summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDamien Miller <djm@mindrot.org>2014-04-20 13:22:46 +1000
committerDamien Miller <djm@mindrot.org>2014-04-20 13:22:46 +1000
commitc1621c84f2dc1279065ab9fde2aa9327af418900 (patch)
tree7e5f4ec6d7024c98ec9209541db0ff20983627e7
parentf2719b7c2b8a3b14d778d8a6d8dc729b5174b054 (diff)
- naddy@cvs.openbsd.org 2014/03/28 05:17:11
[ssh_config.5 sshd_config.5] sync available and default algorithms, improve algorithm list formatting help from jmc@ and schwarze@, ok deraadt@
Diffstat
-rw-r--r--ChangeLog4
-rw-r--r--ssh_config.574
-rw-r--r--sshd_config.5136
3 files changed, 153 insertions, 61 deletions
diff --git a/ChangeLog b/ChangeLog
index 1781b44bd..e7a6e97c6 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -61,6 +61,10 @@
61 - tedu@cvs.openbsd.org 2014/03/26 19:58:37 61 - tedu@cvs.openbsd.org 2014/03/26 19:58:37
62 [sshd.8 sshd.c] 62 [sshd.8 sshd.c]
63 remove libwrap support. ok deraadt djm mfriedl 63 remove libwrap support. ok deraadt djm mfriedl
64 - naddy@cvs.openbsd.org 2014/03/28 05:17:11
65 [ssh_config.5 sshd_config.5]
66 sync available and default algorithms, improve algorithm list formatting
67 help from jmc@ and schwarze@, ok deraadt@
64 68
6520140401 6920140401
66 - (djm) On platforms that support it, use prctl() to prevent sftp-server 70 - (djm) On platforms that support it, use prctl() to prevent sftp-server
diff --git a/ssh_config.5 b/ssh_config.5
index b5803920f..f96f37ba3 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -33,8 +33,8 @@
33.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 33.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
34.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
35.\" 35.\"
36.\" $OpenBSD: ssh_config.5,v 1.185 2014/02/23 20:11:36 djm Exp $ 36.\" $OpenBSD: ssh_config.5,v 1.186 2014/03/28 05:17:11 naddy Exp $
37.Dd $Mdocdate: February 23 2014 $ 37.Dd $Mdocdate: March 28 2014 $
38.Dt SSH_CONFIG 5 38.Dt SSH_CONFIG 5
39.Os 39.Os
40.Sh NAME 40.Sh NAME
@@ -342,30 +342,47 @@ in order of preference.
342Multiple ciphers must be comma-separated. 342Multiple ciphers must be comma-separated.
343The supported ciphers are: 343The supported ciphers are:
344.Pp 344.Pp
345.Dq 3des-cbc , 345.Bl -item -compact -offset indent
346.Dq aes128-cbc , 346.It
347.Dq aes192-cbc , 3473des-cbc
348.Dq aes256-cbc , 348.It
349.Dq aes128-ctr , 349aes128-cbc
350.Dq aes192-ctr , 350.It
351.Dq aes256-ctr , 351aes192-cbc
352.Dq aes128-gcm@openssh.com , 352.It
353.Dq aes256-gcm@openssh.com , 353aes256-cbc
354.Dq arcfour128 , 354.It
355.Dq arcfour256 , 355aes128-ctr
356.Dq arcfour , 356.It
357.Dq blowfish-cbc , 357aes192-ctr
358.Dq cast128-cbc , 358.It
359and 359aes256-ctr
360.Dq chacha20-poly1305@openssh.com . 360.It
361aes128-gcm@openssh.com
362.It
363aes256-gcm@openssh.com
364.It
365arcfour
366.It
367arcfour128
368.It
369arcfour256
370.It
371blowfish-cbc
372.It
373cast128-cbc
374.It
375chacha20-poly1305@openssh.com
376.El
361.Pp 377.Pp
362The default is: 378The default is:
363.Bd -literal -offset 3n 379.Bd -literal -offset indent
364aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128, 380aes128-ctr,aes192-ctr,aes256-ctr,
365aes128-gcm@openssh.com,aes256-gcm@openssh.com, 381aes128-gcm@openssh.com,aes256-gcm@openssh.com,
366chacha20-poly1305@openssh.com, 382chacha20-poly1305@openssh.com,
367aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc, 383arcfour256,arcfour128,
368aes256-cbc,arcfour 384aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,
385aes192-cbc,aes256-cbc,arcfour
369.Ed 386.Ed
370.Pp 387.Pp
371The list of available ciphers may also be obtained using the 388The list of available ciphers may also be obtained using the
@@ -893,8 +910,8 @@ The default is:
893curve25519-sha256@libssh.org, 910curve25519-sha256@libssh.org,
894ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521, 911ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
895diffie-hellman-group-exchange-sha256, 912diffie-hellman-group-exchange-sha256,
896diffie-hellman-group-exchange-sha1,
897diffie-hellman-group14-sha1, 913diffie-hellman-group14-sha1,
914diffie-hellman-group-exchange-sha1,
898diffie-hellman-group1-sha1 915diffie-hellman-group1-sha1
899.Ed 916.Ed
900.It Cm LocalCommand 917.It Cm LocalCommand
@@ -974,13 +991,14 @@ calculate the MAC after encryption (encrypt-then-mac).
