diff options
author | Colin Watson <cjwatson@debian.org> | 2006-05-12 07:53:24 +0000 |
---|---|---|
committer | Colin Watson <cjwatson@debian.org> | 2006-05-12 07:53:24 +0000 |
commit | 3e2e0ac10674d77618c4c7339e18b83ced247492 (patch) | |
tree | 8c7fd1c2333a75d57aa1cb5dfaee2310b1f3d37a /sshd_config.0 | |
parent | 56cf3dc50961bcc871a2d86984049e80c24d6456 (diff) | |
parent | 16704d57999d987fb8d9ba53379841a79f016d67 (diff) |
Import OpenSSH 4.3p2.
Diffstat (limited to 'sshd_config.0')
-rw-r--r-- | sshd_config.0 | 510 |
1 files changed, 510 insertions, 0 deletions
diff --git a/sshd_config.0 b/sshd_config.0 new file mode 100644 index 000000000..d2c5454e1 --- /dev/null +++ b/sshd_config.0 | |||
@@ -0,0 +1,510 @@ | |||
1 | SSHD_CONFIG(5) OpenBSD Programmer's Manual SSHD_CONFIG(5) | ||
2 | |||
3 | NAME | ||
4 | sshd_config - OpenSSH SSH daemon configuration file | ||
5 | |||
6 | SYNOPSIS | ||
7 | /etc/ssh/sshd_config | ||
8 | |||
9 | DESCRIPTION | ||
10 | sshd reads configuration data from /etc/ssh/sshd_config (or the file | ||
11 | specified with -f on the command line). The file contains keyword-argu- | ||
12 | ment pairs, one per line. Lines starting with `#' and empty lines are | ||
13 | interpreted as comments. | ||
14 | |||
15 | The possible keywords and their meanings are as follows (note that key- | ||
16 | words are case-insensitive and arguments are case-sensitive): | ||
17 | |||
18 | AcceptEnv | ||
19 | Specifies what environment variables sent by the client will be | ||
20 | copied into the session's environ(7). See SendEnv in | ||
21 | ssh_config(5) for how to configure the client. Note that envi- | ||
22 | ronment passing is only supported for protocol 2. Variables are | ||
23 | specified by name, which may contain the wildcard characters `*' | ||
24 | and `?'. Multiple environment variables may be separated by | ||
25 | whitespace or spread across multiple AcceptEnv directives. Be | ||
26 | warned that some environment variables could be used to bypass | ||
27 | restricted user environments. For this reason, care should be | ||
28 | taken in the use of this directive. The default is not to accept | ||
29 | any environment variables. | ||
30 | |||
31 | AddressFamily | ||
32 | Specifies which address family should be used by sshd. Valid ar- | ||
33 | guments are ``any'', ``inet'' (use IPv4 only) or ``inet6'' (use | ||
34 | IPv6 only). The default is ``any''. | ||
35 | |||
36 | AllowGroups | ||
37 | This keyword can be followed by a list of group name patterns, | ||
38 | separated by spaces. If specified, login is allowed only for | ||
39 | users whose primary group or supplementary group list matches one | ||
40 | of the patterns. `*' and `?' can be used as wildcards in the | ||
41 | patterns. Only group names are valid; a numerical group ID is | ||
42 | not recognized. By default, login is allowed for all groups. | ||
43 | |||
44 | AllowTcpForwarding | ||
45 | Specifies whether TCP forwarding is permitted. The default is | ||
46 | ``yes''. Note that disabling TCP forwarding does not improve se- | ||
47 | curity unless users are also denied shell access, as they can al- | ||
48 | ways install their own forwarders. | ||
49 | |||
50 | AllowUsers | ||
51 | This keyword can be followed by a list of user name patterns, | ||
52 | separated by spaces. If specified, login is allowed only for us- | ||
53 | er names that match one of the patterns. `*' and `?' can be used | ||
54 | as wildcards in the patterns. Only user names are valid; a nu- | ||
55 | merical user ID is not recognized. By default, login is allowed | ||
56 | for all users. If the pattern takes the form USER@HOST then USER | ||
57 | and HOST are separately checked, restricting logins to particular | ||
58 | users from particular hosts. | ||
59 | |||
60 | AuthorizedKeysFile | ||
61 | Specifies the file that contains the public keys that can be used | ||
