Import OpenSSH 3.7p1.

1 files changed, 459 insertions, 0 deletions

diff --git a/sshd_config.0 b/sshd_config.0
new file mode 100644
index 000000000..bc266317f
--- /dev/null
+++ b/sshd_config.0
@@ -0,0 +1,459 @@
+SSHD_CONFIG(5)              BSD File Formats Manual             SSHD_CONFIG(5)
+
+NAME
+     sshd_config - OpenSSH SSH daemon configuration file
+
+SYNOPSIS
+     /etc/ssh/sshd_config
+
+DESCRIPTION
+     sshd reads configuration data from /etc/ssh/sshd_config (or the file
+     specified with -f on the command line).  The file contains keyword-argu-
+     ment pairs, one per line.  Lines starting with M-bM-^@M-^X#M-bM-^@M-^Y and empty lines are
+     interpreted as comments.
+
+     The possible keywords and their meanings are as follows (note that key-
+     words are case-insensitive and arguments are case-sensitive):
+
+     AllowGroups
+             This keyword can be followed by a list of group name patterns,
+             separated by spaces.  If specified, login is allowed only for
+             users whose primary group or supplementary group list matches one
+             of the patterns.  M-bM-^@M-^X*M-bM-^@M-^Y and M-bM-^@M-^X?M-bM-^@M-^Y can be used as wildcards in the
+             patterns.  Only group names are valid; a numerical group ID is
+             not recognized.  By default, login is allowed for all groups.
+
+     AllowTcpForwarding
+             Specifies whether TCP forwarding is permitted.  The default is
+             M-bM-^@M-^\yesM-bM-^@M-^].  Note that disabling TCP forwarding does not improve secu-
+             rity unless users are also denied shell access, as they can
+             always install their own forwarders.
+
+     AllowUsers
+             This keyword can be followed by a list of user name patterns,
+             separated by spaces.  If specified, login is allowed only for
+             user names that match one of the patterns.  M-bM-^@M-^X*M-bM-^@M-^Y and M-bM-^@M-^X?M-bM-^@M-^Y can be
+             used as wildcards in the patterns.  Only user names are valid; a
+             numerical user ID is not recognized.  By default, login is
+             allowed for all users.  If the pattern takes the form USER@HOST
+             then USER and HOST are separately checked, restricting logins to
+             particular users from particular hosts.
+
+     AuthorizedKeysFile
+             Specifies the file that contains the public keys that can be used
+             for user authentication.  AuthorizedKeysFile may contain tokens
+             of the form %T which are substituted during connection set-up.
+             The following tokens are defined: %% is replaced by a literal
+             M-bM-^@M-^Y%M-bM-^@M-^Y, %h is replaced by the home directory of the user being
+             authenticated and %u is replaced by the username of that user.
+             After expansion, AuthorizedKeysFile is taken to be an absolute
+             path or one relative to the userM-bM-^@M-^Ys home directory.  The default
+             is M-bM-^@M-^\.ssh/authorized_keysM-bM-^@M-^].
+
+     Banner  In some jurisdictions, sending a warning message before authenti-
+             cation may be relevant for getting legal protection.  The con-
+             tents of the specified file are sent to the remote user before
+             authentication is allowed.  This option is only available for
+             protocol version 2.  By default, no banner is displayed.
+
+     ChallengeResponseAuthentication
+             Specifies whether challenge response authentication is allowed.
+             All authentication styles from login.conf(5) are supported.  The
+             default is M-bM-^@M-^\yesM-bM-^@M-^].
+
+     Ciphers
+             Specifies the ciphers allowed for protocol version 2.  Multiple
+             ciphers must be comma-separated.  The default is
+
+               M-bM-^@M-^XM-bM-^@M-^Xaes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
+                 aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctrM-bM-^@M-^YM-bM-^@M-^Y
+
+     ClientAliveInterval
+             Sets a timeout interval in seconds after which if no data has
+             been received from the client, sshd will send a message through
+             the encrypted channel to request a response from the client.  The
+             default is 0, indicating that these messages will not be sent to
+             the client.  This option applies to protocol version 2 only.
+
+     ClientAliveCountMax
+             Sets the number of client alive messages (see above) which may be
+             sent without sshd receiving any messages back from the client.
+             If this threshold is reached while client alive messages are
+             being sent, sshd will disconnect the client, terminating the ses-
+             sion.  It is important to note that the use of client alive mes-
+             sages is very different from KeepAlive (below).  The client alive
+             messages are sent through the encrypted channel and therefore
+             will not be spoofable.  The TCP keepalive option enabled by
+             KeepAlive is spoofable.  The client alive mechanism is valuable
+             when the client or server depend on knowing when a connection has
+             become inactive.
