summaryrefslogtreecommitdiff
path: root/ssh_config.5
diff options
context:
space:
mode:
authorSimon Wilkinson <simon@sxw.org.uk>2014-02-09 16:09:48 +0000
committerColin Watson <cjwatson@debian.org>2015-11-29 17:26:06 +0000
commit233e78235070e871b658c8f289e600bd52a99711 (patch)
tree38c49e39e2a61ef635ce70062d8830d09fc963ff /ssh_config.5
parent58ddb8ad21f21f5358db0204c4ba9abf94a1ca11 (diff)
GSSAPI key exchange support
This patch has been rejected upstream: "None of the OpenSSH developers are in favour of adding this, and this situation has not changed for several years. This is not a slight on Simon's patch, which is of fine quality, but just that a) we don't trust GSSAPI implementations that much and b) we don't like adding new KEX since they are pre-auth attack surface. This one is particularly scary, since it requires hooks out to typically root-owned system resources." However, quite a lot of people rely on this in Debian, and it's better to have it merged into the main openssh package rather than having separate -krb5 packages (as we used to have). It seems to have a generally good security history. Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1242 Last-Updated: 2015-11-29 Patch-Name: gssapi.patch
Diffstat (limited to 'ssh_config.5')
-rw-r--r--ssh_config.536
1 files changed, 35 insertions, 1 deletions
diff --git a/ssh_config.5 b/ssh_config.5
index 5b0975f87..b2dc49b09 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -749,11 +749,45 @@ Specifies whether user authentication based on GSSAPI is allowed.
749The default is 749The default is
750.Dq no . 750.Dq no .
751Note that this option applies to protocol version 2 only. 751Note that this option applies to protocol version 2 only.
752.It Cm GSSAPIKeyExchange
753Specifies whether key exchange based on GSSAPI may be used. When using
754GSSAPI key exchange the server need not have a host key.
755The default is
756.Dq no .
757Note that this option applies to protocol version 2 only.
758.It Cm GSSAPIClientIdentity
759If set, specifies the GSSAPI client identity that ssh should use when
760connecting to the server. The default is unset, which means that the default
761identity will be used.
762.It Cm GSSAPIServerIdentity
763If set, specifies the GSSAPI server identity that ssh should expect when
764connecting to the server. The default is unset, which means that the
765expected GSSAPI server identity will be determined from the target
766hostname.
752.It Cm GSSAPIDelegateCredentials 767.It Cm GSSAPIDelegateCredentials
753Forward (delegate) credentials to the server. 768Forward (delegate) credentials to the server.
754The default is 769The default is
755.Dq no . 770.Dq no .
756Note that this option applies to protocol version 2 only. 771Note that this option applies to protocol version 2 connections using GSSAPI.
772.It Cm GSSAPIRenewalForcesRekey
773If set to
774.Dq yes
775then renewal of the client's GSSAPI credentials will force the rekeying of the
776ssh connection. With a compatible server, this can delegate the renewed
777credentials to a session on the server.
778The default is
779.Dq no .
780.It Cm GSSAPITrustDns
781Set to
782.Dq yes
783to indicate that the DNS is trusted to securely canonicalize
784the name of the host being connected to. If
785.Dq no ,
786the hostname entered on the
787command line will be passed untouched to the GSSAPI library.
788The default is
789.Dq no .
790This option only applies to protocol version 2 connections using GSSAPI.
757.It Cm HashKnownHosts 791.It Cm HashKnownHosts
758Indicates that 792Indicates that
759.Xr ssh 1 793.Xr ssh 1