summaryrefslogtreecommitdiff
path: root/ssh_config.5
diff options
context:
space:
mode:
authorColin Watson <cjwatson@debian.org>2014-02-09 16:10:18 +0000
committerColin Watson <cjwatson@debian.org>2018-08-24 17:49:07 +0100
commit157278376c0eb6e4de3d47e8573684095a230685 (patch)
tree02fd56a8b71afb41346d27c74f7bf7a8609e1706 /ssh_config.5
parentba2be368348f9f411377f494e209faedf53903de (diff)
Various Debian-specific configuration changes
ssh: Enable ForwardX11Trusted, returning to earlier semantics which cause fewer problems with existing setups (http://bugs.debian.org/237021). ssh: Set 'SendEnv LANG LC_*' by default (http://bugs.debian.org/264024). ssh: Enable HashKnownHosts by default to try to limit the spread of ssh worms. ssh: Enable GSSAPIAuthentication by default. sshd: Enable PAM, disable ChallengeResponseAuthentication, and disable PrintMotd. sshd: Enable X11Forwarding. sshd: Set 'AcceptEnv LANG LC_*' by default. sshd: Change sftp subsystem path to /usr/lib/openssh/sftp-server. Document all of this. Author: Russ Allbery <rra@debian.org> Forwarded: not-needed Last-Update: 2017-10-04 Patch-Name: debian-config.patch
Diffstat (limited to 'ssh_config.5')
-rw-r--r--ssh_config.519
1 files changed, 18 insertions, 1 deletions
diff --git a/ssh_config.5 b/ssh_config.5
index cb68f51a6..35c578c3b 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -71,6 +71,22 @@ Since the first obtained value for each parameter is used, more
71host-specific declarations should be given near the beginning of the 71host-specific declarations should be given near the beginning of the
72file, and general defaults at the end. 72file, and general defaults at the end.
73.Pp 73.Pp
74Note that the Debian
75.Ic openssh-client
76package sets several options as standard in
77.Pa /etc/ssh/ssh_config
78which are not the default in
79.Xr ssh 1 :
80.Pp
81.Bl -bullet -offset indent -compact
82.It
83.Cm SendEnv No LANG LC_*
84.It
85.Cm HashKnownHosts No yes
86.It
87.Cm GSSAPIAuthentication No yes
88.El
89.Pp
74The file contains keyword-argument pairs, one per line. 90The file contains keyword-argument pairs, one per line.
75Lines starting with 91Lines starting with
76.Ql # 92.Ql #
@@ -681,11 +697,12 @@ elapsed.
681.It Cm ForwardX11Trusted 697.It Cm ForwardX11Trusted
682If this option is set to 698If this option is set to
683.Cm yes , 699.Cm yes ,
700(the Debian-specific default),
684remote X11 clients will have full access to the original X11 display. 701remote X11 clients will have full access to the original X11 display.
685.Pp 702.Pp
686If this option is set to 703If this option is set to
687.Cm no 704.Cm no
688(the default), 705(the upstream default),
689remote X11 clients will be considered untrusted and prevented 706remote X11 clients will be considered untrusted and prevented
690from stealing or tampering with data belonging to trusted X11 707from stealing or tampering with data belonging to trusted X11
691clients. 708clients.