diff options
author | Damien Miller <djm@mindrot.org> | 2006-03-15 11:56:56 +1100 |
---|---|---|
committer | Damien Miller <djm@mindrot.org> | 2006-03-15 11:56:56 +1100 |
commit | 5b0d63f8943dc7f9029ba5171b2a23acfa97f7aa (patch) | |
tree | 2f0cd066c306ebfd61ebacd792160056af537014 | |
parent | 45ee2b91e62eb382e0cd0c61a9b34c25b8efc36c (diff) |
- jmc@cvs.openbsd.org 2006/02/24 23:43:57
[sshd_config.5]
some grammar/wording fixes;
-rw-r--r-- | ChangeLog | 5 | ||||
-rw-r--r-- | sshd_config.5 | 107 |
2 files changed, 54 insertions, 58 deletions
@@ -172,6 +172,9 @@ | |||
172 | - jmc@cvs.openbsd.org 2006/02/24 23:20:07 | 172 | - jmc@cvs.openbsd.org 2006/02/24 23:20:07 |
173 | [ssh_config.5] | 173 | [ssh_config.5] |
174 | some grammar/wording fixes; | 174 | some grammar/wording fixes; |
175 | - jmc@cvs.openbsd.org 2006/02/24 23:43:57 | ||
176 | [sshd_config.5] | ||
177 | some grammar/wording fixes; | ||
175 | 178 | ||
176 | 20060313 | 179 | 20060313 |
177 | - (dtucker) [configure.ac] Bug #1171: Don't use printf("%lld", longlong) | 180 | - (dtucker) [configure.ac] Bug #1171: Don't use printf("%lld", longlong) |
@@ -4073,4 +4076,4 @@ | |||
4073 | - (djm) Trim deprecated options from INSTALL. Mention UsePAM | 4076 | - (djm) Trim deprecated options from INSTALL. Mention UsePAM |
4074 | - (djm) Fix quote handling in sftp; Patch from admorten AT umich.edu | 4077 | - (djm) Fix quote handling in sftp; Patch from admorten AT umich.edu |
4075 | 4078 | ||
4076 | $Id: ChangeLog,v 1.4188 2006/03/15 00:56:18 djm Exp $ | 4079 | $Id: ChangeLog,v 1.4189 2006/03/15 00:56:56 djm Exp $ |
diff --git a/sshd_config.5 b/sshd_config.5 index 642e1fa29..6f60d7e84 100644 --- a/sshd_config.5 +++ b/sshd_config.5 | |||
@@ -34,7 +34,7 @@ | |||
34 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | 34 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
35 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | 35 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
36 | .\" | 36 | .\" |
37 | .\" $OpenBSD: sshd_config.5,v 1.51 2006/02/24 20:31:31 jmc Exp $ | 37 | .\" $OpenBSD: sshd_config.5,v 1.52 2006/02/24 23:43:57 jmc Exp $ |
38 | .Dd September 25, 1999 | 38 | .Dd September 25, 1999 |
39 | .Dt SSHD_CONFIG 5 | 39 | .Dt SSHD_CONFIG 5 |
40 | .Os | 40 | .Os |
@@ -89,7 +89,7 @@ Specifies which address family should be used by | |||
89 | Valid arguments are | 89 | Valid arguments are |
90 | .Dq any , | 90 | .Dq any , |
91 | .Dq inet | 91 | .Dq inet |
92 | (use IPv4 only) or | 92 | (use IPv4 only), or |
93 | .Dq inet6 | 93 | .Dq inet6 |
94 | (use IPv6 only). | 94 | (use IPv6 only). |
95 | The default is | 95 | The default is |
@@ -135,9 +135,9 @@ Specifies the file that contains the public keys that can be used | |||
135 | for user authentication. | 135 | for user authentication. |
136 | .Cm AuthorizedKeysFile | 136 | .Cm AuthorizedKeysFile |
137 | may contain tokens of the form %T which are substituted during connection | 137 | may contain tokens of the form %T which are substituted during connection |
138 | set-up. | 138 | setup. |
139 | The following tokens are defined: %% is replaced by a literal '%', | 139 | The following tokens are defined: %% is replaced by a literal '%', |
140 | %h is replaced by the home directory of the user being authenticated and | 140 | %h is replaced by the home directory of the user being authenticated, and |
141 | %u is replaced by the username of that user. | 141 | %u is replaced by the username of that user. |
142 | After expansion, | 142 | After expansion, |
143 | .Cm AuthorizedKeysFile | 143 | .Cm AuthorizedKeysFile |
@@ -176,20 +176,19 @@ The supported ciphers are | |||
176 | .Dq blowfish-cbc , | 176 | .Dq blowfish-cbc , |
177 | and | 177 | and |
178 | .Dq cast128-cbc . | 178 | .Dq cast128-cbc . |
179 | The default is | 179 | The default is: |
180 | .Bd -literal | 180 | .Bd -literal -offset 3n |
