diff options
author | Colin Watson <cjwatson@debian.org> | 2011-09-06 14:56:29 +0100 |
---|---|---|
committer | Colin Watson <cjwatson@debian.org> | 2011-09-06 14:56:29 +0100 |
commit | 978e62d6f14c60747bddef2cc72d66a9c8b83b54 (patch) | |
tree | 89400a44e42d84937deba7864e4964d6c7734da5 /sshd.8 | |
parent | 87c685b8c6a49814fd782288097b3093f975aa72 (diff) | |
parent | 3a7e89697ca363de0f64e0d5704c57219294e41c (diff) |
* New upstream release (http://www.openssh.org/txt/release-5.9).
- Introduce sandboxing of the pre-auth privsep child using an optional
sshd_config(5) "UsePrivilegeSeparation=sandbox" mode that enables
mandatory restrictions on the syscalls the privsep child can perform.
- Add new SHA256-based HMAC transport integrity modes from
http://www.ietf.org/id/draft-dbider-sha2-mac-for-ssh-02.txt.
- The pre-authentication sshd(8) privilege separation slave process now
logs via a socket shared with the master process, avoiding the need to
maintain /dev/log inside the chroot (closes: #75043, #429243,
#599240).
- ssh(1) now warns when a server refuses X11 forwarding (closes:
#504757).
- sshd_config(5)'s AuthorizedKeysFile now accepts multiple paths,
separated by whitespace (closes: #76312). The authorized_keys2
fallback is deprecated but documented (closes: #560156).
- ssh(1) and sshd(8): set IPv6 traffic class from IPQoS, as well as IPv4
ToS/DSCP (closes: #498297).
- ssh-add(1) now accepts keys piped from standard input. E.g. "ssh-add
- < /path/to/key" (closes: #229124).
- Clean up lost-passphrase text in ssh-keygen(1) (closes: #444691).
- Say "required" rather than "recommended" in unprotected-private-key
warning (LP: #663455).
Diffstat (limited to 'sshd.8')
-rw-r--r-- | sshd.8 | 13 |
1 files changed, 8 insertions, 5 deletions
@@ -33,8 +33,8 @@ | |||
33 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | 33 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
34 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | 34 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
35 | .\" | 35 | .\" |
36 | .\" $OpenBSD: sshd.8,v 1.260 2010/10/28 18:33:28 jmc Exp $ | 36 | .\" $OpenBSD: sshd.8,v 1.263 2011/08/02 01:22:11 djm Exp $ |
37 | .Dd $Mdocdate: October 28 2010 $ | 37 | .Dd $Mdocdate: August 2 2011 $ |
38 | .Dt SSHD 8 | 38 | .Dt SSHD 8 |
39 | .Os | 39 | .Os |
40 | .Sh NAME | 40 | .Sh NAME |
@@ -314,7 +314,8 @@ The client selects the encryption algorithm | |||
314 | to use from those offered by the server. | 314 | to use from those offered by the server. |
315 | Additionally, session integrity is provided | 315 | Additionally, session integrity is provided |
316 | through a cryptographic message authentication code | 316 | through a cryptographic message authentication code |
317 | (hmac-md5, hmac-sha1, umac-64 or hmac-ripemd160). | 317 | (hmac-md5, hmac-sha1, umac-64, hmac-ripemd160, |
318 | hmac-sha2-256 or hmac-sha2-512). | ||
318 | .Pp | 319 | .Pp |
319 | Finally, the server and the client enter an authentication dialog. | 320 | Finally, the server and the client enter an authentication dialog. |
320 | The client tries to authenticate itself using | 321 | The client tries to authenticate itself using |
@@ -462,10 +463,12 @@ is run, and if that | |||
462 | does not exist either, xauth is used to add the cookie. | 463 | does not exist either, xauth is used to add the cookie. |
463 | .Sh AUTHORIZED_KEYS FILE FORMAT | 464 | .Sh AUTHORIZED_KEYS FILE FORMAT |
464 | .Cm AuthorizedKeysFile | 465 | .Cm AuthorizedKeysFile |
465 | specifies the file containing public keys for | 466 | specifies the files containing public keys for |
466 | public key authentication; | 467 | public key authentication; |
467 | if none is specified, the default is | 468 | if none is specified, the default is |
468 | .Pa ~/.ssh/authorized_keys . | 469 | .Pa ~/.ssh/authorized_keys |
470 | and | ||
471 | .Pa ~/.ssh/authorized_keys2 . | ||
469 | Each line of the file contains one | 472 | Each line of the file contains one |
470 | key (empty lines and lines starting with a | 473 | key (empty lines and lines starting with a |
471 | .Ql # | 474 | .Ql # |