62 | for user authentication. AuthorizedKeysFile may contain tokens | ||
63 | of the form %T which are substituted during connection set-up. | ||
64 | The following tokens are defined: %% is replaced by a literal | ||
65 | '%', %h is replaced by the home directory of the user being au- | ||
66 | thenticated and %u is replaced by the username of that user. Af- | ||
67 | ter expansion, AuthorizedKeysFile is taken to be an absolute path | ||
68 | or one relative to the user's home directory. The default is | ||
69 | ``.ssh/authorized_keys''. | ||
70 | |||
71 | Banner In some jurisdictions, sending a warning message before authenti- | ||
72 | cation may be relevant for getting legal protection. The con- | ||
73 | tents of the specified file are sent to the remote user before | ||
74 | authentication is allowed. This option is only available for | ||
75 | protocol version 2. By default, no banner is displayed. | ||
76 | |||
77 | ChallengeResponseAuthentication | ||
78 | Specifies whether challenge response authentication is allowed. | ||
79 | All authentication styles from login.conf(5) are supported. The | ||
80 | default is ``yes''. | ||
81 | |||
82 | Ciphers | ||
83 | Specifies the ciphers allowed for protocol version 2. Multiple | ||
84 | ciphers must be comma-separated. The supported ciphers are | ||
85 | ``3des-cbc'', ``aes128-cbc'', ``aes192-cbc'', ``aes256-cbc'', | ||
86 | ``aes128-ctr'', ``aes192-ctr'', ``aes256-ctr'', ``arcfour128'', | ||
87 | ``arcfour256'', ``arcfour'', ``blowfish-cbc'', and | ||
88 | ``cast128-cbc''. The default is | ||
89 | |||
90 | ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128, | ||
91 | arcfour256,arcfour,aes192-cbc,aes256-cbc,aes128-ctr, | ||
92 | aes192-ctr,aes256-ctr'' | ||
93 | |||
94 | ClientAliveCountMax | ||
95 | Sets the number of client alive messages (see below) which may be | ||
96 | sent without sshd receiving any messages back from the client. | ||
97 | If this threshold is reached while client alive messages are be- | ||
98 | ing sent, sshd will disconnect the client, terminating the ses- | ||
99 | sion. It is important to note that the use of client alive mes- | ||
100 | sages is very different from TCPKeepAlive (below). The client | ||
101 | alive messages are sent through the encrypted channel and there- | ||
102 | fore will not be spoofable. The TCP keepalive option enabled by | ||
103 | TCPKeepAlive is spoofable. The client alive mechanism is valu- | ||
104 | able when the client or server depend on knowing when a connec- | ||
105 | tion has become inactive. | ||
106 | |||
107 | The default value is 3. If ClientAliveInterval (see below) is | ||
108 | set to 15, and ClientAliveCountMax is left at the default, unre- | ||
109 | sponsive ssh clients will be disconnected after approximately 45 | ||
110 | seconds. | ||
111 | |||
112 | ClientAliveInterval | ||
113 | Sets a timeout interval in seconds after which if no data has | ||
114 | been received from the client, sshd will send a message through | ||
115 | the encrypted channel to request a response from the client. The | ||
116 | default is 0, indicating that these messages will not be sent to | ||
117 | the client. This option applies to protocol version 2 only. | ||
118 | |||
119 | Compression | ||
120 | Specifies whether compression is allowed, or delayed until the | ||
121 | user has authenticated successfully. The argument must be | ||
122 | ``yes'', ``delayed'', or ``no''. The default is ``delayed''. | ||
123 | |||
124 | DenyGroups | ||
125 | This keyword can be followed by a list of group name patterns, | ||
126 | separated by spaces. Login is disallowed for users whose primary | ||
127 | group or supplementary group list matches one of the patterns. | ||
128 | `*' and `?' can be used as wildcards in the patterns. Only group | ||
129 | names are valid; a numerical group ID is not recognized. By de- | ||