181 | ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128, | 181 | aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128, |
182 | arcfour256,arcfour,aes192-cbc,aes256-cbc,aes128-ctr, | 182 | arcfour256,arcfour,aes192-cbc,aes256-cbc,aes128-ctr, |
183 | aes192-ctr,aes256-ctr'' | 183 | aes192-ctr,aes256-ctr |
184 | .Ed | 184 | .Ed |
185 | .It Cm ClientAliveCountMax | 185 | .It Cm ClientAliveCountMax |
186 | Sets the number of client alive messages (see below) which may be | 186 | Sets the number of client alive messages (see below) which may be |
187 | sent without | 187 | sent without |
188 | .Nm sshd | 188 | .Xr sshd 8 |
189 | receiving any messages back from the client. | 189 | receiving any messages back from the client. |
190 | If this threshold is reached while client alive messages are being sent, | 190 | If this threshold is reached while client alive messages are being sent, |
191 | .Nm sshd | 191 | sshd will disconnect the client, terminating the session. |
192 | will disconnect the client, terminating the session. | ||
193 | It is important to note that the use of client alive messages is very | 192 | It is important to note that the use of client alive messages is very |
194 | different from | 193 | different from |
195 | .Cm TCPKeepAlive | 194 | .Cm TCPKeepAlive |
@@ -207,12 +206,12 @@ If | |||
207 | .Cm ClientAliveInterval | 206 | .Cm ClientAliveInterval |
208 | (see below) is set to 15, and | 207 | (see below) is set to 15, and |
209 | .Cm ClientAliveCountMax | 208 | .Cm ClientAliveCountMax |
210 | is left at the default, unresponsive ssh clients | 209 | is left at the default, unresponsive SSH clients |
211 | will be disconnected after approximately 45 seconds. | 210 | will be disconnected after approximately 45 seconds. |
212 | .It Cm ClientAliveInterval | 211 | .It Cm ClientAliveInterval |
213 | Sets a timeout interval in seconds after which if no data has been received | 212 | Sets a timeout interval in seconds after which if no data has been received |
214 | from the client, | 213 | from the client, |
215 | .Nm sshd | 214 | .Xr sshd 8 |
216 | will send a message through the encrypted | 215 | will send a message through the encrypted |
217 | channel to request a response from the client. | 216 | channel to request a response from the client. |
218 | The default | 217 | The default |
@@ -260,12 +259,11 @@ for more information on patterns. | |||
260 | Specifies whether remote hosts are allowed to connect to ports | 259 | Specifies whether remote hosts are allowed to connect to ports |
261 | forwarded for the client. | 260 | forwarded for the client. |
262 | By default, | 261 | By default, |
263 | .Nm sshd | 262 | .Xr sshd 8 |
264 | binds remote port forwardings to the loopback address. | 263 | binds remote port forwardings to the loopback address. |
265 | This prevents other remote hosts from connecting to forwarded ports. | 264 | This prevents other remote hosts from connecting to forwarded ports. |
266 | .Cm GatewayPorts | 265 | .Cm GatewayPorts |
267 | can be used to specify that | 266 | can be used to specify that sshd |
268 | .Nm sshd | ||
269 | should allow remote port forwardings to bind to non-loopback addresses, thus | 267 | should allow remote port forwardings to bind to non-loopback addresses, thus |
270 | allowing other hosts to connect. | 268 | allowing other hosts to connect. |
271 | The argument may be | 269 | The argument may be |
@@ -308,7 +306,7 @@ and | |||
308 | .Pa /etc/ssh/ssh_host_dsa_key | 306 | .Pa /etc/ssh/ssh_host_dsa_key |
309 | for protocol version 2. | 307 | for protocol version 2. |
310 | Note that | 308 | Note that |
311 | .Nm sshd | 309 | .Xr sshd 8 |
312 | will refuse to use a file if it is group/world-accessible. | 310 | will refuse to use a file if it is group/world-accessible. |
313 | It is possible to have multiple host key files. | 311 | It is possible to have multiple host key files. |
