summaryrefslogtreecommitdiff
path: root/sshd_config.0
diff options
context:
space:
mode:
authorColin Watson <cjwatson@debian.org>2004-03-01 01:21:46 +0000
committerColin Watson <cjwatson@debian.org>2004-03-01 01:21:46 +0000
commitf5bda272678ec6dccaa5f29379cf60cb855018e8 (patch)
treec225d6ba3d09bb5ece49c05fdbaeb02df3c94a28 /sshd_config.0
parent3342470472b45f000576e9f79f55bb30c7d517b8 (diff)
parent45431c9b4677608680cd071768cbf156b316a7e8 (diff)
Import OpenSSH 3.8p1.
Diffstat (limited to 'sshd_config.0')
-rw-r--r--sshd_config.0459
1 files changed, 459 insertions, 0 deletions
diff --git a/sshd_config.0 b/sshd_config.0
new file mode 100644
index 000000000..981e91042
--- /dev/null
+++ b/sshd_config.0
@@ -0,0 +1,459 @@
1SSHD_CONFIG(5) OpenBSD Programmer's Manual SSHD_CONFIG(5)
2
3NAME
4 sshd_config - OpenSSH SSH daemon configuration file
5
6SYNOPSIS
7 /etc/ssh/sshd_config
8
9DESCRIPTION
10 sshd reads configuration data from /etc/ssh/sshd_config (or the file
11 specified with -f on the command line). The file contains keyword-argu-
12 ment pairs, one per line. Lines starting with `#' and empty lines are
13 interpreted as comments.
14
15 The possible keywords and their meanings are as follows (note that key-
16 words are case-insensitive and arguments are case-sensitive):
17
18 AllowGroups
19 This keyword can be followed by a list of group name patterns,
20 separated by spaces. If specified, login is allowed only for
21 users whose primary group or supplementary group list matches one
22 of the patterns. `*' and `?' can be used as wildcards in the
23 patterns. Only group names are valid; a numerical group ID is
24 not recognized. By default, login is allowed for all groups.
25
26 AllowTcpForwarding
27 Specifies whether TCP forwarding is permitted. The default is
28 ``yes''. Note that disabling TCP forwarding does not improve se-
29 curity unless users are also denied shell access, as they can al-
30 ways install their own forwarders.
31
32 AllowUsers
33 This keyword can be followed by a list of user name patterns,
34 separated by spaces. If specified, login is allowed only for us-
35 er names that match one of the patterns. `*' and `?' can be used
36 as wildcards in the patterns. Only user names are valid; a nu-
37 merical user ID is not recognized. By default, login is allowed
38 for all users. If the pattern takes the form USER@HOST then USER
39 and HOST are separately checked, restricting logins to particular
40 users from particular hosts.
41
42 AuthorizedKeysFile
43 Specifies the file that contains the public keys that can be used
44 for user authentication. AuthorizedKeysFile may contain tokens
45 of the form %T which are substituted during connection set-up.
46 The following tokens are defined: %% is replaced by a literal
47 '%', %h is replaced by the home directory of the user being au-
48 thenticated and %u is replaced by the username of that user. Af-
49 ter expansion, AuthorizedKeysFile is taken to be an absolute path
50 or one relative to the user's home directory. The default is
51 ``.ssh/authorized_keys''.
52
53 Banner In some jurisdictions, sending a warning message before authenti-
54 cation may be relevant for getting legal protection. The con-
55 tents of the specified file are sent to the remote user before
56 authentication is allowed. This option is only available for
57 protocol version 2. By default, no banner is displayed.
58
59 ChallengeResponseAuthentication
60 Specifies whether challenge response authentication is allowed.
61 All authentication styles from login.conf(5) are supported. The
62 default is ``yes''.
63
64 Ciphers
65 Specifies the ciphers allowed for protocol version 2. Multiple
66 ciphers must be comma-separated. The default is
67
68 ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
69 aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr''
70
71 ClientAliveInterval
72 Sets a timeout interval in seconds after which if no data has
73 been received from the client, sshd will send a message through
74 the encrypted channel to request a response from the client. The
75 default is 0, indicating that these messages will not be sent to
76 the client. This option applies to protocol version 2 only.