130 | fault, login is allowed for all groups. | ||
131 | |||
132 | DenyUsers | ||
133 | This keyword can be followed by a list of user name patterns, | ||
134 | separated by spaces. Login is disallowed for user names that | ||
135 | match one of the patterns. `*' and `?' can be used as wildcards | ||
136 | in the patterns. Only user names are valid; a numerical user ID | ||
137 | is not recognized. By default, login is allowed for all users. | ||
138 | If the pattern takes the form USER@HOST then USER and HOST are | ||
139 | separately checked, restricting logins to particular users from | ||
140 | particular hosts. | ||
141 | |||
142 | GatewayPorts | ||
143 | Specifies whether remote hosts are allowed to connect to ports | ||
144 | forwarded for the client. By default, sshd binds remote port | ||
145 | forwardings to the loopback address. This prevents other remote | ||
146 | hosts from connecting to forwarded ports. GatewayPorts can be | ||
147 | used to specify that sshd should allow remote port forwardings to | ||
148 | bind to non-loopback addresses, thus allowing other hosts to con- | ||
149 | nect. The argument may be ``no'' to force remote port forward- | ||
150 | ings to be available to the local host only, ``yes'' to force re- | ||
151 | mote port forwardings to bind to the wildcard address, or | ||
152 | ``clientspecified'' to allow the client to select the address to | ||
153 | which the forwarding is bound. The default is ``no''. | ||
154 | |||
155 | GSSAPIAuthentication | ||
156 | Specifies whether user authentication based on GSSAPI is allowed. | ||
157 | The default is ``no''. Note that this option applies to protocol | ||
158 | version 2 only. | ||
159 | |||
160 | GSSAPICleanupCredentials | ||
161 | Specifies whether to automatically destroy the user's credentials | ||
162 | cache on logout. The default is ``yes''. Note that this option | ||
163 | applies to protocol version 2 only. | ||
164 | |||
165 | HostbasedAuthentication | ||
166 | Specifies whether rhosts or /etc/hosts.equiv authentication to- | ||
167 | gether with successful public key client host authentication is | ||
168 | allowed (hostbased authentication). This option is similar to | ||
169 | RhostsRSAAuthentication and applies to protocol version 2 only. | ||
170 | The default is ``no''. | ||
171 | |||
172 | HostKey | ||
173 | Specifies a file containing a private host key used by SSH. The | ||
174 | default is /etc/ssh/ssh_host_key for protocol version 1, and | ||
175 | /etc/ssh/ssh_host_rsa_key and /etc/ssh/ssh_host_dsa_key for pro- | ||
176 | tocol version 2. Note that sshd will refuse to use a file if it | ||
177 | is group/world-accessible. It is possible to have multiple host | ||
178 | key files. ``rsa1'' keys are used for version 1 and ``dsa'' or | ||
179 | ``rsa'' are used for version 2 of the SSH protocol. | ||
180 | |||
181 | IgnoreRhosts | ||
182 | Specifies that .rhosts and .shosts files will not be used in | ||
183 | RhostsRSAAuthentication or HostbasedAuthentication. | ||
184 | |||
185 | /etc/hosts.equiv and /etc/shosts.equiv are still used. The de- | ||
186 | fault is ``yes''. | ||
187 | |||
188 | IgnoreUserKnownHosts | ||
189 | Specifies whether sshd should ignore the user's | ||
190 | ~/.ssh/known_hosts during RhostsRSAAuthentication or | ||
191 | HostbasedAuthentication. The default is ``no''. | ||
192 | |||
193 | KerberosAuthentication | ||
194 | Specifies whether the password provided by the user for | ||
195 | PasswordAuthentication will be validated through the Kerberos | ||
196 | KDC. To use this option, the server needs a Kerberos servtab | ||
197 | which allows the verification of the KDC's identity. Default is | ||
198 | ``no''. | ||
199 | |||
200 | KerberosGetAFSToken | ||
201 | If AFS is active and the user has a Kerberos 5 TGT, attempt to | ||