974These are considered safer and their use recommended. 991These are considered safer and their use recommended.
975The default is: 992The default is:
976.Bd -literal -offset indent 993.Bd -literal -offset indent
977hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,
978umac-64-etm@openssh.com,umac-128-etm@openssh.com, 994umac-64-etm@openssh.com,umac-128-etm@openssh.com,
979hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com, 995hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,
980hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com, 996umac-64@openssh.com,umac-128@openssh.com,
981hmac-md5-96-etm@openssh.com, 997hmac-sha2-256,hmac-sha2-512,
982hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com, 998hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,
983hmac-sha2-256,hmac-sha2-512,hmac-ripemd160, 999hmac-ripemd160-etm@openssh.com,
1000hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,
1001hmac-md5,hmac-sha1,hmac-ripemd160,
984hmac-sha1-96,hmac-md5-96 1002hmac-sha1-96,hmac-md5-96
985.Ed 1003.Ed
986.It Cm NoHostAuthenticationForLocalhost 1004.It Cm NoHostAuthenticationForLocalhost
diff --git a/sshd_config.5 b/sshd_config.5
index ce71efe3c..88be8d984 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -33,8 +33,8 @@
33.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 33.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
34.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
35.\" 35.\"
36.\" $OpenBSD: sshd_config.5,v 1.172 2014/02/27 22:47:07 djm Exp $ 36.\" $OpenBSD: sshd_config.5,v 1.173 2014/03/28 05:17:11 naddy Exp $
37.Dd $Mdocdate: February 27 2014 $ 37.Dd $Mdocdate: March 28 2014 $
38.Dt SSHD_CONFIG 5 38.Dt SSHD_CONFIG 5
39.Os 39.Os
40.Sh NAME 40.Sh NAME
@@ -337,30 +337,44 @@ Specifies the ciphers allowed for protocol version 2.
337Multiple ciphers must be comma-separated. 337Multiple ciphers must be comma-separated.
338The supported ciphers are: 338The supported ciphers are:
339.Pp 339.Pp
340.Dq 3des-cbc , 340.Bl -item -compact -offset indent
341.Dq aes128-cbc , 341.It
342.Dq aes192-cbc , 3423des-cbc
343.Dq aes256-cbc , 343.It
344.Dq aes128-ctr , 344aes128-cbc
345.Dq aes192-ctr , 345.It
346.Dq aes256-ctr , 346aes192-cbc
347.Dq aes128-gcm@openssh.com , 347.It
348.Dq aes256-gcm@openssh.com , 348aes256-cbc
349.Dq arcfour128 , 349.It
350.Dq arcfour256 , 350aes128-ctr
351.Dq arcfour , 351.It
352.Dq blowfish-cbc , 352aes192-ctr
353.Dq cast128-cbc , 353.It
354and 354aes256-ctr
355.Dq chacha20-poly1305@openssh.com . 355.It
356aes128-gcm@openssh.com
357.It
358aes256-gcm@openssh.com
359.It
360arcfour
361.It
362arcfour128
363.It
364arcfour256
365.It
366blowfish-cbc
367.It
368cast128-cbc
369.It
370chacha20-poly1305@openssh.com
371.El
356.Pp 372.Pp
357The default is: 373The default is:
358.Bd -literal -offset 3n 374.Bd -literal -offset indent
359aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128, 375aes128-ctr,aes192-ctr,aes256-ctr,
360aes128-gcm@openssh.com,aes256-gcm@openssh.com, 376aes128-gcm@openssh.com,aes256-gcm@openssh.com,
361chacha20-poly1305@openssh.com, 377chacha20-poly1305@openssh.com
362aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,
363aes256-cbc,arcfour
364.Ed 378.Ed
365.Pp 379.Pp
366The list of available ciphers may also be obtained using the 380The list of available ciphers may also be obtained using the
@@ -672,14 +686,33 @@ The default is
672.It Cm KexAlgorithms 686.It Cm KexAlgorithms
673Specifies the available KEX (Key Exchange) algorithms. 687Specifies the available KEX (Key Exchange) algorithms.