+
+             The default value is 3.  If ClientAliveInterval (above) is set to
+             15, and ClientAliveCountMax is left at the default, unresponsive
+             ssh clients will be disconnected after approximately 45 seconds.
+
+     Compression
+             Specifies whether compression is allowed.  The argument must be
+             M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^].  The default is M-bM-^@M-^\yesM-bM-^@M-^].
+
+     DenyGroups
+             This keyword can be followed by a list of group name patterns,
+             separated by spaces.  Login is disallowed for users whose primary
+             group or supplementary group list matches one of the patterns.
+             M-bM-^@M-^X*M-bM-^@M-^Y and M-bM-^@M-^X?M-bM-^@M-^Y can be used as wildcards in the patterns.  Only group
+             names are valid; a numerical group ID is not recognized.  By
+             default, login is allowed for all groups.
+
+     DenyUsers
+             This keyword can be followed by a list of user name patterns,
+             separated by spaces.  Login is disallowed for user names that
+             match one of the patterns.  M-bM-^@M-^X*M-bM-^@M-^Y and M-bM-^@M-^X?M-bM-^@M-^Y can be used as wildcards
+             in the patterns.  Only user names are valid; a numerical user ID
+             is not recognized.  By default, login is allowed for all users.
+             If the pattern takes the form USER@HOST then USER and HOST are
+             separately checked, restricting logins to particular users from
+             particular hosts.
+
+     GatewayPorts
+             Specifies whether remote hosts are allowed to connect to ports
+             forwarded for the client.  By default, sshd binds remote port
+             forwardings to the loopback address.  This prevents other remote
+             hosts from connecting to forwarded ports.  GatewayPorts can be
+             used to specify that sshd should bind remote port forwardings to
+             the wildcard address, thus allowing remote hosts to connect to
+             forwarded ports.  The argument must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^].  The
+             default is M-bM-^@M-^\noM-bM-^@M-^].
+
+     GSSAPIAuthentication
+             Specifies whether user authentication based on GSSAPI is allowed.
+             The default is M-bM-^@M-^\noM-bM-^@M-^].  Note that this option applies to protocol
+             version 2 only.
+
+     GSSAPICleanupCredentials
+             Specifies whether to automatically destroy the userM-bM-^@M-^Ys credentials
+             cache on logout.  The default is M-bM-^@M-^\yesM-bM-^@M-^].  Note that this option
+             applies to protocol version 2 only.
+
+     HostbasedAuthentication
+             Specifies whether rhosts or /etc/hosts.equiv authentication
+             together with successful public key client host authentication is
+             allowed (hostbased authentication).  This option is similar to
+             RhostsRSAAuthentication and applies to protocol version 2 only.
+             The default is M-bM-^@M-^\noM-bM-^@M-^].
+
+     HostKey
+             Specifies a file containing a private host key used by SSH.  The
+             default is /etc/ssh/ssh_host_key for protocol version 1, and
+             /etc/ssh/ssh_host_rsa_key and /etc/ssh/ssh_host_dsa_key for pro-
+             tocol version 2.  Note that sshd will refuse to use a file if it
+             is group/world-accessible.  It is possible to have multiple host
+             key files.  M-bM-^@M-^\rsa1M-bM-^@M-^] keys are used for version 1 and M-bM-^@M-^\dsaM-bM-^@M-^] or M-bM-^@M-^\rsaM-bM-^@M-^]
+             are used for version 2 of the SSH protocol.
+
+     IgnoreRhosts
+             Specifies that .rhosts and .shosts files will not be used in
+             RhostsRSAAuthentication or HostbasedAuthentication.
+
+             /etc/hosts.equiv and /etc/shosts.equiv are still used.  The
+             default is M-bM-^@M-^\yesM-bM-^@M-^].
+
+     IgnoreUserKnownHosts
+             Specifies whether sshd should ignore the userM-bM-^@M-^Ys
+             $HOME/.ssh/known_hosts during RhostsRSAAuthentication or
+             HostbasedAuthentication.  The default is M-bM-^@M-^\noM-bM-^@M-^].
+
+     KeepAlive
+             Specifies whether the system should send TCP keepalive messages
+             to the other side.  If they are sent, death of the connection or
+             crash of one of the machines will be properly noticed.  However,
+             this means that connections will die if the route is down tem-
+             porarily, and some people find it annoying.  On the other hand,
+             if keepalives are not sent, sessions may hang indefinitely on the
+             server, leaving M-bM-^@M-^\ghostM-bM-^@M-^] users and consuming server resources.
