Merge 3.8p1 to the trunk. This builds and runs, but I haven't tested it

extensively yet.

ProtocolKeepAlives is now just a compatibility alias for
ServerAliveInterval.

1 files changed, 140 insertions, 140 deletions

diff --git a/sshd_config.0 b/sshd_config.0
index bc266317f..981e91042 100644
--- a/sshd_config.0
+++ b/sshd_config.0
@@ -1,4 +1,4 @@
-SSHD_CONFIG(5)              BSD File Formats Manual             SSHD_CONFIG(5)
+SSHD_CONFIG(5)            OpenBSD Programmer's Manual           SSHD_CONFIG(5)
 
 NAME
      sshd_config - OpenSSH SSH daemon configuration file
@@ -9,7 +9,7 @@ SYNOPSIS
 DESCRIPTION
      sshd reads configuration data from /etc/ssh/sshd_config (or the file
      specified with -f on the command line).  The file contains keyword-argu-
-     ment pairs, one per line.  Lines starting with M-bM-^@M-^X#M-bM-^@M-^Y and empty lines are
+     ment pairs, one per line.  Lines starting with `#' and empty lines are
      interpreted as comments.
 
      The possible keywords and their meanings are as follows (note that key-
@@ -19,36 +19,36 @@ DESCRIPTION
              This keyword can be followed by a list of group name patterns,
              separated by spaces.  If specified, login is allowed only for
              users whose primary group or supplementary group list matches one
-             of the patterns.  M-bM-^@M-^X*M-bM-^@M-^Y and M-bM-^@M-^X?M-bM-^@M-^Y can be used as wildcards in the
+             of the patterns.  `*' and `?' can be used as wildcards in the
              patterns.  Only group names are valid; a numerical group ID is
              not recognized.  By default, login is allowed for all groups.
 
      AllowTcpForwarding
              Specifies whether TCP forwarding is permitted.  The default is
-             M-bM-^@M-^\yesM-bM-^@M-^].  Note that disabling TCP forwarding does not improve secu-
-             rity unless users are also denied shell access, as they can
-             always install their own forwarders.
+             ``yes''.  Note that disabling TCP forwarding does not improve se-
+             curity unless users are also denied shell access, as they can al-
+             ways install their own forwarders.
 
      AllowUsers
              This keyword can be followed by a list of user name patterns,
-             separated by spaces.  If specified, login is allowed only for
-             user names that match one of the patterns.  M-bM-^@M-^X*M-bM-^@M-^Y and M-bM-^@M-^X?M-bM-^@M-^Y can be
-             used as wildcards in the patterns.  Only user names are valid; a
-             numerical user ID is not recognized.  By default, login is
-             allowed for all users.  If the pattern takes the form USER@HOST
-             then USER and HOST are separately checked, restricting logins to
-             particular users from particular hosts.
+             separated by spaces.  If specified, login is allowed only for us-
+             er names that match one of the patterns.  `*' and `?' can be used
+             as wildcards in the patterns.  Only user names are valid; a nu-
+             merical user ID is not recognized.  By default, login is allowed
+             for all users.  If the pattern takes the form USER@HOST then USER
+             and HOST are separately checked, restricting logins to particular
+             users from particular hosts.
 
      AuthorizedKeysFile
              Specifies the file that contains the public keys that can be used
              for user authentication.  AuthorizedKeysFile may contain tokens
              of the form %T which are substituted during connection set-up.
              The following tokens are defined: %% is replaced by a literal
-             M-bM-^@M-^Y%M-bM-^@M-^Y, %h is replaced by the home directory of the user being
-             authenticated and %u is replaced by the username of that user.
-             After expansion, AuthorizedKeysFile is taken to be an absolute
-             path or one relative to the userM-bM-^@M-^Ys home directory.  The default
-             is M-bM-^@M-^\.ssh/authorized_keysM-bM-^@M-^].
+             '%', %h is replaced by the home directory of the user being au-
+             thenticated and %u is replaced by the username of that user.  Af-
+             ter expansion, AuthorizedKeysFile is taken to be an absolute path
+             or one relative to the user's home directory.  The default is
+             ``.ssh/authorized_keys''.
 
      Banner  In some jurisdictions, sending a warning message before authenti-
              cation may be relevant for getting legal protection.  The con-
@@ -59,14 +59,14 @@ DESCRIPTION
      ChallengeResponseAuthentication
              Specifies whether challenge response authentication is allowed.
              All authentication styles from login.conf(5) are supported.  The
-             default is M-bM-^@M-^\yesM-bM-^@M-^].
+             default is ``yes''.
 