202 | acquire an AFS token before accessing the user's home directory. | ||
203 | Default is ``no''. | ||
204 | |||
205 | KerberosOrLocalPasswd | ||
206 | If set then if password authentication through Kerberos fails | ||
207 | then the password will be validated via any additional local | ||
208 | mechanism such as /etc/passwd. Default is ``yes''. | ||
209 | |||
210 | KerberosTicketCleanup | ||
211 | Specifies whether to automatically destroy the user's ticket | ||
212 | cache file on logout. Default is ``yes''. | ||
213 | |||
214 | KeyRegenerationInterval | ||
215 | In protocol version 1, the ephemeral server key is automatically | ||
216 | regenerated after this many seconds (if it has been used). The | ||
217 | purpose of regeneration is to prevent decrypting captured ses- | ||
218 | sions by later breaking into the machine and stealing the keys. | ||
219 | The key is never stored anywhere. If the value is 0, the key is | ||
220 | never regenerated. The default is 3600 (seconds). | ||
221 | |||
222 | ListenAddress | ||
223 | Specifies the local addresses sshd should listen on. The follow- | ||
224 | ing forms may be used: | ||
225 | |||
226 | ListenAddress host|IPv4_addr|IPv6_addr | ||
227 | ListenAddress host|IPv4_addr:port | ||
228 | ListenAddress [host|IPv6_addr]:port | ||
229 | |||
230 | If port is not specified, sshd will listen on the address and all | ||
231 | prior Port options specified. The default is to listen on all | ||
232 | local addresses. Multiple ListenAddress options are permitted. | ||
233 | Additionally, any Port options must precede this option for non | ||
234 | port qualified addresses. | ||
235 | |||
236 | LoginGraceTime | ||
237 | The server disconnects after this time if the user has not suc- | ||
238 | cessfully logged in. If the value is 0, there is no time limit. | ||
239 | The default is 120 seconds. | ||
240 | |||
241 | LogLevel | ||
242 | Gives the verbosity level that is used when logging messages from | ||
243 | sshd. The possible values are: QUIET, FATAL, ERROR, INFO, VER- | ||
244 | BOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3. The default is INFO. | ||
245 | DEBUG and DEBUG1 are equivalent. DEBUG2 and DEBUG3 each specify | ||
246 | higher levels of debugging output. Logging with a DEBUG level | ||
247 | violates the privacy of users and is not recommended. | ||
248 | |||
249 | MACs Specifies the available MAC (message authentication code) algo- | ||
250 | rithms. The MAC algorithm is used in protocol version 2 for data | ||
251 | integrity protection. Multiple algorithms must be comma-separat- | ||
252 | ed. The default is ``hmac-md5,hmac-sha1,hmac-ripemd160,hmac- | ||
253 | sha1-96,hmac-md5-96''. | ||
254 | |||
255 | MaxAuthTries | ||
256 | Specifies the maximum number of authentication attempts permitted | ||
257 | per connection. Once the number of failures reaches half this | ||
258 | value, additional failures are logged. The default is 6. | ||
259 | |||
260 | MaxStartups | ||
261 | Specifies the maximum number of concurrent unauthenticated con- | ||
262 | nections to the sshd daemon. Additional connections will be | ||
263 | dropped until authentication succeeds or the LoginGraceTime ex- | ||
264 | pires for a connection. The default is 10. | ||
265 | |||
266 | Alternatively, random early drop can be enabled by specifying the | ||
267 | three colon separated values ``start:rate:full'' (e.g., | ||
268 | "10:30:60"). sshd will refuse connection attempts with a proba- | ||
269 | bility of ``rate/100'' (30%) if there are currently ``start'' | ||
270 | (10) unauthenticated connections. The probability increases lin- | ||
271 | early and all connection attempts are refused if the number of | ||
272 | unauthenticated connections reaches ``full'' (60). | ||
273 | |||
274 | PasswordAuthentication | ||
275 | Specifies whether password authentication is allowed. The de- | ||
