Nm sshd
260: will refuse to use a file if it is group/world-accessible.
261: It is possible to have multiple host key files.
262: .Dq rsa1
263: keys are used for version 1 and
264: .Dq dsa
265: or
266: .Dq rsa
267: are used for version 2 of the SSH protocol.
268: .It Cm IgnoreRhosts
269: Specifies that
270: .Pa .rhosts
271: and
272: .Pa .shosts
273: files will not be used in
274: .Cm RhostsRSAAuthentication
275: or
276: .Cm HostbasedAuthentication .
277: .Pp
278: .Pa /etc/hosts.equiv
279: and
280: .Pa /etc/shosts.equiv
281: are still used.
282: The default is
283: .Dq yes .
284: .It Cm IgnoreUserKnownHosts
285: Specifies whether
286: .Nm sshd
287: should ignore the user's
288: .Pa $HOME/.ssh/known_hosts
289: during
290: .Cm RhostsRSAAuthentication
291: or
292: .Cm HostbasedAuthentication .
293: The default is
294: .Dq no .
295: .It Cm KeepAlive
296: Specifies whether the system should send TCP keepalive messages to the
297: other side.
298: If they are sent, death of the connection or crash of one
299: of the machines will be properly noticed.
300: However, this means that
301: connections will die if the route is down temporarily, and some people
302: find it annoying.
303: On the other hand, if keepalives are not sent,
304: sessions may hang indefinitely on the server, leaving
305: .Dq ghost
306: users and consuming server resources.
307: .Pp
308: The default is
309: .Dq yes
310: (to send keepalives), and the server will notice
311: if the network goes down or the client host crashes.
312: This avoids infinitely hanging sessions.
313: .Pp
314: To disable keepalives, the value should be set to
315: .Dq no .
316: .It Cm KerberosAuthentication
1.14.2.2! brad 317: Specifies whether the password provided by the user for
1.1 stevesk 318: .Cm PasswordAuthentication
1.14.2.2! brad 319: will be validated through the Kerberos KDC.
1.1 stevesk 320: To use this option, the server needs a
321: Kerberos servtab which allows the verification of the KDC's identity.
322: Default is
323: .Dq no .
324: .It Cm KerberosOrLocalPasswd
325: If set then if password authentication through Kerberos fails then
326: the password will be validated via any additional local mechanism
327: such as
328: .Pa /etc/passwd .
329: Default is
330: .Dq yes .
331: .It Cm KerberosTicketCleanup
332: Specifies whether to automatically destroy the user's ticket cache
333: file on logout.
334: Default is
335: .Dq yes .
336: .It Cm KeyRegenerationInterval
337: In protocol version 1, the ephemeral server key is automatically regenerated
338: after this many seconds (if it has been used).
339: The purpose of regeneration is to prevent
340: decrypting captured sessions by later breaking into the machine and
341: stealing the keys.
342: The key is never stored anywhere.
343: If the value is 0, the key is never regenerated.
344: The default is 3600 (seconds).
345: .It Cm ListenAddress
346: Specifies the local addresses
347: .Nm sshd
348: should listen on.
349: The following forms may be used:
350: .Pp
351: .Bl -item -offset indent -compact
352: .It
353: .Cm ListenAddress
354: .Sm off
355: .Ar host No | Ar IPv4_addr No | Ar IPv6_addr
356: .Sm on
357: .It
358: .Cm ListenAddress
359: .Sm off
360: .Ar host No | Ar IPv4_addr No : Ar port
361: .Sm on
362: .It
363: .Cm ListenAddress
364: .Sm off
365: .Oo
366: .Ar host No | Ar IPv6_addr Oc : Ar port
367: .Sm on
368: .El
369: .Pp
370: If
371: .Ar port
372: is not specified,
373: .Nm sshd
374: will listen on the address and all prior
375: .Cm Port
1.14.2.2! brad 376: options specified.
! 377: The default is to listen on all local addresses.
1.14.2.1 margarid 378: Multiple
1.1 stevesk 379: .Cm ListenAddress
1.14.2.2! brad 380: options are permitted.
! 381: Additionally, any
1.1 stevesk 382: .Cm Port
383: options must precede this option for non port qualified addresses.
384: .It Cm LoginGraceTime
385: The server disconnects after this time if the user has not
386: successfully logged in.