      Ciphers
              Specifies the ciphers allowed for protocol version 2.  Multiple
              ciphers must be comma-separated.  The default is
 
-               M-bM-^@M-^XM-bM-^@M-^Xaes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
-                 aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctrM-bM-^@M-^YM-bM-^@M-^Y
+               ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
+                 aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr''
 
      ClientAliveInterval
              Sets a timeout interval in seconds after which if no data has
@@ -78,15 +78,15 @@ DESCRIPTION
      ClientAliveCountMax
              Sets the number of client alive messages (see above) which may be
              sent without sshd receiving any messages back from the client.
-             If this threshold is reached while client alive messages are
-             being sent, sshd will disconnect the client, terminating the ses-
+             If this threshold is reached while client alive messages are be-
+             ing sent, sshd will disconnect the client, terminating the ses-
              sion.  It is important to note that the use of client alive mes-
-             sages is very different from KeepAlive (below).  The client alive
-             messages are sent through the encrypted channel and therefore
-             will not be spoofable.  The TCP keepalive option enabled by
-             KeepAlive is spoofable.  The client alive mechanism is valuable
-             when the client or server depend on knowing when a connection has
-             become inactive.
+             sages is very different from TCPKeepAlive (below).  The client
+             alive messages are sent through the encrypted channel and there-
+             fore will not be spoofable.  The TCP keepalive option enabled by
+             TCPKeepAlive is spoofable.  The client alive mechanism is valu-
+             able when the client or server depend on knowing when a connec-
+             tion has become inactive.
 
              The default value is 3.  If ClientAliveInterval (above) is set to
              15, and ClientAliveCountMax is left at the default, unresponsive
@@ -94,20 +94,20 @@ DESCRIPTION
 
      Compression
              Specifies whether compression is allowed.  The argument must be
-             M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^].  The default is M-bM-^@M-^\yesM-bM-^@M-^].
+             ``yes'' or ``no''.  The default is ``yes''.
 
      DenyGroups
              This keyword can be followed by a list of group name patterns,
              separated by spaces.  Login is disallowed for users whose primary
              group or supplementary group list matches one of the patterns.
-             M-bM-^@M-^X*M-bM-^@M-^Y and M-bM-^@M-^X?M-bM-^@M-^Y can be used as wildcards in the patterns.  Only group
-             names are valid; a numerical group ID is not recognized.  By
-             default, login is allowed for all groups.
+             `*' and `?' can be used as wildcards in the patterns.  Only group
+             names are valid; a numerical group ID is not recognized.  By de-
+             fault, login is allowed for all groups.
 
      DenyUsers
              This keyword can be followed by a list of user name patterns,
              separated by spaces.  Login is disallowed for user names that
-             match one of the patterns.  M-bM-^@M-^X*M-bM-^@M-^Y and M-bM-^@M-^X?M-bM-^@M-^Y can be used as wildcards
+             match one of the patterns.  `*' and `?' can be used as wildcards
              in the patterns.  Only user names are valid; a numerical user ID
              is not recognized.  By default, login is allowed for all users.
              If the pattern takes the form USER@HOST then USER and HOST are
@@ -121,25 +121,25 @@ DESCRIPTION
              hosts from connecting to forwarded ports.  GatewayPorts can be
              used to specify that sshd should bind remote port forwardings to
              the wildcard address, thus allowing remote hosts to connect to
-             forwarded ports.  The argument must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^].  The
-             default is M-bM-^@M-^\noM-bM-^@M-^].
+             forwarded ports.  The argument must be ``yes'' or ``no''.  The
+             default is ``no''.
 
      GSSAPIAuthentication
              Specifies whether user authentication based on GSSAPI is allowed.
-             The default is M-bM-^@M-^\noM-bM-^@M-^].  Note that this option applies to protocol
+             The default is ``no''.  Note that this option applies to protocol
              version 2 only.
 
      GSSAPICleanupCredentials
-             Specifies whether to automatically destroy the userM-bM-^@M-^Ys credentials
-             cache on logout.  The default is M-bM-^@M-^\yesM-bM-^@M-^].  Note that this option
+             Specifies whether to automatically destroy the user's credentials
+             cache on logout.  The default is ``yes''.  Note that this option
              applies to protocol version 2 only.
 
      HostbasedAuthentication
-             Specifies whether rhosts or /etc/hosts.equiv authentication
-             together with successful public key client host authentication is
+             Specifies whether rhosts or /etc/hosts.equiv authentication to-
+             gether with successful public key client host authentication is
              allowed (hostbased authentication).  This option is similar to
              RhostsRSAAuthentication and applies to protocol version 2 only.
-             The default is M-bM-^@M-^\noM-bM-^@M-^].
+             The default is ``no''.
 
      HostKey
              Specifies a file containing a private host key used by SSH.  The
@@ -147,51 +147,36 @@ DESCRIPTION
              /etc/ssh/ssh_host_rsa_key and /etc/ssh/ssh_host_dsa_key for pro-
              tocol version 2.  Note that sshd will refuse to use a file if it
              is group/world-accessible.  It is possible to have multiple host
-             key files.  M-bM-^@M-^\rsa1M-bM-^@M-^] keys are used for version 1 and M-bM-^@M-^\dsaM-bM-^@M-^] or M-bM-^@M-^\rsaM-bM-^@M-^]
-             are used for version 2 of the SSH protocol.
+             key files.  ``rsa1'' keys are used for version 1 and ``dsa'' or
+             ``rsa'' are used for version 2 of the SSH protocol.
 
      IgnoreRhosts
              Specifies that .rhosts and .shosts files will not be used in
              RhostsRSAAuthentication or HostbasedAuthentication.
 
-             /etc/hosts.equiv and /etc/shosts.equiv are still used.  The
-             default is M-bM-^@M-^\yesM-bM-^@M-^].
+             /etc/hosts.equiv and /etc/shosts.equiv are still used.  The de-
+             fault is ``yes''.
 
      IgnoreUserKnownHosts
-             Specifies whether sshd should ignore the userM-bM-^@M-^Ys
+             Specifies whether sshd should ignore the user's
              $HOME/.ssh/known_hosts during RhostsRSAAuthentication or
-             HostbasedAuthentication.  The default is M-bM-^@M-^\noM-bM-^@M-^].
-
-     KeepAlive
-             Specifies whether the system should send TCP keepalive messages
-             to the other side.  If they are sent, death of the connection or
-             crash of one of the machines will be properly noticed.  However,
-             this means that connections will die if the route is down tem-
-             porarily, and some people find it annoying.  On the other hand,
-             if keepalives are not sent, sessions may hang indefinitely on the
-             server, leaving M-bM-^@M-^\ghostM-bM-^@M-^] users and consuming server resources.
-
-             The default is M-bM-^@M-^\yesM-bM-^@M-^] (to send keepalives), and the server will
-             notice if the network goes down or the client host crashes.  This
-             avoids infinitely hanging sessions.
-
-             To disable keepalives, the value should be set to M-bM-^@M-^\noM-bM-^@M-^].
+             HostbasedAuthentication.  The default is ``no''.
 
      KerberosAuthentication
              Specifies whether the password provided by the user for
              PasswordAuthentication will be validated through the Kerberos
              KDC.  To use this option, the server needs a Kerberos servtab
-             which allows the verification of the KDCM-bM-^@M-^Ys identity.  Default is
-             M-bM-^@M-^\noM-bM-^@M-^].
+             which allows the verification of the KDC's identity.  Default is
+             ``no''.
 
      KerberosOrLocalPasswd
              If set then if password authentication through Kerberos fails
              then the password will be validated via any additional local
-             mechanism such as /etc/passwd.  Default is M-bM-^@M-^\yesM-bM-^@M-^].
+             mechanism such as /etc/passwd.  Default is ``yes''.
 
      KerberosTicketCleanup
-             Specifies whether to automatically destroy the userM-bM-^@M-^Ys ticket
-             cache file on logout.  Default is M-bM-^@M-^\yesM-bM-^@M-^].
+             Specifies whether to automatically destroy the user's ticket
+             cache file on logout.  Default is ``yes''.
 
      KeyRegenerationInterval
              In protocol version 1, the ephemeral server key is automatically
@@ -230,55 +215,55 @@ DESCRIPTION
 
      MACs    Specifies the available MAC (message authentication code) algo-
              rithms.  The MAC algorithm is used in protocol version 2 for data
-             integrity protection.  Multiple algorithms must be comma-sepa-
-             rated.  The default is
-             M-bM-^@M-^\hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96M-bM-^@M-^].
+             integrity protection.  Multiple algorithms must be comma-separat-
+             ed.  The default is ``hmac-md5,hmac-sha1,hmac-ripemd160,hmac-
+             sha1-96,hmac-md5-96''.
 
      MaxStartups
              Specifies the maximum number of concurrent unauthenticated con-
              nections to the sshd daemon.  Additional connections will be
-             dropped until authentication succeeds or the LoginGraceTime
-             expires for a connection.  The default is 10.
+             dropped until authentication succeeds or the LoginGraceTime ex-
+             pires for a connection.  The default is 10.
 