674Multiple algorithms must be comma-separated. 688Multiple algorithms must be comma-separated.
675The default is 689The supported algorithms are:
690.Pp
691.Bl -item -compact -offset indent
692.It
693curve25519-sha256@libssh.org
694.It
695diffie-hellman-group1-sha1
696.It
697diffie-hellman-group14-sha1
698.It
699diffie-hellman-group-exchange-sha1
700.It
701diffie-hellman-group-exchange-sha256
702.It
703ecdh-sha2-nistp256
704.It
705ecdh-sha2-nistp384
706.It
707ecdh-sha2-nistp521
708.El
709.Pp
710The default is:
676.Bd -literal -offset indent 711.Bd -literal -offset indent
677curve25519-sha256@libssh.org, 712curve25519-sha256@libssh.org,
678ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521, 713ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
679diffie-hellman-group-exchange-sha256, 714diffie-hellman-group-exchange-sha256,
680diffie-hellman-group-exchange-sha1, 715diffie-hellman-group14-sha1
681diffie-hellman-group14-sha1,
682diffie-hellman-group1-sha1
683.Ed 716.Ed
684.It Cm KeyRegenerationInterval 717.It Cm KeyRegenerationInterval
685In protocol version 1, the ephemeral server key is automatically regenerated 718In protocol version 1, the ephemeral server key is automatically regenerated
@@ -751,16 +784,53 @@ The algorithms that contain
751.Dq -etm 784.Dq -etm
752calculate the MAC after encryption (encrypt-then-mac). 785calculate the MAC after encryption (encrypt-then-mac).
753These are considered safer and their use recommended. 786These are considered safer and their use recommended.
787The supported MACs are:
788.Pp
789.Bl -item -compact -offset indent
790.It
791hmac-md5
792.It
793hmac-md5-96
794.It
795hmac-ripemd160
796.It
797hmac-sha1
798.It
799hmac-sha1-96
800.It
801hmac-sha2-256
802.It
803hmac-sha2-512
804.It
805umac-64@openssh.com
806.It
807umac-128@openssh.com
808.It
809hmac-md5-etm@openssh.com
810.It
811hmac-md5-96-etm@openssh.com
812.It
813hmac-ripemd160-etm@openssh.com
814.It
815hmac-sha1-etm@openssh.com
816.It
817hmac-sha1-96-etm@openssh.com
818.It
819hmac-sha2-256-etm@openssh.com
820.It
821hmac-sha2-512-etm@openssh.com
822.It
823umac-64-etm@openssh.com
824.It
825umac-128-etm@openssh.com
826.El
827.Pp
754The default is: 828The default is:
755.Bd -literal -offset indent 829.Bd -literal -offset indent
756hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,
757umac-64-etm@openssh.com,umac-128-etm@openssh.com, 830umac-64-etm@openssh.com,umac-128-etm@openssh.com,
758hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com, 831hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,
759hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com, 832umac-64@openssh.com,umac-128@openssh.com,
760hmac-md5-96-etm@openssh.com, 833hmac-sha2-256,hmac-sha2-512
761hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,
762hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,
763hmac-sha1-96,hmac-md5-96
764.Ed 834.Ed
765.It Cm Match 835.It Cm Match
766Introduces a conditional block. 836Introduces a conditional block.
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-08 03:32:06 +0000