276 | fault is ``yes''. | ||
277 | |||
278 | PermitEmptyPasswords | ||
279 | When password authentication is allowed, it specifies whether the | ||
280 | server allows login to accounts with empty password strings. The | ||
281 | default is ``no''. | ||
282 | |||
283 | PermitRootLogin | ||
284 | Specifies whether root can log in using ssh(1). The argument | ||
285 | must be ``yes'', ``without-password'', ``forced-commands-only'' | ||
286 | or ``no''. The default is ``yes''. | ||
287 | |||
288 | If this option is set to ``without-password'' password authenti- | ||
289 | cation is disabled for root. | ||
290 | |||
291 | If this option is set to ``forced-commands-only'' root login with | ||
292 | public key authentication will be allowed, but only if the | ||
293 | command option has been specified (which may be useful for taking | ||
294 | remote backups even if root login is normally not allowed). All | ||
295 | other authentication methods are disabled for root. | ||
296 | |||
297 | If this option is set to ``no'' root is not allowed to log in. | ||
298 | |||
299 | PermitTunnel | ||
300 | Specifies whether tun(4) device forwarding is allowed. The argu- | ||
301 | ment must be ``yes'', ``point-to-point'', ``ethernet'' or ``no''. | ||
302 | The default is ``no''. | ||
303 | |||
304 | PermitUserEnvironment | ||
305 | Specifies whether ~/.ssh/environment and environment= options in | ||
306 | ~/.ssh/authorized_keys are processed by sshd. The default is | ||
307 | ``no''. Enabling environment processing may enable users to by- | ||
308 | pass access restrictions in some configurations using mechanisms | ||
309 | such as LD_PRELOAD. | ||
310 | |||
311 | PidFile | ||
312 | Specifies the file that contains the process ID of the sshd dae- | ||
313 | mon. The default is /var/run/sshd.pid. | ||
314 | |||
315 | Port Specifies the port number that sshd listens on. The default is | ||
316 | 22. Multiple options of this type are permitted. See also | ||
317 | ListenAddress. | ||
318 | |||
319 | PrintLastLog | ||
320 | Specifies whether sshd should print the date and time of the last | ||
321 | user login when a user logs in interactively. The default is | ||
322 | ``yes''. | ||
323 | |||
324 | PrintMotd | ||
325 | Specifies whether sshd should print /etc/motd when a user logs in | ||
326 | interactively. (On some systems it is also printed by the shell, | ||
327 | /etc/profile, or equivalent.) The default is ``yes''. | ||
328 | |||
329 | Protocol | ||
330 | Specifies the protocol versions sshd supports. The possible val- | ||
331 | ues are ``1'' and ``2''. Multiple versions must be comma-sepa- | ||
332 | rated. The default is ``2,1''. Note that the order of the pro- | ||
333 | tocol list does not indicate preference, because the client se- | ||
334 | lects among multiple protocol versions offered by the server. | ||
335 | Specifying ``2,1'' is identical to ``1,2''. | ||
336 | |||
337 | PubkeyAuthentication | ||
338 | Specifies whether public key authentication is allowed. The de- | ||
339 | fault is ``yes''. Note that this option applies to protocol ver- | ||
340 | sion 2 only. | ||
341 | |||
342 | RhostsRSAAuthentication | ||
343 | Specifies whether rhosts or /etc/hosts.equiv authentication to- | ||
344 | gether with successful RSA host authentication is allowed. The | ||
345 | default is ``no''. This option applies to protocol version 1 on- | ||
346 | ly. | ||
347 | |||
348 | RSAAuthentication | ||
349 | Specifies whether pure RSA authentication is allowed. The de- | ||
350 | fault is ``yes''. This option applies to protocol version 1 on- | ||
351 | ly. | ||
352 | |||
353 | ServerKeyBits | ||
354 | Defines the number of bits in the ephemeral protocol version 1 | ||
355 | server key. The minimum value is 512, and the default is 768. | ||
356 | |||
357 | StrictModes | ||
358 | Specifies whether sshd should check file modes and ownership of | ||