314 | .Dq rsa1 | 312 | .Dq rsa1 |
@@ -335,7 +333,7 @@ The default is | |||
335 | .Dq yes . | 333 | .Dq yes . |
336 | .It Cm IgnoreUserKnownHosts | 334 | .It Cm IgnoreUserKnownHosts |
337 | Specifies whether | 335 | Specifies whether |
338 | .Nm sshd | 336 | .Xr sshd 8 |
339 | should ignore the user's | 337 | should ignore the user's |
340 | .Pa ~/.ssh/known_hosts | 338 | .Pa ~/.ssh/known_hosts |
341 | during | 339 | during |
@@ -350,24 +348,24 @@ Specifies whether the password provided by the user for | |||
350 | will be validated through the Kerberos KDC. | 348 | will be validated through the Kerberos KDC. |
351 | To use this option, the server needs a | 349 | To use this option, the server needs a |
352 | Kerberos servtab which allows the verification of the KDC's identity. | 350 | Kerberos servtab which allows the verification of the KDC's identity. |
353 | Default is | 351 | The default is |
354 | .Dq no . | 352 | .Dq no . |
355 | .It Cm KerberosGetAFSToken | 353 | .It Cm KerberosGetAFSToken |
356 | If AFS is active and the user has a Kerberos 5 TGT, attempt to acquire | 354 | If AFS is active and the user has a Kerberos 5 TGT, attempt to acquire |
357 | an AFS token before accessing the user's home directory. | 355 | an AFS token before accessing the user's home directory. |
358 | Default is | 356 | The default is |
359 | .Dq no . | 357 | .Dq no . |
360 | .It Cm KerberosOrLocalPasswd | 358 | .It Cm KerberosOrLocalPasswd |
361 | If set then if password authentication through Kerberos fails then | 359 | If password authentication through Kerberos fails then |
362 | the password will be validated via any additional local mechanism | 360 | the password will be validated via any additional local mechanism |
363 | such as | 361 | such as |
364 | .Pa /etc/passwd . | 362 | .Pa /etc/passwd . |
365 | Default is | 363 | The default is |
366 | .Dq yes . | 364 | .Dq yes . |
367 | .It Cm KerberosTicketCleanup | 365 | .It Cm KerberosTicketCleanup |
368 | Specifies whether to automatically destroy the user's ticket cache | 366 | Specifies whether to automatically destroy the user's ticket cache |
369 | file on logout. | 367 | file on logout. |
370 | Default is | 368 | The default is |
371 | .Dq yes . | 369 | .Dq yes . |
372 | .It Cm KeyRegenerationInterval | 370 | .It Cm KeyRegenerationInterval |
373 | In protocol version 1, the ephemeral server key is automatically regenerated | 371 | In protocol version 1, the ephemeral server key is automatically regenerated |
@@ -380,7 +378,7 @@ If the value is 0, the key is never regenerated. | |||
380 | The default is 3600 (seconds). | 378 | The default is 3600 (seconds). |
381 | .It Cm ListenAddress | 379 | .It Cm ListenAddress |
382 | Specifies the local addresses | 380 | Specifies the local addresses |
383 | .Nm sshd | 381 | .Xr sshd 8 |
384 | should listen on. | 382 | should listen on. |
385 | The following forms may be used: | 383 | The following forms may be used: |
386 | .Pp | 384 | .Pp |
@@ -406,8 +404,7 @@ The following forms may be used: | |||
406 | If | 404 | If |
407 | .Ar port | 405 | .Ar port |
408 | is not specified, | 406 | is not specified, |
409 | .Nm sshd | 407 | sshd will listen on the address and all prior |
410 | will listen on the address and all prior | ||
411 | .Cm Port | 408 | .Cm Port |
412 | options specified. | 409 | options specified. |
413 | The default is to listen on all local addresses. | 410 | The default is to listen on all local addresses. |
@@ -416,7 +413,7 @@ Multiple | |||
416 | options are permitted. | 413 | options are permitted. |
417 | Additionally, any | 414 | Additionally, any |
418 | .Cm Port | 415 | .Cm Port |
419 | options must precede this option for non port qualified addresses. | 416 | options must precede this option for non-port qualified addresses. |
420 | .It Cm LoginGraceTime | 417 | .It Cm LoginGraceTime |
