diff options
author | Colin Watson <cjwatson@debian.org> | 2003-09-23 18:08:35 +0000 |
---|---|---|
committer | Colin Watson <cjwatson@debian.org> | 2003-09-23 18:08:35 +0000 |
commit | d59fd3e421aa81b8e5e118f3f806081df2aca879 (patch) | |
tree | 356a4e607edc979c625bb33db63c656d771478bd /ssh_config.5 | |
parent | 7505658c58e96b8d270f1928a0e1fa7f3e0c266b (diff) | |
parent | 45431c9b4677608680cd071768cbf156b316a7e8 (diff) |
Merge 3.7.1p2 to the trunk. I have absolutely no idea yet whether this will
work.
Diffstat (limited to 'ssh_config.5')
-rw-r--r-- | ssh_config.5 | 121 |
1 files changed, 65 insertions, 56 deletions
diff --git a/ssh_config.5 b/ssh_config.5 index d0ea33918..2ca7ce02f 100644 --- a/ssh_config.5 +++ b/ssh_config.5 | |||
@@ -34,7 +34,7 @@ | |||
34 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | 34 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
35 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | 35 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
36 | .\" | 36 | .\" |
37 | .\" $OpenBSD: ssh_config.5,v 1.7 2003/03/28 10:11:43 jmc Exp $ | 37 | .\" $OpenBSD: ssh_config.5,v 1.20 2003/09/02 18:50:06 jmc Exp $ |
38 | .Dd September 25, 1999 | 38 | .Dd September 25, 1999 |
39 | .Dt SSH_CONFIG 5 | 39 | .Dt SSH_CONFIG 5 |
40 | .Os | 40 | .Os |
@@ -104,7 +104,7 @@ keyword) to be only for those hosts that match one of the patterns | |||
104 | given after the keyword. | 104 | given after the keyword. |
105 | .Ql \&* | 105 | .Ql \&* |
106 | and | 106 | and |
107 | .Ql ? | 107 | .Ql \&? |
108 | can be used as wildcards in the | 108 | can be used as wildcards in the |
109 | patterns. | 109 | patterns. |
110 | A single | 110 | A single |
@@ -115,13 +115,14 @@ The host is the | |||
115 | .Ar hostname | 115 | .Ar hostname |
116 | argument given on the command line (i.e., the name is not converted to | 116 | argument given on the command line (i.e., the name is not converted to |
117 | a canonicalized host name before matching). | 117 | a canonicalized host name before matching). |
118 | .It Cm AFSTokenPassing | 118 | .It Cm AddressFamily |
119 | Specifies whether to pass AFS tokens to remote host. | 119 | Specifies which address family to use when connecting. |
120 | The argument to this keyword must be | 120 | Valid arguments are |
121 | .Dq yes | 121 | .Dq any , |
122 | or | 122 | .Dq inet |
123 | .Dq no . | 123 | (Use IPv4 only) or |
124 | This option applies to protocol version 1 only. | 124 | .Dq inet6 |
125 | (Use IPv6 only.) | ||
125 | .It Cm BatchMode | 126 | .It Cm BatchMode |
126 | If set to | 127 | If set to |
127 | .Dq yes , | 128 | .Dq yes , |
@@ -234,18 +235,41 @@ Specifies the number of tries (one per second) to make before exiting. | |||
234 | The argument must be an integer. | 235 | The argument must be an integer. |
235 | This may be useful in scripts if the connection sometimes fails. | 236 | This may be useful in scripts if the connection sometimes fails. |
236 | The default is 1. | 237 | The default is 1. |
238 | .It Cm ConnectTimeout | ||
239 | Specifies the timeout (in seconds) used when connecting to the ssh | ||
240 | server, instead of using the default system TCP timeout. | ||
241 | This value is used only when the target is down or really unreachable, | ||
242 | not when it refuses the connection. | ||
237 | .It Cm DynamicForward | 243 | .It Cm DynamicForward |
238 | Specifies that a TCP/IP port on the local machine be forwarded | 244 | Specifies that a TCP/IP port on the local machine be forwarded |
239 | over the secure channel, and the application | 245 | over the secure channel, and the application |
240 | protocol is then used to determine where to connect to from the | 246 | protocol is then used to determine where to connect to from the |
241 | remote machine. | 247 | remote machine. |
242 | The argument must be a port number. | 248 | The argument must be a port number. |
243 | Currently the SOCKS4 protocol is supported, and | 249 | Currently the SOCKS4 and SOCKS5 protocols are supported, and |
244 | .Nm ssh | 250 | .Nm ssh |
245 | will act as a SOCKS4 server. | 251 | will act as a SOCKS server. |
246 | Multiple forwardings may be specified, and | 252 | Multiple forwardings may be specified, and |
247 | additional forwardings can be given on the command line. | 253 | additional forwardings can be given on the command line. |
248 | Only the superuser can forward privileged ports. | 254 | Only the superuser can forward privileged ports. |
255 | .It Cm EnableSSHKeysign | ||
256 | Setting this option to | ||
257 | .Dq yes | ||