77
78 ClientAliveCountMax
79 Sets the number of client alive messages (see above) which may be
80 sent without sshd receiving any messages back from the client.
81 If this threshold is reached while client alive messages are be-
82 ing sent, sshd will disconnect the client, terminating the ses-
83 sion. It is important to note that the use of client alive mes-
84 sages is very different from TCPKeepAlive (below). The client
85 alive messages are sent through the encrypted channel and there-
86 fore will not be spoofable. The TCP keepalive option enabled by
87 TCPKeepAlive is spoofable. The client alive mechanism is valu-
88 able when the client or server depend on knowing when a connec-
89 tion has become inactive.
90
91 The default value is 3. If ClientAliveInterval (above) is set to
92 15, and ClientAliveCountMax is left at the default, unresponsive
93 ssh clients will be disconnected after approximately 45 seconds.
94
95 Compression
96 Specifies whether compression is allowed. The argument must be
97 ``yes'' or ``no''. The default is ``yes''.
98
99 DenyGroups
100 This keyword can be followed by a list of group name patterns,
101 separated by spaces. Login is disallowed for users whose primary
102 group or supplementary group list matches one of the patterns.
103 `*' and `?' can be used as wildcards in the patterns. Only group
104 names are valid; a numerical group ID is not recognized. By de-
105 fault, login is allowed for all groups.
106
107 DenyUsers
108 This keyword can be followed by a list of user name patterns,
109 separated by spaces. Login is disallowed for user names that
110 match one of the patterns. `*' and `?' can be used as wildcards
111 in the patterns. Only user names are valid; a numerical user ID
112 is not recognized. By default, login is allowed for all users.
113 If the pattern takes the form USER@HOST then USER and HOST are
114 separately checked, restricting logins to particular users from
115 particular hosts.
116
117 GatewayPorts
118 Specifies whether remote hosts are allowed to connect to ports
119 forwarded for the client. By default, sshd binds remote port
120 forwardings to the loopback address. This prevents other remote
121 hosts from connecting to forwarded ports. GatewayPorts can be
122 used to specify that sshd should bind remote port forwardings to
123 the wildcard address, thus allowing remote hosts to connect to
124 forwarded ports. The argument must be ``yes'' or ``no''. The
125 default is ``no''.
126
127 GSSAPIAuthentication
128 Specifies whether user authentication based on GSSAPI is allowed.
129 The default is ``no''. Note that this option applies to protocol
130 version 2 only.
131
132 GSSAPICleanupCredentials
133 Specifies whether to automatically destroy the user's credentials
134 cache on logout. The default is ``yes''. Note that this option
135 applies to protocol version 2 only.
136
137 HostbasedAuthentication
138 Specifies whether rhosts or /etc/hosts.equiv authentication to-
139 gether with successful public key client host authentication is
140 allowed (hostbased authentication). This option is similar to
141 RhostsRSAAuthentication and applies to protocol version 2 only.
142 The default is ``no''.
143
144 HostKey
145 Specifies a file containing a private host key used by SSH. The
146 default is /etc/ssh/ssh_host_key for protocol version 1, and
147 /etc/ssh/ssh_host_rsa_key and /etc/ssh/ssh_host_dsa_key for pro-
148 tocol version 2. Note that sshd will refuse to use a file if it
149 is group/world-accessible. It is possible to have multiple host
150 key files. ``rsa1'' keys are used for version 1 and ``dsa'' or
151 ``rsa'' are used for version 2 of the SSH protocol.
152
153 IgnoreRhosts
154 Specifies that .rhosts and .shosts files will not be used in
155 RhostsRSAAuthentication or HostbasedAuthentication.
156
157 /etc/hosts.equiv and /etc/shosts.equiv are still used. The de-
158 fault is ``yes''.