421 | The server disconnects after this time if the user has not | 418 | The server disconnects after this time if the user has not |
422 | successfully logged in. | 419 | successfully logged in. |
@@ -426,7 +423,7 @@ The default is 120 seconds. | |||
426 | Gives the verbosity level that is used when logging messages from | 423 | Gives the verbosity level that is used when logging messages from |
427 | .Nm sshd . | 424 | .Nm sshd . |
428 | The possible values are: | 425 | The possible values are: |
429 | QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3. | 426 | QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. |
430 | The default is INFO. | 427 | The default is INFO. |
431 | DEBUG and DEBUG1 are equivalent. | 428 | DEBUG and DEBUG1 are equivalent. |
432 | DEBUG2 and DEBUG3 each specify higher levels of debugging output. | 429 | DEBUG2 and DEBUG3 each specify higher levels of debugging output. |
@@ -436,7 +433,7 @@ Specifies the available MAC (message authentication code) algorithms. | |||
436 | The MAC algorithm is used in protocol version 2 | 433 | The MAC algorithm is used in protocol version 2 |
437 | for data integrity protection. | 434 | for data integrity protection. |
438 | Multiple algorithms must be comma-separated. | 435 | Multiple algorithms must be comma-separated. |
439 | The default is | 436 | The default is: |
440 | .Dq hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96 . | 437 | .Dq hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96 . |
441 | .It Cm MaxAuthTries | 438 | .It Cm MaxAuthTries |
442 | Specifies the maximum number of authentication attempts permitted per | 439 | Specifies the maximum number of authentication attempts permitted per |
@@ -446,8 +443,7 @@ additional failures are logged. | |||
446 | The default is 6. | 443 | The default is 6. |
447 | .It Cm MaxStartups | 444 | .It Cm MaxStartups |
448 | Specifies the maximum number of concurrent unauthenticated connections to the | 445 | Specifies the maximum number of concurrent unauthenticated connections to the |
449 | .Nm sshd | 446 | SSH daemon. |
450 | daemon. | ||
451 | Additional connections will be dropped until authentication succeeds or the | 447 | Additional connections will be dropped until authentication succeeds or the |
452 | .Cm LoginGraceTime | 448 | .Cm LoginGraceTime |
453 | expires for a connection. | 449 | expires for a connection. |
@@ -484,18 +480,18 @@ Specifies whether root can log in using | |||
484 | The argument must be | 480 | The argument must be |
485 | .Dq yes , | 481 | .Dq yes , |
486 | .Dq without-password , | 482 | .Dq without-password , |
487 | .Dq forced-commands-only | 483 | .Dq forced-commands-only , |
488 | or | 484 | or |
489 | .Dq no . | 485 | .Dq no . |
490 | The default is | 486 | The default is |
491 | .Dq yes . | 487 | .Dq yes . |
492 | .Pp | 488 | .Pp |
493 | If this option is set to | 489 | If this option is set to |
494 | .Dq without-password | 490 | .Dq without-password , |
495 | password authentication is disabled for root. | 491 | password authentication is disabled for root. |
496 | .Pp | 492 | .Pp |
497 | If this option is set to | 493 | If this option is set to |
498 | .Dq forced-commands-only | 494 | .Dq forced-commands-only , |
499 | root login with public key authentication will be allowed, | 495 | root login with public key authentication will be allowed, |
500 | but only if the | 496 | but only if the |
501 | .Ar command | 497 | .Ar command |
@@ -505,7 +501,7 @@ normally not allowed). | |||
505 | All other authentication methods are disabled for root. | 501 | All other authentication methods are disabled for root. |
506 | .Pp | 502 | .Pp |
507 | If this option is set to | 503 | If this option is set to |
508 | .Dq no | 504 | .Dq no , |
509 | root is not allowed to log in. | 505 | root is not allowed to log in. |