387: If the value is 0, there is no time limit.
1.12 stevesk 388: The default is 120 seconds.
1.1 stevesk 389: .It Cm LogLevel
390: Gives the verbosity level that is used when logging messages from
391: .Nm sshd .
392: The possible values are:
393: QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3.
1.14.2.1 margarid 394: The default is INFO.
395: DEBUG and DEBUG1 are equivalent.
396: DEBUG2 and DEBUG3 each specify higher levels of debugging output.
397: Logging with a DEBUG level violates the privacy of users and is not recommended.
1.1 stevesk 398: .It Cm MACs
399: Specifies the available MAC (message authentication code) algorithms.
400: The MAC algorithm is used in protocol version 2
401: for data integrity protection.
402: Multiple algorithms must be comma-separated.
403: The default is
404: .Dq hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96 .
405: .It Cm MaxStartups
406: Specifies the maximum number of concurrent unauthenticated connections to the
407: .Nm sshd
408: daemon.
409: Additional connections will be dropped until authentication succeeds or the
410: .Cm LoginGraceTime
411: expires for a connection.
412: The default is 10.
413: .Pp
414: Alternatively, random early drop can be enabled by specifying
415: the three colon separated values
416: .Dq start:rate:full
417: (e.g., "10:30:60").
418: .Nm sshd
419: will refuse connection attempts with a probability of
420: .Dq rate/100
421: (30%)
422: if there are currently
423: .Dq start
424: (10)
425: unauthenticated connections.
426: The probability increases linearly and all connection attempts
427: are refused if the number of unauthenticated connections reaches
428: .Dq full
429: (60).
430: .It Cm PasswordAuthentication
431: Specifies whether password authentication is allowed.
432: The default is
433: .Dq yes .
434: .It Cm PermitEmptyPasswords
435: When password authentication is allowed, it specifies whether the
436: server allows login to accounts with empty password strings.
437: The default is
438: .Dq no .
439: .It Cm PermitRootLogin
440: Specifies whether root can login using
441: .Xr ssh 1 .
442: The argument must be
443: .Dq yes ,
444: .Dq without-password ,
445: .Dq forced-commands-only
446: or
447: .Dq no .
448: The default is
449: .Dq yes .
450: .Pp
451: If this option is set to
452: .Dq without-password
453: password authentication is disabled for root.
454: .Pp
455: If this option is set to
456: .Dq forced-commands-only
457: root login with public key authentication will be allowed,
458: but only if the
459: .Ar command
460: option has been specified
461: (which may be useful for taking remote backups even if root login is
1.14.2.2! brad 462: normally not allowed).
! 463: All other authentication methods are disabled for root.
1.1 stevesk 464: .Pp
465: If this option is set to
466: .Dq no
467: root is not allowed to login.
1.6 markus 468: .It Cm PermitUserEnvironment
469: Specifies whether
470: .Pa ~/.ssh/environment
1.9 stevesk 471: and
1.6 markus 472: .Cm environment=
473: options in
474: .Pa ~/.ssh/authorized_keys
1.9 stevesk 475: are processed by
476: .Nm sshd .
1.6 markus 477: The default is
478: .Dq no .
1.9 stevesk 479: Enabling environment processing may enable users to bypass access
480: restrictions in some configurations using mechanisms such as
481: .Ev LD_PRELOAD .
1.1 stevesk 482: .It Cm PidFile
1.4 stevesk 483: Specifies the file that contains the process ID of the
1.1 stevesk 484: .Nm sshd
485: daemon.
486: The default is
487: .Pa /var/run/sshd.pid .
488: .It Cm Port
489: Specifies the port number that
490: .Nm sshd
491: listens on.
492: The default is 22.
493: Multiple options of this type are permitted.
494: See also
495: .Cm ListenAddress .
496: .It Cm PrintLastLog
497: Specifies whether
498: .Nm sshd
499: should print the date and time when the user last logged in.
500: The default is
501: .Dq yes .
502: .It Cm PrintMotd
503: Specifies whether
504: .Nm sshd
505: should print
506: .Pa /etc/motd
507: when a user logs in interactively.
508: (On some systems it is also printed by the shell,
509: .Pa /etc/profile ,
510: or equivalent.)
511: The default is
512: .Dq yes .