159
160 IgnoreUserKnownHosts
161 Specifies whether sshd should ignore the user's
162 $HOME/.ssh/known_hosts during RhostsRSAAuthentication or
163 HostbasedAuthentication. The default is ``no''.
164
165 KerberosAuthentication
166 Specifies whether the password provided by the user for
167 PasswordAuthentication will be validated through the Kerberos
168 KDC. To use this option, the server needs a Kerberos servtab
169 which allows the verification of the KDC's identity. Default is
170 ``no''.
171
172 KerberosOrLocalPasswd
173 If set then if password authentication through Kerberos fails
174 then the password will be validated via any additional local
175 mechanism such as /etc/passwd. Default is ``yes''.
176
177 KerberosTicketCleanup
178 Specifies whether to automatically destroy the user's ticket
179 cache file on logout. Default is ``yes''.
180
181 KeyRegenerationInterval
182 In protocol version 1, the ephemeral server key is automatically
183 regenerated after this many seconds (if it has been used). The
184 purpose of regeneration is to prevent decrypting captured ses-
185 sions by later breaking into the machine and stealing the keys.
186 The key is never stored anywhere. If the value is 0, the key is
187 never regenerated. The default is 3600 (seconds).
188
189 ListenAddress
190 Specifies the local addresses sshd should listen on. The follow-
191 ing forms may be used:
192
193 ListenAddress host|IPv4_addr|IPv6_addr
194 ListenAddress host|IPv4_addr:port
195 ListenAddress [host|IPv6_addr]:port
196
197 If port is not specified, sshd will listen on the address and all
198 prior Port options specified. The default is to listen on all
199 local addresses. Multiple ListenAddress options are permitted.
200 Additionally, any Port options must precede this option for non
201 port qualified addresses.
202
203 LoginGraceTime
204 The server disconnects after this time if the user has not suc-
205 cessfully logged in. If the value is 0, there is no time limit.
206 The default is 120 seconds.
207
208 LogLevel
209 Gives the verbosity level that is used when logging messages from
210 sshd. The possible values are: QUIET, FATAL, ERROR, INFO, VER-
211 BOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3. The default is INFO.
212 DEBUG and DEBUG1 are equivalent. DEBUG2 and DEBUG3 each specify
213 higher levels of debugging output. Logging with a DEBUG level
214 violates the privacy of users and is not recommended.
215
216 MACs Specifies the available MAC (message authentication code) algo-
217 rithms. The MAC algorithm is used in protocol version 2 for data
218 integrity protection. Multiple algorithms must be comma-separat-
219 ed. The default is ``hmac-md5,hmac-sha1,hmac-ripemd160,hmac-
220 sha1-96,hmac-md5-96''.
221
222 MaxStartups
223 Specifies the maximum number of concurrent unauthenticated con-
224 nections to the sshd daemon. Additional connections will be
225 dropped until authentication succeeds or the LoginGraceTime ex-
226 pires for a connection. The default is 10.
227
228 Alternatively, random early drop can be enabled by specifying the
229 three colon separated values ``start:rate:full'' (e.g.,
230 "10:30:60"). sshd will refuse connection attempts with a proba-
231 bility of ``rate/100'' (30%) if there are currently ``start''
232 (10) unauthenticated connections. The probability increases lin-
233 early and all connection attempts are refused if the number of
234 unauthenticated connections reaches ``full'' (60).
235
236 PasswordAuthentication
237 Specifies whether password authentication is allowed. The de-
238 fault is ``yes''.
239
240 PermitEmptyPasswords
241 When password authentication is allowed, it specifies whether the
242 server allows login to accounts with empty password strings. The
243 default is ``no''.
244
245 PermitRootLogin
246 Specifies whether root can login using ssh(1). The argument must
247 be ``yes'', ``without-password'', ``forced-commands-only'' or
248 ``no''. The default is ``yes''.
249
250 If this option is set to ``without-password'' password authenti-
251 cation is disabled for root.
252
253 If this option is set to ``forced-commands-only'' root login with
254 public key authentication will be allowed, but only if the
255 command option has been specified (which may be useful for taking
256 remote backups even if root login is normally not allowed). All
257 other authentication methods are disabled for root.