510 | .It Cm PermitTunnel | 506 | .It Cm PermitTunnel |
511 | Specifies whether | 507 | Specifies whether |
@@ -514,7 +510,7 @@ device forwarding is allowed. | |||
514 | The argument must be | 510 | The argument must be |
515 | .Dq yes , | 511 | .Dq yes , |
516 | .Dq point-to-point , | 512 | .Dq point-to-point , |
517 | .Dq ethernet | 513 | .Dq ethernet , |
518 | or | 514 | or |
519 | .Dq no . | 515 | .Dq no . |
520 | The default is | 516 | The default is |
@@ -527,7 +523,7 @@ and | |||
527 | options in | 523 | options in |
528 | .Pa ~/.ssh/authorized_keys | 524 | .Pa ~/.ssh/authorized_keys |
529 | are processed by | 525 | are processed by |
530 | .Nm sshd . | 526 | .Xr sshd 8 . |
531 | The default is | 527 | The default is |
532 | .Dq no . | 528 | .Dq no . |
533 | Enabling environment processing may enable users to bypass access | 529 | Enabling environment processing may enable users to bypass access |
@@ -541,7 +537,7 @@ The default is | |||
541 | .Pa /var/run/sshd.pid . | 537 | .Pa /var/run/sshd.pid . |
542 | .It Cm Port | 538 | .It Cm Port |
543 | Specifies the port number that | 539 | Specifies the port number that |
544 | .Nm sshd | 540 | .Xr sshd 8 |
545 | listens on. | 541 | listens on. |
546 | The default is 22. | 542 | The default is 22. |
547 | Multiple options of this type are permitted. | 543 | Multiple options of this type are permitted. |
@@ -549,14 +545,14 @@ See also | |||
549 | .Cm ListenAddress . | 545 | .Cm ListenAddress . |
550 | .It Cm PrintLastLog | 546 | .It Cm PrintLastLog |
551 | Specifies whether | 547 | Specifies whether |
552 | .Nm sshd | 548 | .Xr sshd 8 |
553 | should print the date and time of the last user login when a user logs | 549 | should print the date and time of the last user login when a user logs |
554 | in interactively. | 550 | in interactively. |
555 | The default is | 551 | The default is |
556 | .Dq yes . | 552 | .Dq yes . |
557 | .It Cm PrintMotd | 553 | .It Cm PrintMotd |
558 | Specifies whether | 554 | Specifies whether |
559 | .Nm sshd | 555 | .Xr sshd 8 |
560 | should print | 556 | should print |
561 | .Pa /etc/motd | 557 | .Pa /etc/motd |
562 | when a user logs in interactively. | 558 | when a user logs in interactively. |
@@ -567,12 +563,12 @@ The default is | |||
567 | .Dq yes . | 563 | .Dq yes . |
568 | .It Cm Protocol | 564 | .It Cm Protocol |
569 | Specifies the protocol versions | 565 | Specifies the protocol versions |
570 | .Nm sshd | 566 | .Xr sshd 8 |
571 | supports. | 567 | supports. |
572 | The possible values are | 568 | The possible values are |
573 | .Dq 1 | 569 | .Sq 1 |
574 | and | 570 | and |
575 | .Dq 2 . | 571 | .Sq 2 . |
576 | Multiple versions must be comma-separated. | 572 | Multiple versions must be comma-separated. |
577 | The default is | 573 | The default is |
578 | .Dq 2,1 . | 574 | .Dq 2,1 . |
@@ -604,7 +600,7 @@ Defines the number of bits in the ephemeral protocol version 1 server key. | |||
604 | The minimum value is 512, and the default is 768. | 600 | The minimum value is 512, and the default is 768. |
605 | .It Cm StrictModes | 601 | .It Cm StrictModes |
606 | Specifies whether | 602 | Specifies whether |
607 | .Nm sshd | 603 | .Xr sshd 8 |
608 | should check file modes and ownership of the | 604 | should check file modes and ownership of the |
609 | user's files and home directory before accepting login. | 605 | user's files and home directory before accepting login. |
610 | This is normally desirable because novices sometimes accidentally leave their | 606 | This is normally desirable because novices sometimes accidentally leave their |
@@ -651,7 +647,7 @@ To disable TCP keepalive messages, the value should be set to | |||
651 | .Dq no . | 647 | .Dq no . |
652 | .It Cm UseDNS | 648 | .It Cm UseDNS |
653 | Specifies whether | 649 | Specifies whether |
654 | .Nm sshd | 650 | .Xr sshd 8 |