513: .It Cm Protocol
514: Specifies the protocol versions
515: .Nm sshd
1.5 stevesk 516: supports.
1.1 stevesk 517: The possible values are
518: .Dq 1
519: and
520: .Dq 2 .
521: Multiple versions must be comma-separated.
522: The default is
523: .Dq 2,1 .
1.5 stevesk 524: Note that the order of the protocol list does not indicate preference,
525: because the client selects among multiple protocol versions offered
526: by the server.
527: Specifying
528: .Dq 2,1
529: is identical to
530: .Dq 1,2 .
1.1 stevesk 531: .It Cm PubkeyAuthentication
532: Specifies whether public key authentication is allowed.
533: The default is
534: .Dq yes .
535: Note that this option applies to protocol version 2 only.
536: .Cm RhostsRSAAuthentication
537: should be used
538: instead, because it performs RSA-based host authentication in addition
539: to normal rhosts or /etc/hosts.equiv authentication.
540: The default is
541: .Dq no .
542: This option applies to protocol version 1 only.
543: .It Cm RhostsRSAAuthentication
544: Specifies whether rhosts or /etc/hosts.equiv authentication together
545: with successful RSA host authentication is allowed.
546: The default is
547: .Dq no .
548: This option applies to protocol version 1 only.
549: .It Cm RSAAuthentication
550: Specifies whether pure RSA authentication is allowed.
551: The default is
552: .Dq yes .
553: This option applies to protocol version 1 only.
554: .It Cm ServerKeyBits
555: Defines the number of bits in the ephemeral protocol version 1 server key.
556: The minimum value is 512, and the default is 768.
557: .It Cm StrictModes
558: Specifies whether
559: .Nm sshd
560: should check file modes and ownership of the
561: user's files and home directory before accepting login.
562: This is normally desirable because novices sometimes accidentally leave their
563: directory or files world-writable.
564: The default is
565: .Dq yes .
566: .It Cm Subsystem
567: Configures an external subsystem (e.g., file transfer daemon).
568: Arguments should be a subsystem name and a command to execute upon subsystem
569: request.
570: The command
571: .Xr sftp-server 8
572: implements the
573: .Dq sftp
574: file transfer subsystem.
575: By default no subsystems are defined.
576: Note that this option applies to protocol version 2 only.
577: .It Cm SyslogFacility
578: Gives the facility code that is used when logging messages from
579: .Nm sshd .
580: The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2,
581: LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
582: The default is AUTH.
1.14.2.2! brad 583: .It Cm UseDNS
! 584: Specifies whether
! 585: .Nm sshd
! 586: should lookup the remote host name and check that
! 587: the resolved host name for the remote IP address maps back to the
! 588: very same IP address.
! 589: The default is
! 590: .Dq yes .
1.1 stevesk 591: .It Cm UseLogin
592: Specifies whether
593: .Xr login 1
594: is used for interactive login sessions.
595: The default is
596: .Dq no .
597: Note that
598: .Xr login 1
599: is never used for remote command execution.
600: Note also, that if this is enabled,
601: .Cm X11Forwarding
602: will be disabled because
603: .Xr login 1
604: does not know how to handle
605: .Xr xauth 1
1.14.2.1 margarid 606: cookies.
607: If
1.1 stevesk 608: .Cm UsePrivilegeSeparation
609: is specified, it will be disabled after authentication.
610: .It Cm UsePrivilegeSeparation
611: Specifies whether
612: .Nm sshd
1.2 stevesk 613: separates privileges by creating an unprivileged child process
1.14.2.1 margarid 614: to deal with incoming network traffic.
615: After successful authentication, another process will be created that has
616: the privilege of the authenticated user.
617: The goal of privilege separation is to prevent privilege
1.1 stevesk 618: escalation by containing any corruption within the unprivileged processes.
619: The default is
620: .Dq yes .
621: .It Cm X11DisplayOffset
622: Specifies the first display number available for
623: .Nm sshd Ns 's
624: X11 forwarding.
625: This prevents
626: .Nm sshd
627: from interfering with real X11 servers.
628: The default is 10.
629: .It Cm X11Forwarding
630: Specifies whether X11 forwarding is permitted.
1.13 stevesk 631: The argument must be
632: .Dq yes
633: or
634: .Dq no .
1.1 stevesk 635: The default is
636: .Dq no .