359 | the user's files and home directory before accepting login. This | ||
360 | is normally desirable because novices sometimes accidentally | ||
361 | leave their directory or files world-writable. The default is | ||
362 | ``yes''. | ||
363 | |||
364 | Subsystem | ||
365 | Configures an external subsystem (e.g., file transfer daemon). | ||
366 | Arguments should be a subsystem name and a command to execute up- | ||
367 | on subsystem request. The command sftp-server(8) implements the | ||
368 | ``sftp'' file transfer subsystem. By default no subsystems are | ||
369 | defined. Note that this option applies to protocol version 2 on- | ||
370 | ly. | ||
371 | |||
372 | SyslogFacility | ||
373 | Gives the facility code that is used when logging messages from | ||
374 | sshd. The possible values are: DAEMON, USER, AUTH, LOCAL0, LO- | ||
375 | CAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. The de- | ||
376 | fault is AUTH. | ||
377 | |||
378 | TCPKeepAlive | ||
379 | Specifies whether the system should send TCP keepalive messages | ||
380 | to the other side. If they are sent, death of the connection or | ||
381 | crash of one of the machines will be properly noticed. However, | ||
382 | this means that connections will die if the route is down tem- | ||
383 | porarily, and some people find it annoying. On the other hand, | ||
384 | if TCP keepalives are not sent, sessions may hang indefinitely on | ||
385 | the server, leaving ``ghost'' users and consuming server re- | ||
386 | sources. | ||
387 | |||
388 | The default is ``yes'' (to send TCP keepalive messages), and the | ||
389 | server will notice if the network goes down or the client host | ||
390 | crashes. This avoids infinitely hanging sessions. | ||
391 | |||
392 | To disable TCP keepalive messages, the value should be set to | ||
393 | ``no''. | ||
394 | |||
395 | UseDNS Specifies whether sshd should look up the remote host name and | ||
396 | check that the resolved host name for the remote IP address maps | ||
397 | back to the very same IP address. The default is ``yes''. | ||
398 | |||
399 | UseLogin | ||
400 | Specifies whether login(1) is used for interactive login ses- | ||
401 | sions. The default is ``no''. Note that login(1) is never used | ||
402 | for remote command execution. Note also, that if this is en- | ||
403 | abled, X11Forwarding will be disabled because login(1) does not | ||
404 | know how to handle xauth(1) cookies. If UsePrivilegeSeparation | ||
405 | is specified, it will be disabled after authentication. | ||
406 | |||
407 | UsePAM Enables the Pluggable Authentication Module interface. If set to | ||
408 | ``yes'' this will enable PAM authentication using | ||
409 | ChallengeResponseAuthentication and PAM account and session mod- | ||
410 | ule processing for all authentication types. | ||
411 | |||
412 | Because PAM challenge-response authentication usually serves an | ||
413 | equivalent role to password authentication, you should disable | ||
414 | either PasswordAuthentication or ChallengeResponseAuthentication. | ||
415 | |||
416 | If UsePAM is enabled, you will not be able to run sshd(8) as a | ||
417 | non-root user. The default is ``no''. | ||
418 | |||
419 | UsePrivilegeSeparation | ||
420 | Specifies whether sshd separates privileges by creating an un- | ||
421 | privileged child process to deal with incoming network traffic. | ||
422 | After successful authentication, another process will be created | ||
423 | that has the privilege of the authenticated user. The goal of | ||
424 | privilege separation is to prevent privilege escalation by con- | ||
425 | taining any corruption within the unprivileged processes. The | ||
426 | default is ``yes''. | ||
427 | |||
428 | X11DisplayOffset | ||
429 | Specifies the first display number available for sshd's X11 for- | ||