258
259 If this option is set to ``no'' root is not allowed to login.
260
261 PermitUserEnvironment
262 Specifies whether ~/.ssh/environment and environment= options in
263 ~/.ssh/authorized_keys are processed by sshd. The default is
264 ``no''. Enabling environment processing may enable users to by-
265 pass access restrictions in some configurations using mechanisms
266 such as LD_PRELOAD.
267
268 PidFile
269 Specifies the file that contains the process ID of the sshd dae-
270 mon. The default is /var/run/sshd.pid.
271
272 Port Specifies the port number that sshd listens on. The default is
273 22. Multiple options of this type are permitted. See also
274 ListenAddress.
275
276 PrintLastLog
277 Specifies whether sshd should print the date and time when the
278 user last logged in. The default is ``yes''.
279
280 PrintMotd
281 Specifies whether sshd should print /etc/motd when a user logs in
282 interactively. (On some systems it is also printed by the shell,
283 /etc/profile, or equivalent.) The default is ``yes''.
284
285 Protocol
286 Specifies the protocol versions sshd supports. The possible val-
287 ues are ``1'' and ``2''. Multiple versions must be comma-sepa-
288 rated. The default is ``2,1''. Note that the order of the pro-
289 tocol list does not indicate preference, because the client se-
290 lects among multiple protocol versions offered by the server.
291 Specifying ``2,1'' is identical to ``1,2''.
292
293 PubkeyAuthentication
294 Specifies whether public key authentication is allowed. The de-
295 fault is ``yes''. Note that this option applies to protocol ver-
296 sion 2 only.
297
298 RhostsRSAAuthentication
299 Specifies whether rhosts or /etc/hosts.equiv authentication to-
300 gether with successful RSA host authentication is allowed. The
301 default is ``no''. This option applies to protocol version 1 on-
302 ly.
303
304 RSAAuthentication
305 Specifies whether pure RSA authentication is allowed. The de-
306 fault is ``yes''. This option applies to protocol version 1 on-
307 ly.
308
309 ServerKeyBits
310 Defines the number of bits in the ephemeral protocol version 1
311 server key. The minimum value is 512, and the default is 768.
312
313 StrictModes
314 Specifies whether sshd should check file modes and ownership of
315 the user's files and home directory before accepting login. This
316 is normally desirable because novices sometimes accidentally
317 leave their directory or files world-writable. The default is
318 ``yes''.
319
320 Subsystem
321 Configures an external subsystem (e.g., file transfer daemon).
322 Arguments should be a subsystem name and a command to execute up-
323 on subsystem request. The command sftp-server(8) implements the
324 ``sftp'' file transfer subsystem. By default no subsystems are
325 defined. Note that this option applies to protocol version 2 on-
326 ly.
327
328 SyslogFacility
329 Gives the facility code that is used when logging messages from
330 sshd. The possible values are: DAEMON, USER, AUTH, LOCAL0, LO-
331 CAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. The de-
332 fault is AUTH.
333
334 TCPKeepAlive
335 Specifies whether the system should send TCP keepalive messages
336 to the other side. If they are sent, death of the connection or
337 crash of one of the machines will be properly noticed. However,
338 this means that connections will die if the route is down tem-
339 porarily, and some people find it annoying. On the other hand,
340 if TCP keepalives are not sent, sessions may hang indefinitely on
341 the server, leaving ``ghost'' users and consuming server re-
342 sources.
343
344 The default is ``yes'' (to send TCP keepalive messages), and the
345 server will notice if the network goes down or the client host
346 crashes. This avoids infinitely hanging sessions.
347
348 To disable TCP keepalive messages, the value should be set to
349 ``no''.
350
351 UseDNS Specifies whether sshd should lookup the remote host name and
352 check that the resolved host name for the remote IP address maps
353 back to the very same IP address. The default is ``yes''.
354
355 UseLogin
356 Specifies whether login(1) is used for interactive login ses-
357 sions. The default is ``no''. Note that login(1) is never used
358 for remote command execution. Note also, that if this is en-
359 abled, X11Forwarding will be disabled because login(1) does not
360 know how to handle xauth(1) cookies. If UsePrivilegeSeparation
361 is specified, it will be disabled after authentication.