258 | in the global client configuration file | ||
259 | .Pa /etc/ssh/ssh_config | ||
260 | enables the use of the helper program | ||
261 | .Xr ssh-keysign 8 | ||
262 | during | ||
263 | .Cm HostbasedAuthentication . | ||
264 | The argument must be | ||
265 | .Dq yes | ||
266 | or | ||
267 | .Dq no . | ||
268 | The default is | ||
269 | .Dq no . | ||
270 | See | ||
271 | .Xr ssh-keysign 8 | ||
272 | for more information. | ||
249 | .It Cm EscapeChar | 273 | .It Cm EscapeChar |
250 | Sets the escape character (default: | 274 | Sets the escape character (default: |
251 | .Ql ~ ) . | 275 | .Ql ~ ) . |
@@ -314,6 +338,18 @@ The default is | |||
314 | Specifies a file to use for the global | 338 | Specifies a file to use for the global |
315 | host key database instead of | 339 | host key database instead of |
316 | .Pa /etc/ssh/ssh_known_hosts . | 340 | .Pa /etc/ssh/ssh_known_hosts . |
341 | .It Cm GSSAPIAuthentication | ||
342 | Specifies whether authentication based on GSSAPI may be used, either using | ||
343 | the result of a successful key exchange, or using GSSAPI user | ||
344 | authentication. | ||
345 | The default is | ||
346 | .Dq yes . | ||
347 | Note that this option applies to protocol version 2 only. | ||
348 | .It Cm GSSAPIDelegateCredentials | ||
349 | Forward (delegate) credentials to the server. | ||
350 | The default is | ||
351 | .Dq no . | ||
352 | Note that this option applies to protocol version 2 only. | ||
317 | .It Cm HostbasedAuthentication | 353 | .It Cm HostbasedAuthentication |
318 | Specifies whether to try rhosts based authentication with public key | 354 | Specifies whether to try rhosts based authentication with public key |
319 | authentication. | 355 | authentication. |
@@ -346,7 +382,8 @@ Numeric IP addresses are also permitted (both on the command line and in | |||
346 | specifications). | 382 | specifications). |
347 | .It Cm IdentityFile | 383 | .It Cm IdentityFile |
348 | Specifies a file from which the user's RSA or DSA authentication identity | 384 | Specifies a file from which the user's RSA or DSA authentication identity |
349 | is read. The default is | 385 | is read. |
386 | The default is | ||
350 | .Pa $HOME/.ssh/identity | 387 | .Pa $HOME/.ssh/identity |
351 | for protocol version 1, and | 388 | for protocol version 1, and |
352 | .Pa $HOME/.ssh/id_rsa | 389 | .Pa $HOME/.ssh/id_rsa |
@@ -383,19 +420,6 @@ This is important in scripts, and many users want it too. | |||
383 | .Pp | 420 | .Pp |
384 | To disable keepalives, the value should be set to | 421 | To disable keepalives, the value should be set to |
385 | .Dq no . | 422 | .Dq no . |
386 | .It Cm KerberosAuthentication | ||
387 | Specifies whether Kerberos authentication will be used. | ||
388 | The argument to this keyword must be | ||
389 | .Dq yes | ||
390 | or | ||
391 | .Dq no . | ||
392 | .It Cm KerberosTgtPassing | ||
393 | Specifies whether a Kerberos TGT will be forwarded to the server. | ||
394 | This will only work if the Kerberos server is actually an AFS kaserver. | ||
395 | The argument to this keyword must be | ||
396 | .Dq yes | ||
397 | or | ||
398 | .Dq no . | ||
399 | .It Cm LocalForward | 423 | .It Cm LocalForward |
400 | Specifies that a TCP/IP port on the local machine be forwarded over | 424 | Specifies that a TCP/IP port on the local machine be forwarded over |
401 | the secure channel to the specified host and port from the remote machine. | 425 | the secure channel to the specified host and port from the remote machine. |
@@ -449,7 +473,8 @@ Specifies the port number to connect on the remote host. | |||
449 | Default is 22. | 473 | Default is 22. |
450 | .It Cm PreferredAuthentications | 474 | .It Cm PreferredAuthentications |
451 | Specifies the order in which the client should try protocol 2 | 475 | Specifies the order in which the client should try protocol 2 |
452 | authentication methods. This allows a client to prefer one method (e.g. | 476 | authentication methods. |
477 | This allows a client to prefer one method (e.g. | ||
453 | .Cm keyboard-interactive ) | 478 | .Cm keyboard-interactive ) |
454 | over another method (e.g. | 479 | over another method (e.g. |
455 | .Cm password ) | 480 | .Cm password ) |
@@ -525,26 +550,6 @@ IPv6 addresses can be specified with an alternative syntax: | |||
525 | Multiple forwardings may be specified, and additional | 550 | Multiple forwardings may be specified, and additional |
526 | forwardings can be given on the command line. | 551 | forwardings can be given on the command line. |