655 | should look up the remote host name and check that | 651 | should look up the remote host name and check that |
656 | the resolved host name for the remote IP address maps back to the | 652 | the resolved host name for the remote IP address maps back to the |
657 | very same IP address. | 653 | very same IP address. |
@@ -702,7 +698,7 @@ The default is | |||
702 | .Dq no . | 698 | .Dq no . |
703 | .It Cm UsePrivilegeSeparation | 699 | .It Cm UsePrivilegeSeparation |
704 | Specifies whether | 700 | Specifies whether |
705 | .Nm sshd | 701 | .Xr sshd 8 |
706 | separates privileges by creating an unprivileged child process | 702 | separates privileges by creating an unprivileged child process |
707 | to deal with incoming network traffic. | 703 | to deal with incoming network traffic. |
708 | After successful authentication, another process will be created that has | 704 | After successful authentication, another process will be created that has |
@@ -713,11 +709,9 @@ The default is | |||
713 | .Dq yes . | 709 | .Dq yes . |
714 | .It Cm X11DisplayOffset | 710 | .It Cm X11DisplayOffset |
715 | Specifies the first display number available for | 711 | Specifies the first display number available for |
716 | .Nm sshd Ns 's | 712 | .Xr sshd 8 Ns 's |
717 | X11 forwarding. | 713 | X11 forwarding. |
718 | This prevents | 714 | This prevents sshd from interfering with real X11 servers. |
719 | .Nm sshd | ||
720 | from interfering with real X11 servers. | ||
721 | The default is 10. | 715 | The default is 10. |
722 | .It Cm X11Forwarding | 716 | .It Cm X11Forwarding |
723 | Specifies whether X11 forwarding is permitted. | 717 | Specifies whether X11 forwarding is permitted. |
@@ -730,14 +724,14 @@ The default is | |||
730 | .Pp | 724 | .Pp |
731 | When X11 forwarding is enabled, there may be additional exposure to | 725 | When X11 forwarding is enabled, there may be additional exposure to |
732 | the server and to client displays if the | 726 | the server and to client displays if the |
733 | .Nm sshd | 727 | .Xr sshd 8 |
734 | proxy display is configured to listen on the wildcard address (see | 728 | proxy display is configured to listen on the wildcard address (see |
735 | .Cm X11UseLocalhost | 729 | .Cm X11UseLocalhost |
736 | below), however this is not the default. | 730 | below), though this is not the default. |
737 | Additionally, the authentication spoofing and authentication data | 731 | Additionally, the authentication spoofing and authentication data |
738 | verification and substitution occur on the client side. | 732 | verification and substitution occur on the client side. |
739 | The security risk of using X11 forwarding is that the client's X11 | 733 | The security risk of using X11 forwarding is that the client's X11 |
740 | display server may be exposed to attack when the ssh client requests | 734 | display server may be exposed to attack when the SSH client requests |
741 | forwarding (see the warnings for | 735 | forwarding (see the warnings for |
742 | .Cm ForwardX11 | 736 | .Cm ForwardX11 |
743 | in | 737 | in |
@@ -755,12 +749,11 @@ X11 forwarding is automatically disabled if | |||
755 | is enabled. | 749 | is enabled. |
756 | .It Cm X11UseLocalhost | 750 | .It Cm X11UseLocalhost |
757 | Specifies whether | 751 | Specifies whether |
758 | .Nm sshd | 752 | .Xr sshd 8 |
759 | should bind the X11 forwarding server to the loopback address or to | 753 | should bind the X11 forwarding server to the loopback address or to |
760 | the wildcard address. | 754 | the wildcard address. |
761 | By default, | 755 | By default, |
762 | .Nm sshd | 756 | sshd binds the forwarding server to the loopback address and sets the |
763 | binds the forwarding server to the loopback address and sets the | ||
764 | hostname part of the | 757 | hostname part of the |
765 | .Ev DISPLAY | 758 | .Ev DISPLAY |
766 | environment variable to | 759 | environment variable to |