+
+             The default is M-bM-^@M-^\yesM-bM-^@M-^] (to send keepalives), and the server will
+             notice if the network goes down or the client host crashes.  This
+             avoids infinitely hanging sessions.
+
+             To disable keepalives, the value should be set to M-bM-^@M-^\noM-bM-^@M-^].
+
+     KerberosAuthentication
+             Specifies whether the password provided by the user for
+             PasswordAuthentication will be validated through the Kerberos
+             KDC.  To use this option, the server needs a Kerberos servtab
+             which allows the verification of the KDCM-bM-^@M-^Ys identity.  Default is
+             M-bM-^@M-^\noM-bM-^@M-^].
+
+     KerberosOrLocalPasswd
+             If set then if password authentication through Kerberos fails
+             then the password will be validated via any additional local
+             mechanism such as /etc/passwd.  Default is M-bM-^@M-^\yesM-bM-^@M-^].
+
+     KerberosTicketCleanup
+             Specifies whether to automatically destroy the userM-bM-^@M-^Ys ticket
+             cache file on logout.  Default is M-bM-^@M-^\yesM-bM-^@M-^].
+
+     KeyRegenerationInterval
+             In protocol version 1, the ephemeral server key is automatically
+             regenerated after this many seconds (if it has been used).  The
+             purpose of regeneration is to prevent decrypting captured ses-
+             sions by later breaking into the machine and stealing the keys.
+             The key is never stored anywhere.  If the value is 0, the key is
+             never regenerated.  The default is 3600 (seconds).
+
+     ListenAddress
+             Specifies the local addresses sshd should listen on.  The follow-
+             ing forms may be used:
+
+                   ListenAddress host|IPv4_addr|IPv6_addr
+                   ListenAddress host|IPv4_addr:port
+                   ListenAddress [host|IPv6_addr]:port
+
+             If port is not specified, sshd will listen on the address and all
+             prior Port options specified.  The default is to listen on all
+             local addresses.  Multiple ListenAddress options are permitted.
+             Additionally, any Port options must precede this option for non
+             port qualified addresses.
+
+     LoginGraceTime
+             The server disconnects after this time if the user has not suc-
+             cessfully logged in.  If the value is 0, there is no time limit.
+             The default is 120 seconds.
+
+     LogLevel
+             Gives the verbosity level that is used when logging messages from
+             sshd.  The possible values are: QUIET, FATAL, ERROR, INFO, VER-
+             BOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3.  The default is INFO.
+             DEBUG and DEBUG1 are equivalent.  DEBUG2 and DEBUG3 each specify
+             higher levels of debugging output.  Logging with a DEBUG level
+             violates the privacy of users and is not recommended.
+
+     MACs    Specifies the available MAC (message authentication code) algo-
+             rithms.  The MAC algorithm is used in protocol version 2 for data
+             integrity protection.  Multiple algorithms must be comma-sepa-
+             rated.  The default is
+             M-bM-^@M-^\hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96M-bM-^@M-^].
+
+     MaxStartups
+             Specifies the maximum number of concurrent unauthenticated con-
+             nections to the sshd daemon.  Additional connections will be
+             dropped until authentication succeeds or the LoginGraceTime
+             expires for a connection.  The default is 10.
+
+             Alternatively, random early drop can be enabled by specifying the
+             three colon separated values M-bM-^@M-^\start:rate:fullM-bM-^@M-^] (e.g.,
+             "10:30:60").  sshd will refuse connection attempts with a proba-
+             bility of M-bM-^@M-^\rate/100M-bM-^@M-^] (30%) if there are currently M-bM-^@M-^\startM-bM-^@M-^] (10)
+             unauthenticated connections.  The probability increases linearly
+             and all connection attempts are refused if the number of unau-
+             thenticated connections reaches M-bM-^@M-^\fullM-bM-^@M-^] (60).
+
+     PasswordAuthentication
+             Specifies whether password authentication is allowed.  The
+             default is M-bM-^@M-^\yesM-bM-^@M-^].
+
+     PermitEmptyPasswords
+             When password authentication is allowed, it specifies whether the
+             server allows login to accounts with empty password strings.  The
+             default is M-bM-^@M-^\noM-bM-^@M-^].
+
+     PermitRootLogin
+             Specifies whether root can login using ssh(1).  The argument must
+             be M-bM-^@M-^\yesM-bM-^@M-^], M-bM-^@M-^\without-passwordM-bM-^@M-^], M-bM-^@M-^\forced-commands-onlyM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^].
