New upstream release (7.7p1)

1 files changed, 36 insertions, 17 deletions

diff --git a/ssh_config.0 b/ssh_config.0
index 9493953ab..4109b1909 100644
--- a/ssh_config.0
+++ b/ssh_config.0
@@ -112,6 +112,11 @@ DESCRIPTION
              one address.  Note that this option does not work if
              UsePrivilegedPort is set to yes.
 
+     BindInterface
+             Use the address of the specified interface on the local machine
+             as the source address of the connection.  Note that this option
+             does not work if UsePrivilegedPort is set to yes.
+
      CanonicalDomains
              When CanonicalizeHostname is enabled, this option specifies the
              list of domain suffixes in which to search for the specified
@@ -583,7 +588,10 @@ DESCRIPTION
                    curve25519-sha256,curve25519-sha256@libssh.org,
                    ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
                    diffie-hellman-group-exchange-sha256,
+                   diffie-hellman-group16-sha512,
+                   diffie-hellman-group18-sha512,
                    diffie-hellman-group-exchange-sha1,
+                   diffie-hellman-group14-sha256,
                    diffie-hellman-group14-sha1
 
              The list of available key exchange algorithms may also be
@@ -652,12 +660,8 @@ DESCRIPTION
              "ssh -Q mac".
 
      NoHostAuthenticationForLocalhost
-             This option can be used if the home directory is shared across
-             machines.  In this case localhost will refer to a different
-             machine on each of the machines and the user will get many
-             warnings about changed host keys.  However, this option disables
-             host authentication for localhost.  The argument to this keyword
-             must be yes or no (the default).
+             Disable host authentication for localhost (loopback addresses).
+             The argument to this keyword must be yes or no (the default).
 
      NumberOfPasswordPrompts
              Specifies the number of password prompts before giving up.  The
@@ -713,12 +717,12 @@ DESCRIPTION
                 ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p
 
      ProxyJump
-             Specifies one or more jump proxies as [user@]host[:port].
-             Multiple proxies may be separated by comma characters and will be
-             visited sequentially.  Setting this option will cause ssh(1) to
-             connect to the target host by first making a ssh(1) connection to
-             the specified ProxyJump host and then establishing a TCP
-             forwarding to the ultimate target from there.
+             Specifies one or more jump proxies as either [user@]host[:port]
+             or an ssh URI.  Multiple proxies may be separated by comma
+             characters and will be visited sequentially.  Setting this option
+             will cause ssh(1) to connect to the target host by first making a
+             ssh(1) connection to the specified ProxyJump host and then
+             establishing a TCP forwarding to the ultimate target from there.
 
              Note that this option will compete with the ProxyCommand option -
              whichever is specified first will prevent later instances of the
@@ -883,8 +887,8 @@ DESCRIPTION
              If this flag is set to yes, ssh(1) will never automatically add
              host keys to the ~/.ssh/known_hosts file, and refuses to connect
              to hosts whose host key has changed.  This provides maximum
-             protection against trojan horse attacks, though it can be
-             annoying when the /etc/ssh/ssh_known_hosts file is poorly
+             protection against man-in-the-middle (MITM) attacks, though it
+             can be annoying when the /etc/ssh/ssh_known_hosts file is poorly
              maintained or when connections to new hosts are frequently made.
              This option forces the user to manually add all new hosts.
 
@@ -918,6 +922,7 @@ DESCRIPTION
              dies.  This is important in scripts, and many users want it too.
 
              To disable TCP keepalive messages, the value should be set to no.
+             See also ServerAliveInterval for protocol-level keepalives.
 
      Tunnel  Request tun(4) device forwarding between the client and the
              server.  The argument must be yes, point-to-point (layer 3),
@@ -1012,12 +1017,23 @@ PATTERNS
 
            from="!*.dialup.example.com,*.example.com"
 
+     Note that a negated match will never produce a positive result by itself.
+     For example, attempting to match "host3" against the following pattern-
+     list will fail:
+
+           from="!host1,!host2"
+
+     The solution here is to include a term that will yield a positive match,
+     such as a wildcard:
+
+           from="!host1,!host2,*"
+
 TOKENS
      Arguments to some keywords can make use of tokens, which are expanded at
      runtime:
 
            %%    A literal M-bM-^@M-^X%M-bM-^@M-^Y.
-           %C    Shorthand for %l%h%p%r.
+           %C    Hash of %l%h%p%r.
            %d    Local user's home directory.
            %h    The remote hostname.
            %i    The local user ID.
@@ -1026,6 +1042,8 @@ TOKENS
            %n    The original remote hostname, as given on the command line.
            %p    The remote port.
            %r    The remote username.
+           %T    The local tun(4) or tap(4) network interface assigned if
+                 tunnel forwarding was requested, or "NONE" otherwise.
            %u    The local username.
 
      Match exec accepts the tokens %%, %h, %L, %l, %n, %p, %r, and %u.
@@ -1040,7 +1058,8 @@ TOKENS
      IdentityAgent and IdentityFile accept the tokens %%, %d, %h, %l, %r, and
      %u.
 
-     LocalCommand accepts the tokens %%, %C, %d, %h, %l, %n, %p, %r, and %u.
+     LocalCommand accepts the tokens %%, %C, %d, %h, %l, %n, %p, %r, %T, and
+     %u.
 
      ProxyCommand accepts the tokens %%, %h, %p, and %r.
 
@@ -1070,4 +1089,4 @@ AUTHORS
      created OpenSSH.  Markus Friedl contributed the support for SSH protocol
      versions 1.5 and 2.0.
 
-OpenBSD 6.2                   September 21, 2017                   OpenBSD 6.2
+OpenBSD 6.2                    February 23, 2018                   OpenBSD 6.2