362
363 UsePAM Enables PAM authentication (via challenge-response) and session
364 set up. If you enable this, you should probably disable
365 PasswordAuthentication. If you enable then you will not be able
366 to run sshd as a non-root user. The default is ``no''.
367
368 UsePrivilegeSeparation
369 Specifies whether sshd separates privileges by creating an un-
370 privileged child process to deal with incoming network traffic.
371 After successful authentication, another process will be created
372 that has the privilege of the authenticated user. The goal of
373 privilege separation is to prevent privilege escalation by con-
374 taining any corruption within the unprivileged processes. The
375 default is ``yes''.
376
377 X11DisplayOffset
378 Specifies the first display number available for sshd's X11 for-
379 warding. This prevents sshd from interfering with real X11
380 servers. The default is 10.
381
382 X11Forwarding
383 Specifies whether X11 forwarding is permitted. The argument must
384 be ``yes'' or ``no''. The default is ``no''.
385
386 When X11 forwarding is enabled, there may be additional exposure
387 to the server and to client displays if the sshd proxy display is
388 configured to listen on the wildcard address (see X11UseLocalhost
389 below), however this is not the default. Additionally, the au-
390 thentication spoofing and authentication data verification and
391 substitution occur on the client side. The security risk of us-
392 ing X11 forwarding is that the client's X11 display server may be
393 exposed to attack when the ssh client requests forwarding (see
394 the warnings for ForwardX11 in ssh_config(5)). A system adminis-
395 trator may have a stance in which they want to protect clients
396 that may expose themselves to attack by unwittingly requesting
397 X11 forwarding, which can warrant a ``no'' setting.
398
399 Note that disabling X11 forwarding does not prevent users from
400 forwarding X11 traffic, as users can always install their own
401 forwarders. X11 forwarding is automatically disabled if UseLogin
402 is enabled.
403
404 X11UseLocalhost
405 Specifies whether sshd should bind the X11 forwarding server to
406 the loopback address or to the wildcard address. By default,
407 sshd binds the forwarding server to the loopback address and sets
408 the hostname part of the DISPLAY environment variable to
409 ``localhost''. This prevents remote hosts from connecting to the
410 proxy display. However, some older X11 clients may not function
411 with this configuration. X11UseLocalhost may be set to ``no'' to
412 specify that the forwarding server should be bound to the wild-
413 card address. The argument must be ``yes'' or ``no''. The de-
414 fault is ``yes''.
415
416 XAuthLocation
417 Specifies the full pathname of the xauth(1) program. The default
418 is /usr/X11R6/bin/xauth.
419
420 Time Formats
421 sshd command-line arguments and configuration file options that specify
422 time may be expressed using a sequence of the form: time[qualifier],
423 where time is a positive integer value and qualifier is one of the fol-
424 lowing:
425
426 <none> seconds
427 s | S seconds
428 m | M minutes
429 h | H hours
430 d | D days
431 w | W weeks
432
433 Each member of the sequence is added together to calculate the total time
434 value.
435
436 Time format examples:
437
438 600 600 seconds (10 minutes)
439 10m 10 minutes
440 1h30m 1 hour 30 minutes (90 minutes)
441
442FILES
443 /etc/ssh/sshd_config
444 Contains configuration data for sshd. This file should be
445 writable by root only, but it is recommended (though not neces-
446 sary) that it be world-readable.
447
448SEE ALSO
449 sshd(8)
450
451AUTHORS
452 OpenSSH is a derivative of the original and free ssh 1.2.12 release by
453 Tatu Ylonen. Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, Theo
454 de Raadt and Dug Song removed many bugs, re-added newer features and cre-
455 ated OpenSSH. Markus Friedl contributed the support for SSH protocol
456 versions 1.5 and 2.0. Niels Provos and Markus Friedl contributed support
457 for privilege separation.
458
459OpenBSD 3.4 September 25, 1999 7