summaryrefslogtreecommitdiff
path: root/ssh.1
diff options
context:
space:
mode:
authorDamien Miller <djm@mindrot.org>2005-03-01 21:24:33 +1100
committerDamien Miller <djm@mindrot.org>2005-03-01 21:24:33 +1100
commitf91ee4c3def4de8b4b9409f07ab26a61e535e1e6 (patch)
tree92d9f883c3c34f0d80b49a7855dcc2514798cf02 /ssh.1
parent1717fd422f2c5691d745a7daf6908df9a6458904 (diff)
- djm@cvs.openbsd.org 2005/03/01 10:09:52
[auth-options.c channels.c channels.h clientloop.c compat.c compat.h] [misc.c misc.h readconf.c readconf.h servconf.c ssh.1 ssh.c ssh_config.5] [sshd_config.5] bz#413: allow optional specification of bind address for port forwardings. Patch originally by Dan Astorian, but worked on by several people Adds GatewayPorts=clientspecified option on server to allow remote forwards to bind to client-specified ports.
Diffstat (limited to 'ssh.1')
-rw-r--r--ssh.159
1 files changed, 49 insertions, 10 deletions
diff --git a/ssh.1 b/ssh.1
index b8a91a160..27da08c69 100644
--- a/ssh.1
+++ b/ssh.1
@@ -34,7 +34,7 @@
34.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36.\" 36.\"
37.\" $OpenBSD: ssh.1,v 1.199 2004/11/07 17:42:36 jmc Exp $ 37.\" $OpenBSD: ssh.1,v 1.200 2005/03/01 10:09:52 djm Exp $
38.Dd September 25, 1999 38.Dd September 25, 1999
39.Dt SSH 1 39.Dt SSH 1
40.Os 40.Os
@@ -53,13 +53,13 @@
53.Op Fl i Ar identity_file 53.Op Fl i Ar identity_file
54.Oo Fl L Xo 54.Oo Fl L Xo
55.Sm off 55.Sm off
56.Oo Ar bind_address : Oc
56.Ar port : 57.Ar port :
57.Ar host : 58.Ar host :
58.Ar hostport 59.Ar hostport
59.Sm on 60.Sm on
60.Xc 61.Xc
61.Oc 62.Oc
62.Ek
63.Op Fl l Ar login_name 63.Op Fl l Ar login_name
64.Op Fl m Ar mac_spec 64.Op Fl m Ar mac_spec
65.Op Fl O Ar ctl_cmd 65.Op Fl O Ar ctl_cmd
@@ -69,6 +69,7 @@
69.Ek 69.Ek
70.Oo Fl R Xo 70.Oo Fl R Xo
71.Sm off 71.Sm off
72.Oo Ar bind_address : Oc
72.Ar port : 73.Ar port :
73.Ar host : 74.Ar host :
74.Ar hostport 75.Ar hostport
@@ -570,6 +571,7 @@ configuration files).
570Disables forwarding (delegation) of GSSAPI credentials to the server. 571Disables forwarding (delegation) of GSSAPI credentials to the server.
571.It Fl L Xo 572.It Fl L Xo
572.Sm off 573.Sm off
574.Oo Ar bind_address : Oc
573.Ar port : host : hostport 575.Ar port : host : hostport
574.Sm on 576.Sm on
575.Xc 577.Xc
@@ -577,7 +579,9 @@ Specifies that the given port on the local (client) host is to be
577forwarded to the given host and port on the remote side. 579forwarded to the given host and port on the remote side.
578This works by allocating a socket to listen to 580This works by allocating a socket to listen to
579.Ar port 581.Ar port
580on the local side, and whenever a connection is made to this port, the 582on the local side, optionally bound to the specified
583.Ar bind_address .
584Whenever a connection is made to this port, the
581connection is forwarded over the secure channel, and a connection is 585connection is forwarded over the secure channel, and a connection is
582made to 586made to
583.Ar host 587.Ar host
@@ -585,14 +589,30 @@ port
585.Ar hostport 589.Ar hostport
586from the remote machine. 590from the remote machine.
587Port forwardings can also be specified in the configuration file. 591Port forwardings can also be specified in the configuration file.
588Only root can forward privileged ports.
589IPv6 addresses can be specified with an alternative syntax: 592IPv6 addresses can be specified with an alternative syntax:
590.Sm off 593.Sm off
591.Xo 594.Xo
595.Oo Ar bind_address / Oc
592.Ar port No / Ar host No / 596.Ar port No / Ar host No /
593.Ar hostport . 597.Ar hostport
594.Xc 598.Xc
595.Sm on 599.Sm on
600or by enclosing the address in square brackets.
601Only the superuser can forward privileged ports.
602By default, the local port is bound in accordance with the
603.Cm GatewayPorts
604setting.
605However, an explicit
606.Ar bind_address
607may be used to bind the connection to a specific address.
608The
609.Ar bind_address
610of
611.Dq localhost
612indicates that the listening port be bound for local use only, while an
613empty address or
614.Dq *
615indicates that the port should be available from all interfaces.
596.It Fl l Ar login_name 616.It Fl l Ar login_name
597Specifies the user to log in as on the remote machine. 617Specifies the user to log in as on the remote machine.
598This also may be specified on a per-host basis in the configuration file. 618This also may be specified on a per-host basis in the configuration file.
@@ -724,6 +744,7 @@ Quiet mode.
724Causes all warning and diagnostic messages to be suppressed. 744Causes all warning and diagnostic messages to be suppressed.
725.It Fl R Xo 745.It Fl R Xo
726.Sm off 746.Sm off
747.Oo Ar bind_address : Oc
727.Ar port : host : hostport 748.Ar port : host : hostport
728.Sm on 749.Sm on
729.Xc 750.Xc
@@ -738,16 +759,34 @@ made to
738port 759port
739.Ar hostport 760.Ar hostport
740from the local machine. 761from the local machine.
762.Pp
741Port forwardings can also be specified in the configuration file. 763Port forwardings can also be specified in the configuration file.
742Privileged ports can be forwarded only when 764Privileged ports can be forwarded only when
743logging in as root on the remote machine. 765logging in as root on the remote machine.
744IPv6 addresses can be specified with an alternative syntax: 766IPv6 addresses can be specified by enclosing the address in square braces or
745.Sm off 767using an alternative syntax:
746.Xo 768.Xo
747.Ar port No / Ar host No / 769.Sm off
748.Ar hostport . 770.Oo Ar bind_address / Oc
749.Xc 771.Ar host/port/hostport
750.Sm on 772.Sm on
773.Xc .
774.Pp
775By default, the listening socket on the server will be bound to the loopback
776interface only.
777This may be overriden by specifying a
778.Ar bind_address .
779An empty
780.Ar bind_address ,
781or the address
782.Ql *
783indicates that the remote socket should listen on all interfaces.
784Specifying a remote
785.Ar bind_address
786will only succeed if the server's
787.Cm GatewayPorts
788option is enabled (see
789.Xr sshd_config 5 ).
751.It Fl S Ar ctl_path 790.It Fl S Ar ctl_path
752Specifies the location of a control socket for connection sharing. 791Specifies the location of a control socket for connection sharing.
753Refer to the description of 792Refer to the description of