1.13 stevesk 637: .Pp
638: When X11 forwarding is enabled, there may be additional exposure to
639: the server and to client displays if the
640: .Nm sshd
641: proxy display is configured to listen on the wildcard address (see
642: .Cm X11UseLocalhost
643: below), however this is not the default.
644: Additionally, the authentication spoofing and authentication data
645: verification and substitution occur on the client side.
646: The security risk of using X11 forwarding is that the client's X11
647: display server may be exposed to attack when the ssh client requests
648: forwarding (see the warnings for
649: .Cm ForwardX11
650: in
1.14.2.2! brad 651: .Xr ssh_config 5 ) .
1.13 stevesk 652: A system administrator may have a stance in which they want to
653: protect clients that may expose themselves to attack by unwittingly
654: requesting X11 forwarding, which can warrant a
655: .Dq no
656: setting.
657: .Pp
658: Note that disabling X11 forwarding does not prevent users from
659: forwarding X11 traffic, as users can always install their own forwarders.
1.1 stevesk 660: X11 forwarding is automatically disabled if
661: .Cm UseLogin
662: is enabled.
663: .It Cm X11UseLocalhost
664: Specifies whether
665: .Nm sshd
666: should bind the X11 forwarding server to the loopback address or to
1.14.2.1 margarid 667: the wildcard address.
668: By default,
1.1 stevesk 669: .Nm sshd
670: binds the forwarding server to the loopback address and sets the
671: hostname part of the
672: .Ev DISPLAY
673: environment variable to
674: .Dq localhost .
1.8 stevesk 675: This prevents remote hosts from connecting to the proxy display.
1.1 stevesk 676: However, some older X11 clients may not function with this
677: configuration.
678: .Cm X11UseLocalhost
679: may be set to
680: .Dq no
681: to specify that the forwarding server should be bound to the wildcard
682: address.
683: The argument must be
684: .Dq yes
685: or
686: .Dq no .
687: The default is
688: .Dq yes .
689: .It Cm XAuthLocation
1.11 stevesk 690: Specifies the full pathname of the
1.1 stevesk 691: .Xr xauth 1
692: program.
693: The default is
694: .Pa /usr/X11R6/bin/xauth .
695: .El
696: .Ss Time Formats
697: .Nm sshd
698: command-line arguments and configuration file options that specify time
699: may be expressed using a sequence of the form:
700: .Sm off
1.7 stevesk 701: .Ar time Op Ar qualifier ,
1.1 stevesk 702: .Sm on
703: where
704: .Ar time
705: is a positive integer value and
706: .Ar qualifier
707: is one of the following:
708: .Pp
709: .Bl -tag -width Ds -compact -offset indent
710: .It Cm <none>
711: seconds
712: .It Cm s | Cm S
713: seconds
714: .It Cm m | Cm M
715: minutes
716: .It Cm h | Cm H
717: hours
718: .It Cm d | Cm D
719: days
720: .It Cm w | Cm W
721: weeks
722: .El
723: .Pp
724: Each member of the sequence is added together to calculate
725: the total time value.
726: .Pp
727: Time format examples:
728: .Pp
729: .Bl -tag -width Ds -compact -offset indent
730: .It 600
731: 600 seconds (10 minutes)
732: .It 10m
733: 10 minutes
734: .It 1h30m
735: 1 hour 30 minutes (90 minutes)
736: .El
737: .Sh FILES
738: .Bl -tag -width Ds
739: .It Pa /etc/ssh/sshd_config
740: Contains configuration data for
741: .Nm sshd .
742: This file should be writable by root only, but it is recommended
743: (though not necessary) that it be world-readable.
744: .El
1.14.2.2! brad 745: .Sh SEE ALSO
! 746: .Xr sshd 8
1.1 stevesk 747: .Sh AUTHORS
748: OpenSSH is a derivative of the original and free
749: ssh 1.2.12 release by Tatu Ylonen.
750: Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos,
751: Theo de Raadt and Dug Song
752: removed many bugs, re-added newer features and
753: created OpenSSH.
754: Markus Friedl contributed the support for SSH
755: protocol versions 1.5 and 2.0.
756: Niels Provos and Markus Friedl contributed support
757: for privilege separation.
![[BACK]](/icons/back.gif){kind=icon}
Return to sshd_config.5 CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh