Import OpenSSH 4.3p2.

1 files changed, 510 insertions, 0 deletions

diff --git a/sshd_config.0 b/sshd_config.0
new file mode 100644
index 000000000..d2c5454e1
--- /dev/null
+++ b/sshd_config.0
@@ -0,0 +1,510 @@
+SSHD_CONFIG(5)            OpenBSD Programmer's Manual           SSHD_CONFIG(5)
+
+NAME
+     sshd_config - OpenSSH SSH daemon configuration file
+
+SYNOPSIS
+     /etc/ssh/sshd_config
+
+DESCRIPTION
+     sshd reads configuration data from /etc/ssh/sshd_config (or the file
+     specified with -f on the command line).  The file contains keyword-argu-
+     ment pairs, one per line.  Lines starting with `#' and empty lines are
+     interpreted as comments.
+
+     The possible keywords and their meanings are as follows (note that key-
+     words are case-insensitive and arguments are case-sensitive):
+
+     AcceptEnv
+             Specifies what environment variables sent by the client will be
+             copied into the session's environ(7).  See SendEnv in
+             ssh_config(5) for how to configure the client.  Note that envi-
+             ronment passing is only supported for protocol 2.  Variables are
+             specified by name, which may contain the wildcard characters `*'
+             and `?'.  Multiple environment variables may be separated by
+             whitespace or spread across multiple AcceptEnv directives.  Be
+             warned that some environment variables could be used to bypass
+             restricted user environments.  For this reason, care should be
+             taken in the use of this directive.  The default is not to accept
+             any environment variables.
+
+     AddressFamily
+             Specifies which address family should be used by sshd.  Valid ar-
+             guments are ``any'', ``inet'' (use IPv4 only) or ``inet6'' (use
+             IPv6 only).  The default is ``any''.
+
+     AllowGroups
+             This keyword can be followed by a list of group name patterns,
+             separated by spaces.  If specified, login is allowed only for
+             users whose primary group or supplementary group list matches one
+             of the patterns.  `*' and `?' can be used as wildcards in the
+             patterns.  Only group names are valid; a numerical group ID is
+             not recognized.  By default, login is allowed for all groups.
+
+     AllowTcpForwarding
+             Specifies whether TCP forwarding is permitted.  The default is
+             ``yes''.  Note that disabling TCP forwarding does not improve se-
+             curity unless users are also denied shell access, as they can al-
+             ways install their own forwarders.
+
+     AllowUsers
+             This keyword can be followed by a list of user name patterns,
+             separated by spaces.  If specified, login is allowed only for us-
+             er names that match one of the patterns.  `*' and `?' can be used
+             as wildcards in the patterns.  Only user names are valid; a nu-
+             merical user ID is not recognized.  By default, login is allowed
+             for all users.  If the pattern takes the form USER@HOST then USER
+             and HOST are separately checked, restricting logins to particular
+             users from particular hosts.
+
+     AuthorizedKeysFile
+             Specifies the file that contains the public keys that can be used
+             for user authentication.  AuthorizedKeysFile may contain tokens
+             of the form %T which are substituted during connection set-up.
+             The following tokens are defined: %% is replaced by a literal
+             '%', %h is replaced by the home directory of the user being au-
+             thenticated and %u is replaced by the username of that user.  Af-
+             ter expansion, AuthorizedKeysFile is taken to be an absolute path
+             or one relative to the user's home directory.  The default is
+             ``.ssh/authorized_keys''.
+
+     Banner  In some jurisdictions, sending a warning message before authenti-
+             cation may be relevant for getting legal protection.  The con-
+             tents of the specified file are sent to the remote user before
+             authentication is allowed.  This option is only available for
+             protocol version 2.  By default, no banner is displayed.
+
+     ChallengeResponseAuthentication
+             Specifies whether challenge response authentication is allowed.
+             All authentication styles from login.conf(5) are supported.  The
+             default is ``yes''.
+
+     Ciphers
+             Specifies the ciphers allowed for protocol version 2.  Multiple
+             ciphers must be comma-separated.  The supported ciphers are
+             ``3des-cbc'', ``aes128-cbc'', ``aes192-cbc'', ``aes256-cbc'',
+             ``aes128-ctr'', ``aes192-ctr'', ``aes256-ctr'', ``arcfour128'',
+             ``arcfour256'', ``arcfour'', ``blowfish-cbc'', and
+             ``cast128-cbc''.  The default is
+
+               ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,
+                 arcfour256,arcfour,aes192-cbc,aes256-cbc,aes128-ctr,
+                 aes192-ctr,aes256-ctr''
+
+     ClientAliveCountMax
+             Sets the number of client alive messages (see below) which may be
+             sent without sshd receiving any messages back from the client.
+             If this threshold is reached while client alive messages are be-
+             ing sent, sshd will disconnect the client, terminating the ses-
+             sion.  It is important to note that the use of client alive mes-
+             sages is very different from TCPKeepAlive (below).  The client
+             alive messages are sent through the encrypted channel and there-
+             fore will not be spoofable.  The TCP keepalive option enabled by
+             TCPKeepAlive is spoofable.  The client alive mechanism is valu-
+             able when the client or server depend on knowing when a connec-
+             tion has become inactive.
+
+             The default value is 3.  If ClientAliveInterval (see below) is
+             set to 15, and ClientAliveCountMax is left at the default, unre-
+             sponsive ssh clients will be disconnected after approximately 45
+             seconds.
+
+     ClientAliveInterval
+             Sets a timeout interval in seconds after which if no data has
+             been received from the client, sshd will send a message through
+             the encrypted channel to request a response from the client.  The
+             default is 0, indicating that these messages will not be sent to
+             the client.  This option applies to protocol version 2 only.
+
+     Compression
+             Specifies whether compression is allowed, or delayed until the
+             user has authenticated successfully.  The argument must be
+             ``yes'', ``delayed'', or ``no''.  The default is ``delayed''.
+
+     DenyGroups
+             This keyword can be followed by a list of group name patterns,
+             separated by spaces.  Login is disallowed for users whose primary
+             group or supplementary group list matches one of the patterns.
+             `*' and `?' can be used as wildcards in the patterns.  Only group
+             names are valid; a numerical group ID is not recognized.  By de-
+             fault, login is allowed for all groups.
+
+     DenyUsers
+             This keyword can be followed by a list of user name patterns,
+             separated by spaces.  Login is disallowed for user names that
+             match one of the patterns.  `*' and `?' can be used as wildcards
+             in the patterns.  Only user names are valid; a numerical user ID
+             is not recognized.  By default, login is allowed for all users.
+             If the pattern takes the form USER@HOST then USER and HOST are
+             separately checked, restricting logins to particular users from
+             particular hosts.
+
+     GatewayPorts
+             Specifies whether remote hosts are allowed to connect to ports
+             forwarded for the client.  By default, sshd binds remote port
+             forwardings to the loopback address.  This prevents other remote
+             hosts from connecting to forwarded ports.  GatewayPorts can be
+             used to specify that sshd should allow remote port forwardings to
+             bind to non-loopback addresses, thus allowing other hosts to con-
+             nect.  The argument may be ``no'' to force remote port forward-
+             ings to be available to the local host only, ``yes'' to force re-
+             mote port forwardings to bind to the wildcard address, or
+             ``clientspecified'' to allow the client to select the address to
+             which the forwarding is bound.  The default is ``no''.
+
+     GSSAPIAuthentication
+             Specifies whether user authentication based on GSSAPI is allowed.
+             The default is ``no''.  Note that this option applies to protocol
+             version 2 only.
+
+     GSSAPICleanupCredentials
+             Specifies whether to automatically destroy the user's credentials
+             cache on logout.  The default is ``yes''.  Note that this option
+             applies to protocol version 2 only.
+
+     HostbasedAuthentication
+             Specifies whether rhosts or /etc/hosts.equiv authentication to-
+             gether with successful public key client host authentication is
+             allowed (hostbased authentication).  This option is similar to
+             RhostsRSAAuthentication and applies to protocol version 2 only.
+             The default is ``no''.
+
+     HostKey
+             Specifies a file containing a private host key used by SSH.  The
+             default is /etc/ssh/ssh_host_key for protocol version 1, and
+             /etc/ssh/ssh_host_rsa_key and /etc/ssh/ssh_host_dsa_key for pro-
+             tocol version 2.  Note that sshd will refuse to use a file if it
+             is group/world-accessible.  It is possible to have multiple host
+             key files.  ``rsa1'' keys are used for version 1 and ``dsa'' or
+             ``rsa'' are used for version 2 of the SSH protocol.
+
+     IgnoreRhosts
+             Specifies that .rhosts and .shosts files will not be used in
+             RhostsRSAAuthentication or HostbasedAuthentication.
+
+             /etc/hosts.equiv and /etc/shosts.equiv are still used.  The de-
+             fault is ``yes''.
+
+     IgnoreUserKnownHosts
+             Specifies whether sshd should ignore the user's
+             ~/.ssh/known_hosts during RhostsRSAAuthentication or
+             HostbasedAuthentication.  The default is ``no''.
+
+     KerberosAuthentication
+             Specifies whether the password provided by the user for
+             PasswordAuthentication will be validated through the Kerberos
+             KDC.  To use this option, the server needs a Kerberos servtab
+             which allows the verification of the KDC's identity.  Default is
+             ``no''.
+
+     KerberosGetAFSToken
+             If AFS is active and the user has a Kerberos 5 TGT, attempt to
+             acquire an AFS token before accessing the user's home directory.
+             Default is ``no''.
+
+     KerberosOrLocalPasswd
+             If set then if password authentication through Kerberos fails
+             then the password will be validated via any additional local
+             mechanism such as /etc/passwd.  Default is ``yes''.
+
+     KerberosTicketCleanup
+             Specifies whether to automatically destroy the user's ticket
+             cache file on logout.  Default is ``yes''.
+
+     KeyRegenerationInterval
+             In protocol version 1, the ephemeral server key is automatically
+             regenerated after this many seconds (if it has been used).  The
+             purpose of regeneration is to prevent decrypting captured ses-
+             sions by later breaking into the machine and stealing the keys.
+             The key is never stored anywhere.  If the value is 0, the key is
+             never regenerated.  The default is 3600 (seconds).
+
+     ListenAddress
+             Specifies the local addresses sshd should listen on.  The follow-
+             ing forms may be used:
+
+                   ListenAddress host|IPv4_addr|IPv6_addr
+                   ListenAddress host|IPv4_addr:port
+                   ListenAddress [host|IPv6_addr]:port
+
+             If port is not specified, sshd will listen on the address and all
+             prior Port options specified.  The default is to listen on all
+             local addresses.  Multiple ListenAddress options are permitted.
+             Additionally, any Port options must precede this option for non
+             port qualified addresses.
+
+     LoginGraceTime
+             The server disconnects after this time if the user has not suc-
+             cessfully logged in.  If the value is 0, there is no time limit.
+             The default is 120 seconds.
+
+     LogLevel
+             Gives the verbosity level that is used when logging messages from
+             sshd.  The possible values are: QUIET, FATAL, ERROR, INFO, VER-
+             BOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3.  The default is INFO.
+             DEBUG and DEBUG1 are equivalent.  DEBUG2 and DEBUG3 each specify
+             higher levels of debugging output.  Logging with a DEBUG level
+             violates the privacy of users and is not recommended.
+
+     MACs    Specifies the available MAC (message authentication code) algo-
+             rithms.  The MAC algorithm is used in protocol version 2 for data
+             integrity protection.  Multiple algorithms must be comma-separat-
+             ed.  The default is ``hmac-md5,hmac-sha1,hmac-ripemd160,hmac-
+             sha1-96,hmac-md5-96''.
+
+     MaxAuthTries
+             Specifies the maximum number of authentication attempts permitted
+             per connection.  Once the number of failures reaches half this
+             value, additional failures are logged.  The default is 6.
+
+     MaxStartups
+             Specifies the maximum number of concurrent unauthenticated con-
+             nections to the sshd daemon.  Additional connections will be
+             dropped until authentication succeeds or the LoginGraceTime ex-
+             pires for a connection.  The default is 10.
+
+             Alternatively, random early drop can be enabled by specifying the
+             three colon separated values ``start:rate:full'' (e.g.,
+             "10:30:60").  sshd will refuse connection attempts with a proba-
+             bility of ``rate/100'' (30%) if there are currently ``start''
+             (10) unauthenticated connections.  The probability increases lin-
+             early and all connection attempts are refused if the number of
+             unauthenticated connections reaches ``full'' (60).
+
+     PasswordAuthentication
+             Specifies whether password authentication is allowed.  The de-
+             fault is ``yes''.
+
+     PermitEmptyPasswords
+             When password authentication is allowed, it specifies whether the
+             server allows login to accounts with empty password strings.  The
+             default is ``no''.
+
+     PermitRootLogin
+             Specifies whether root can log in using ssh(1).  The argument
+             must be ``yes'', ``without-password'', ``forced-commands-only''
+             or ``no''.  The default is ``yes''.
+
+             If this option is set to ``without-password'' password authenti-
+             cation is disabled for root.
+
+             If this option is set to ``forced-commands-only'' root login with
+             public key authentication will be allowed, but only if the
+             command option has been specified (which may be useful for taking
+             remote backups even if root login is normally not allowed).  All
+             other authentication methods are disabled for root.
+
+             If this option is set to ``no'' root is not allowed to log in.
+
+     PermitTunnel
+             Specifies whether tun(4) device forwarding is allowed.  The argu-
+             ment must be ``yes'', ``point-to-point'', ``ethernet'' or ``no''.
+             The default is ``no''.
+
+     PermitUserEnvironment
+             Specifies whether ~/.ssh/environment and environment= options in
+             ~/.ssh/authorized_keys are processed by sshd.  The default is
+             ``no''.  Enabling environment processing may enable users to by-
+             pass access restrictions in some configurations using mechanisms
+             such as LD_PRELOAD.
+
+     PidFile
+             Specifies the file that contains the process ID of the sshd dae-
+             mon.  The default is /var/run/sshd.pid.
+
+     Port    Specifies the port number that sshd listens on.  The default is
+             22.  Multiple options of this type are permitted.  See also
+             ListenAddress.
+
+     PrintLastLog
+             Specifies whether sshd should print the date and time of the last
+             user login when a user logs in interactively.  The default is
+             ``yes''.
+
+     PrintMotd
+             Specifies whether sshd should print /etc/motd when a user logs in
+             interactively.  (On some systems it is also printed by the shell,
+             /etc/profile, or equivalent.)  The default is ``yes''.
+
+     Protocol
+             Specifies the protocol versions sshd supports.  The possible val-
+             ues are ``1'' and ``2''.  Multiple versions must be comma-sepa-
+             rated.  The default is ``2,1''.  Note that the order of the pro-
+             tocol list does not indicate preference, because the client se-
+             lects among multiple protocol versions offered by the server.
+             Specifying ``2,1'' is identical to ``1,2''.
+
+     PubkeyAuthentication
+             Specifies whether public key authentication is allowed.  The de-
+             fault is ``yes''.  Note that this option applies to protocol ver-
+             sion 2 only.
+
+     RhostsRSAAuthentication
+             Specifies whether rhosts or /etc/hosts.equiv authentication to-
+             gether with successful RSA host authentication is allowed.  The
+             default is ``no''.  This option applies to protocol version 1 on-
+             ly.
+
+     RSAAuthentication
+             Specifies whether pure RSA authentication is allowed.  The de-
+             fault is ``yes''.  This option applies to protocol version 1 on-
+             ly.
+
+     ServerKeyBits
+             Defines the number of bits in the ephemeral protocol version 1
+             server key.  The minimum value is 512, and the default is 768.
+
+     StrictModes
+             Specifies whether sshd should check file modes and ownership of
+             the user's files and home directory before accepting login.  This
+             is normally desirable because novices sometimes accidentally
+             leave their directory or files world-writable.  The default is
+             ``yes''.
+
+     Subsystem
+             Configures an external subsystem (e.g., file transfer daemon).
+             Arguments should be a subsystem name and a command to execute up-
+             on subsystem request.  The command sftp-server(8) implements the
+             ``sftp'' file transfer subsystem.  By default no subsystems are
+             defined.  Note that this option applies to protocol version 2 on-
+             ly.
+
+     SyslogFacility
+             Gives the facility code that is used when logging messages from
+             sshd.  The possible values are: DAEMON, USER, AUTH, LOCAL0, LO-
+             CAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.  The de-
+             fault is AUTH.
+
+     TCPKeepAlive
+             Specifies whether the system should send TCP keepalive messages
+             to the other side.  If they are sent, death of the connection or
+             crash of one of the machines will be properly noticed.  However,
+             this means that connections will die if the route is down tem-
+             porarily, and some people find it annoying.  On the other hand,
+             if TCP keepalives are not sent, sessions may hang indefinitely on
+             the server, leaving ``ghost'' users and consuming server re-
+             sources.
+
+             The default is ``yes'' (to send TCP keepalive messages), and the
+             server will notice if the network goes down or the client host
+             crashes.  This avoids infinitely hanging sessions.
+
+             To disable TCP keepalive messages, the value should be set to
+             ``no''.
+
+     UseDNS  Specifies whether sshd should look up the remote host name and
+             check that the resolved host name for the remote IP address maps
+             back to the very same IP address.  The default is ``yes''.
+
+     UseLogin
+             Specifies whether login(1) is used for interactive login ses-
+             sions.  The default is ``no''.  Note that login(1) is never used
+             for remote command execution.  Note also, that if this is en-
+             abled, X11Forwarding will be disabled because login(1) does not
+             know how to handle xauth(1) cookies.  If UsePrivilegeSeparation
+             is specified, it will be disabled after authentication.
+
+     UsePAM  Enables the Pluggable Authentication Module interface.  If set to
+             ``yes'' this will enable PAM authentication using
+             ChallengeResponseAuthentication and PAM account and session mod-
+             ule processing for all authentication types.
+
+             Because PAM challenge-response authentication usually serves an
+             equivalent role to password authentication, you should disable
+             either PasswordAuthentication or ChallengeResponseAuthentication.
+
+             If UsePAM is enabled, you will not be able to run sshd(8) as a
+             non-root user.  The default is ``no''.
+
+     UsePrivilegeSeparation
+             Specifies whether sshd separates privileges by creating an un-
+             privileged child process to deal with incoming network traffic.
+             After successful authentication, another process will be created
+             that has the privilege of the authenticated user.  The goal of
+             privilege separation is to prevent privilege escalation by con-
+             taining any corruption within the unprivileged processes.  The
+             default is ``yes''.
+
+     X11DisplayOffset
+             Specifies the first display number available for sshd's X11 for-
+             warding.  This prevents sshd from interfering with real X11
+             servers.  The default is 10.
+
+     X11Forwarding
+             Specifies whether X11 forwarding is permitted.  The argument must
+             be ``yes'' or ``no''.  The default is ``no''.
+
+             When X11 forwarding is enabled, there may be additional exposure
+             to the server and to client displays if the sshd proxy display is
+             configured to listen on the wildcard address (see X11UseLocalhost
+             below), however this is not the default.  Additionally, the au-
+             thentication spoofing and authentication data verification and
+             substitution occur on the client side.  The security risk of us-
+             ing X11 forwarding is that the client's X11 display server may be
+             exposed to attack when the ssh client requests forwarding (see
+             the warnings for ForwardX11 in ssh_config(5)).  A system adminis-
+             trator may have a stance in which they want to protect clients
+             that may expose themselves to attack by unwittingly requesting
+             X11 forwarding, which can warrant a ``no'' setting.
+
+             Note that disabling X11 forwarding does not prevent users from
+             forwarding X11 traffic, as users can always install their own
+             forwarders.  X11 forwarding is automatically disabled if UseLogin
+             is enabled.
+
+     X11UseLocalhost
+             Specifies whether sshd should bind the X11 forwarding server to
+             the loopback address or to the wildcard address.  By default,
+             sshd binds the forwarding server to the loopback address and sets
+             the hostname part of the DISPLAY environment variable to
+             ``localhost''.  This prevents remote hosts from connecting to the
+             proxy display.  However, some older X11 clients may not function
+             with this configuration.  X11UseLocalhost may be set to ``no'' to
+             specify that the forwarding server should be bound to the wild-
+             card address.  The argument must be ``yes'' or ``no''.  The de-
+             fault is ``yes''.
+
+     XAuthLocation
+             Specifies the full pathname of the xauth(1) program.  The default
+             is /usr/X11R6/bin/xauth.
+
+   Time Formats
+     sshd command-line arguments and configuration file options that specify
+     time may be expressed using a sequence of the form: time[qualifier],
+     where time is a positive integer value and qualifier is one of the fol-
+     lowing:
+
+           <none>  seconds
+           s | S   seconds
+           m | M   minutes
+           h | H   hours
+           d | D   days
+           w | W   weeks
+
+     Each member of the sequence is added together to calculate the total time
+     value.
+
+     Time format examples:
+
+           600     600 seconds (10 minutes)
+           10m     10 minutes
+           1h30m   1 hour 30 minutes (90 minutes)
+
+FILES
+     /etc/ssh/sshd_config
+             Contains configuration data for sshd.  This file should be
+             writable by root only, but it is recommended (though not neces-
+             sary) that it be world-readable.
+
+SEE ALSO
+     sshd(8)
+
+AUTHORS
+     OpenSSH is a derivative of the original and free ssh 1.2.12 release by
+     Tatu Ylonen.  Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, Theo
+     de Raadt and Dug Song removed many bugs, re-added newer features and cre-
+     ated OpenSSH.  Markus Friedl contributed the support for SSH protocol
+     versions 1.5 and 2.0.  Niels Provos and Markus Friedl contributed support
+     for privilege separation.
+
+OpenBSD 3.9                   September 25, 1999                             8