430 | warding. This prevents sshd from interfering with real X11 | ||
431 | servers. The default is 10. | ||
432 | |||
433 | X11Forwarding | ||
434 | Specifies whether X11 forwarding is permitted. The argument must | ||
435 | be ``yes'' or ``no''. The default is ``no''. | ||
436 | |||
437 | When X11 forwarding is enabled, there may be additional exposure | ||
438 | to the server and to client displays if the sshd proxy display is | ||
439 | configured to listen on the wildcard address (see X11UseLocalhost | ||
440 | below), however this is not the default. Additionally, the au- | ||
441 | thentication spoofing and authentication data verification and | ||
442 | substitution occur on the client side. The security risk of us- | ||
443 | ing X11 forwarding is that the client's X11 display server may be | ||
444 | exposed to attack when the ssh client requests forwarding (see | ||
445 | the warnings for ForwardX11 in ssh_config(5)). A system adminis- | ||
446 | trator may have a stance in which they want to protect clients | ||
447 | that may expose themselves to attack by unwittingly requesting | ||
448 | X11 forwarding, which can warrant a ``no'' setting. | ||
449 | |||
450 | Note that disabling X11 forwarding does not prevent users from | ||
451 | forwarding X11 traffic, as users can always install their own | ||
452 | forwarders. X11 forwarding is automatically disabled if UseLogin | ||
453 | is enabled. | ||
454 | |||
455 | X11UseLocalhost | ||
456 | Specifies whether sshd should bind the X11 forwarding server to | ||
457 | the loopback address or to the wildcard address. By default, | ||
458 | sshd binds the forwarding server to the loopback address and sets | ||
459 | the hostname part of the DISPLAY environment variable to | ||
460 | ``localhost''. This prevents remote hosts from connecting to the | ||
461 | proxy display. However, some older X11 clients may not function | ||
462 | with this configuration. X11UseLocalhost may be set to ``no'' to | ||
463 | specify that the forwarding server should be bound to the wild- | ||
464 | card address. The argument must be ``yes'' or ``no''. The de- | ||
465 | fault is ``yes''. | ||
466 | |||
467 | XAuthLocation | ||
468 | Specifies the full pathname of the xauth(1) program. The default | ||
469 | is /usr/X11R6/bin/xauth. | ||
470 | |||
471 | Time Formats | ||
472 | sshd command-line arguments and configuration file options that specify | ||
473 | time may be expressed using a sequence of the form: time[qualifier], | ||
474 | where time is a positive integer value and qualifier is one of the fol- | ||
475 | lowing: | ||
476 | |||
477 | <none> seconds | ||
478 | s | S seconds | ||
479 | m | M minutes | ||
480 | h | H hours | ||
481 | d | D days | ||
482 | w | W weeks | ||
483 | |||
484 | Each member of the sequence is added together to calculate the total time | ||
485 | value. | ||
486 | |||
487 | Time format examples: | ||
488 | |||
489 | 600 600 seconds (10 minutes) | ||
490 | 10m 10 minutes | ||
491 | 1h30m 1 hour 30 minutes (90 minutes) | ||
492 | |||
493 | FILES | ||
494 | /etc/ssh/sshd_config | ||
495 | Contains configuration data for sshd. This file should be | ||
496 | writable by root only, but it is recommended (though not neces- | ||
497 | sary) that it be world-readable. | ||
498 | |||
499 | SEE ALSO | ||
500 | sshd(8) | ||
501 | |||
502 | AUTHORS | ||
503 | OpenSSH is a derivative of the original and free ssh 1.2.12 release by | ||
504 | Tatu Ylonen. Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, Theo | ||
505 | de Raadt and Dug Song removed many bugs, re-added newer features and cre- | ||
506 | ated OpenSSH. Markus Friedl contributed the support for SSH protocol | ||
507 | versions 1.5 and 2.0. Niels Provos and Markus Friedl contributed support | ||
508 | for privilege separation. | ||
509 | |||
510 | OpenBSD 3.9 September 25, 1999 8 | ||