+             The default is M-bM-^@M-^\yesM-bM-^@M-^].
+
+             If this option is set to M-bM-^@M-^\without-passwordM-bM-^@M-^] password authentica-
+             tion is disabled for root.
+
+             If this option is set to M-bM-^@M-^\forced-commands-onlyM-bM-^@M-^] root login with
+             public key authentication will be allowed, but only if the
+             command option has been specified (which may be useful for taking
+             remote backups even if root login is normally not allowed).  All
+             other authentication methods are disabled for root.
+
+             If this option is set to M-bM-^@M-^\noM-bM-^@M-^] root is not allowed to login.
+
+     PermitUserEnvironment
+             Specifies whether ~/.ssh/environment and environment= options in
+             ~/.ssh/authorized_keys are processed by sshd.  The default is
+             M-bM-^@M-^\noM-bM-^@M-^].  Enabling environment processing may enable users to bypass
+             access restrictions in some configurations using mechanisms such
+             as LD_PRELOAD.
+
+     PidFile
+             Specifies the file that contains the process ID of the sshd dae-
+             mon.  The default is /var/run/sshd.pid.
+
+     Port    Specifies the port number that sshd listens on.  The default is
+             22.  Multiple options of this type are permitted.  See also
+             ListenAddress.
+
+     PrintLastLog
+             Specifies whether sshd should print the date and time when the
+             user last logged in.  The default is M-bM-^@M-^\yesM-bM-^@M-^].
+
+     PrintMotd
+             Specifies whether sshd should print /etc/motd when a user logs in
+             interactively.  (On some systems it is also printed by the shell,
+             /etc/profile, or equivalent.)  The default is M-bM-^@M-^\yesM-bM-^@M-^].
+
+     Protocol
+             Specifies the protocol versions sshd supports.  The possible val-
+             ues are M-bM-^@M-^\1M-bM-^@M-^] and M-bM-^@M-^\2M-bM-^@M-^].  Multiple versions must be comma-separated.
+             The default is M-bM-^@M-^\2,1M-bM-^@M-^].  Note that the order of the protocol list
+             does not indicate preference, because the client selects among
+             multiple protocol versions offered by the server.  Specifying
+             M-bM-^@M-^\2,1M-bM-^@M-^] is identical to M-bM-^@M-^\1,2M-bM-^@M-^].
+
+     PubkeyAuthentication
+             Specifies whether public key authentication is allowed.  The
+             default is M-bM-^@M-^\yesM-bM-^@M-^].  Note that this option applies to protocol ver-
+             sion 2 only.  RhostsRSAAuthentication should be used instead,
+             because it performs RSA-based host authentication in addition to
+             normal rhosts or /etc/hosts.equiv authentication.  The default is
+             M-bM-^@M-^\noM-bM-^@M-^].  This option applies to protocol version 1 only.
+
+     RhostsRSAAuthentication
+             Specifies whether rhosts or /etc/hosts.equiv authentication
+             together with successful RSA host authentication is allowed.  The
+             default is M-bM-^@M-^\noM-bM-^@M-^].  This option applies to protocol version 1 only.
+
+     RSAAuthentication
+             Specifies whether pure RSA authentication is allowed.  The
+             default is M-bM-^@M-^\yesM-bM-^@M-^].  This option applies to protocol version 1
+             only.
+
+     ServerKeyBits
+             Defines the number of bits in the ephemeral protocol version 1
+             server key.  The minimum value is 512, and the default is 768.
+
+     StrictModes
+             Specifies whether sshd should check file modes and ownership of
+             the userM-bM-^@M-^Ys files and home directory before accepting login.  This
+             is normally desirable because novices sometimes accidentally
+             leave their directory or files world-writable.  The default is
+             M-bM-^@M-^\yesM-bM-^@M-^].
+
+     Subsystem
+             Configures an external subsystem (e.g., file transfer daemon).
+             Arguments should be a subsystem name and a command to execute
+             upon subsystem request.  The command sftp-server(8) implements
+             the M-bM-^@M-^\sftpM-bM-^@M-^] file transfer subsystem.  By default no subsystems are
+             defined.  Note that this option applies to protocol version 2
+             only.
+
+     SyslogFacility
+             Gives the facility code that is used when logging messages from
+             sshd.  The possible values are: DAEMON, USER, AUTH, LOCAL0,
+             LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.  The
+             default is AUTH.
+
+     UseDNS  Specifies whether sshd should lookup the remote host name and
+             check that the resolved host name for the remote IP address maps
+             back to the very same IP address.  The default is M-bM-^@M-^\yesM-bM-^@M-^].