527 | Only the superuser can forward privileged ports. | 552 | Only the superuser can forward privileged ports. |
528 | .It Cm RhostsAuthentication | ||
529 | Specifies whether to try rhosts based authentication. | ||
530 | Note that this | ||
531 | declaration only affects the client side and has no effect whatsoever | ||
532 | on security. | ||
533 | Most servers do not permit RhostsAuthentication because it | ||
534 | is not secure (see | ||
535 | .Cm RhostsRSAAuthentication ) . | ||
536 | The argument to this keyword must be | ||
537 | .Dq yes | ||
538 | or | ||
539 | .Dq no . | ||
540 | The default is | ||
541 | .Dq no . | ||
542 | This option applies to protocol version 1 only and requires | ||
543 | .Nm ssh | ||
544 | to be setuid root and | ||
545 | .Cm UsePrivilegedPort | ||
546 | to be set to | ||
547 | .Dq yes . | ||
548 | .It Cm RhostsRSAAuthentication | 553 | .It Cm RhostsRSAAuthentication |
549 | Specifies whether to try rhosts based authentication with RSA host | 554 | Specifies whether to try rhosts based authentication with RSA host |
550 | authentication. | 555 | authentication. |
@@ -586,12 +591,12 @@ The default is 0 (disabled), or 300 if | |||
586 | .Cm BatchMode | 591 | .Cm BatchMode |
587 | is set. | 592 | is set. |
588 | .It Cm SmartcardDevice | 593 | .It Cm SmartcardDevice |
589 | Specifies which smartcard device to use. The argument to this keyword is | 594 | Specifies which smartcard device to use. |
590 | the device | 595 | The argument to this keyword is the device |
591 | .Nm ssh | 596 | .Nm ssh |
592 | should use to communicate with a smartcard used for storing the user's | 597 | should use to communicate with a smartcard used for storing the user's |
593 | private RSA key. By default, no device is specified and smartcard support | 598 | private RSA key. |
594 | is not activated. | 599 | By default, no device is specified and smartcard support is not activated. |
595 | .It Cm StrictHostKeyChecking | 600 | .It Cm StrictHostKeyChecking |
596 | If this flag is set to | 601 | If this flag is set to |
597 | .Dq yes , | 602 | .Dq yes , |
@@ -641,11 +646,9 @@ If set to | |||
641 | must be setuid root. | 646 | must be setuid root. |
642 | Note that this option must be set to | 647 | Note that this option must be set to |
643 | .Dq yes | 648 | .Dq yes |
644 | if | 649 | for |
645 | .Cm RhostsAuthentication | ||
646 | and | ||
647 | .Cm RhostsRSAAuthentication | 650 | .Cm RhostsRSAAuthentication |
648 | authentications are needed with older servers. | 651 | with older servers. |
649 | .It Cm User | 652 | .It Cm User |
650 | Specifies the user to log in as. | 653 | Specifies the user to log in as. |
651 | This can be useful when a different user name is used on different machines. | 654 | This can be useful when a different user name is used on different machines. |
@@ -655,6 +658,12 @@ having to remember to give the user name on the command line. | |||
655 | Specifies a file to use for the user | 658 | Specifies a file to use for the user |
656 | host key database instead of | 659 | host key database instead of |
657 | .Pa $HOME/.ssh/known_hosts . | 660 | .Pa $HOME/.ssh/known_hosts . |
661 | .It Cm VerifyHostKeyDNS | ||
662 | Specifies whether to verify the remote key using DNS and SSHFP resource | ||
663 | records. | ||
664 | The default is | ||
665 | .Dq no . | ||
666 | Note that this option applies to protocol version 2 only. | ||
658 | .It Cm XAuthLocation | 667 | .It Cm XAuthLocation |
659 | Specifies the full pathname of the | 668 | Specifies the full pathname of the |
660 | .Xr xauth 1 | 669 | .Xr xauth 1 |
@@ -680,6 +689,8 @@ values that are not specified in the user's configuration file, and | |||
680 | for those users who do not have a configuration file. | 689 | for those users who do not have a configuration file. |
681 | This file must be world-readable. | 690 | This file must be world-readable. |
682 | .El | 691 | .El |
692 | .Sh SEE ALSO | ||
693 | .Xr ssh 1 | ||
683 | .Sh AUTHORS | 694 | .Sh AUTHORS |
684 | OpenSSH is a derivative of the original and free | 695 | OpenSSH is a derivative of the original and free |
685 | ssh 1.2.12 release by Tatu Ylonen. | 696 | ssh 1.2.12 release by Tatu Ylonen. |
@@ -689,5 +700,3 @@ removed many bugs, re-added newer features and | |||
689 | created OpenSSH. | 700 | created OpenSSH. |
690 | Markus Friedl contributed the support for SSH | 701 | Markus Friedl contributed the support for SSH |
691 | protocol versions 1.5 and 2.0. | 702 | protocol versions 1.5 and 2.0. |
692 | .Sh SEE ALSO | ||
693 | .Xr ssh 1 | ||