+
+     UseLogin
+             Specifies whether login(1) is used for interactive login ses-
+             sions.  The default is M-bM-^@M-^\noM-bM-^@M-^].  Note that login(1) is never used
+             for remote command execution.  Note also, that if this is
+             enabled, X11Forwarding will be disabled because login(1) does not
+             know how to handle xauth(1) cookies.  If UsePrivilegeSeparation
+             is specified, it will be disabled after authentication.
+
+     UsePAM  Enables PAM authentication (via challenge-response) and session
+             set up.  If you enable this, you should probably disable
+             PasswordAuthentication.  If you enable then you will not be able
+             to run sshd as a non-root user.
+
+     UsePrivilegeSeparation
+             Specifies whether sshd separates privileges by creating an
+             unprivileged child process to deal with incoming network traffic.
+             After successful authentication, another process will be created
+             that has the privilege of the authenticated user.  The goal of
+             privilege separation is to prevent privilege escalation by con-
+             taining any corruption within the unprivileged processes.  The
+             default is M-bM-^@M-^\yesM-bM-^@M-^].
+
+     X11DisplayOffset
+             Specifies the first display number available for sshdM-bM-^@M-^Ys X11 for-
+             warding.  This prevents sshd from interfering with real X11
+             servers.  The default is 10.
+
+     X11Forwarding
+             Specifies whether X11 forwarding is permitted.  The argument must
+             be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^].  The default is M-bM-^@M-^\noM-bM-^@M-^].
+
+             When X11 forwarding is enabled, there may be additional exposure
+             to the server and to client displays if the sshd proxy display is
+             configured to listen on the wildcard address (see X11UseLocalhost
+             below), however this is not the default.  Additionally, the
+             authentication spoofing and authentication data verification and
+             substitution occur on the client side.  The security risk of
+             using X11 forwarding is that the clientM-bM-^@M-^Ys X11 display server may
+             be exposed to attack when the ssh client requests forwarding (see
+             the warnings for ForwardX11 in ssh_config(5)).  A system adminis-
+             trator may have a stance in which they want to protect clients
+             that may expose themselves to attack by unwittingly requesting
+             X11 forwarding, which can warrant a M-bM-^@M-^\noM-bM-^@M-^] setting.
+
+             Note that disabling X11 forwarding does not prevent users from
+             forwarding X11 traffic, as users can always install their own
+             forwarders.  X11 forwarding is automatically disabled if UseLogin
+             is enabled.
+
+     X11UseLocalhost
+             Specifies whether sshd should bind the X11 forwarding server to
+             the loopback address or to the wildcard address.  By default,
+             sshd binds the forwarding server to the loopback address and sets
+             the hostname part of the DISPLAY environment variable to
+             M-bM-^@M-^\localhostM-bM-^@M-^].  This prevents remote hosts from connecting to the
+             proxy display.  However, some older X11 clients may not function
+             with this configuration.  X11UseLocalhost may be set to M-bM-^@M-^\noM-bM-^@M-^] to
+             specify that the forwarding server should be bound to the wild-
+             card address.  The argument must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^].  The default
+             is M-bM-^@M-^\yesM-bM-^@M-^].
+
+     XAuthLocation
+             Specifies the full pathname of the xauth(1) program.  The default
+             is /usr/X11R6/bin/xauth.
+
+   Time Formats
+     sshd command-line arguments and configuration file options that specify
+     time may be expressed using a sequence of the form: time[qualifier],
+     where time is a positive integer value and qualifier is one of the fol-
+     lowing:
+
+           <none>  seconds
+           s | S   seconds
+           m | M   minutes
+           h | H   hours
+           d | D   days
+           w | W   weeks
+
+     Each member of the sequence is added together to calculate the total time
+     value.
+
+     Time format examples:
+
+           600     600 seconds (10 minutes)
+           10m     10 minutes
+           1h30m   1 hour 30 minutes (90 minutes)
+
+FILES
+     /etc/ssh/sshd_config
+             Contains configuration data for sshd.  This file should be
+             writable by root only, but it is recommended (though not neces-
+             sary) that it be world-readable.
+
+SEE ALSO
+     sshd(8)
+
+AUTHORS
+     OpenSSH is a derivative of the original and free ssh 1.2.12 release by
+     Tatu Ylonen.  Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, Theo
+     de Raadt and Dug Song removed many bugs, re-added newer features and cre-
+     ated OpenSSH.  Markus Friedl contributed the support for SSH protocol
+     versions 1.5 and 2.0.  Niels Provos and Markus Friedl contributed support
+     for privilege separation.
+
+BSD                           September 25, 1999                           BSD