              Alternatively, random early drop can be enabled by specifying the
-             three colon separated values M-bM-^@M-^\start:rate:fullM-bM-^@M-^] (e.g.,
+             three colon separated values ``start:rate:full'' (e.g.,
              "10:30:60").  sshd will refuse connection attempts with a proba-
-             bility of M-bM-^@M-^\rate/100M-bM-^@M-^] (30%) if there are currently M-bM-^@M-^\startM-bM-^@M-^] (10)
-             unauthenticated connections.  The probability increases linearly
-             and all connection attempts are refused if the number of unau-
-             thenticated connections reaches M-bM-^@M-^\fullM-bM-^@M-^] (60).
+             bility of ``rate/100'' (30%) if there are currently ``start''
+             (10) unauthenticated connections.  The probability increases lin-
+             early and all connection attempts are refused if the number of
+             unauthenticated connections reaches ``full'' (60).
 
      PasswordAuthentication
-             Specifies whether password authentication is allowed.  The
-             default is M-bM-^@M-^\yesM-bM-^@M-^].
+             Specifies whether password authentication is allowed.  The de-
+             fault is ``yes''.
 
      PermitEmptyPasswords
              When password authentication is allowed, it specifies whether the
              server allows login to accounts with empty password strings.  The
-             default is M-bM-^@M-^\noM-bM-^@M-^].
+             default is ``no''.
 
      PermitRootLogin
              Specifies whether root can login using ssh(1).  The argument must
-             be M-bM-^@M-^\yesM-bM-^@M-^], M-bM-^@M-^\without-passwordM-bM-^@M-^], M-bM-^@M-^\forced-commands-onlyM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^].
-             The default is M-bM-^@M-^\yesM-bM-^@M-^].
+             be ``yes'', ``without-password'', ``forced-commands-only'' or
+             ``no''.  The default is ``yes''.
 
-             If this option is set to M-bM-^@M-^\without-passwordM-bM-^@M-^] password authentica-
-             tion is disabled for root.
+             If this option is set to ``without-password'' password authenti-
+             cation is disabled for root.
 
-             If this option is set to M-bM-^@M-^\forced-commands-onlyM-bM-^@M-^] root login with
+             If this option is set to ``forced-commands-only'' root login with
              public key authentication will be allowed, but only if the
              command option has been specified (which may be useful for taking
              remote backups even if root login is normally not allowed).  All
              other authentication methods are disabled for root.
 
-             If this option is set to M-bM-^@M-^\noM-bM-^@M-^] root is not allowed to login.
+             If this option is set to ``no'' root is not allowed to login.
 
      PermitUserEnvironment
              Specifies whether ~/.ssh/environment and environment= options in
              ~/.ssh/authorized_keys are processed by sshd.  The default is
-             M-bM-^@M-^\noM-bM-^@M-^].  Enabling environment processing may enable users to bypass
-             access restrictions in some configurations using mechanisms such
-             as LD_PRELOAD.
+             ``no''.  Enabling environment processing may enable users to by-
+             pass access restrictions in some configurations using mechanisms
+             such as LD_PRELOAD.
 
      PidFile
              Specifies the file that contains the process ID of the sshd dae-
@@ -290,38 +275,36 @@ DESCRIPTION
 
      PrintLastLog
              Specifies whether sshd should print the date and time when the
-             user last logged in.  The default is M-bM-^@M-^\yesM-bM-^@M-^].
+             user last logged in.  The default is ``yes''.
 
      PrintMotd
              Specifies whether sshd should print /etc/motd when a user logs in
              interactively.  (On some systems it is also printed by the shell,
-             /etc/profile, or equivalent.)  The default is M-bM-^@M-^\yesM-bM-^@M-^].
+             /etc/profile, or equivalent.)  The default is ``yes''.
 
      Protocol
              Specifies the protocol versions sshd supports.  The possible val-
-             ues are M-bM-^@M-^\1M-bM-^@M-^] and M-bM-^@M-^\2M-bM-^@M-^].  Multiple versions must be comma-separated.
-             The default is M-bM-^@M-^\2,1M-bM-^@M-^].  Note that the order of the protocol list
-             does not indicate preference, because the client selects among
-             multiple protocol versions offered by the server.  Specifying
-             M-bM-^@M-^\2,1M-bM-^@M-^] is identical to M-bM-^@M-^\1,2M-bM-^@M-^].
+             ues are ``1'' and ``2''.  Multiple versions must be comma-sepa-
+             rated.  The default is ``2,1''.  Note that the order of the pro-
+             tocol list does not indicate preference, because the client se-
+             lects among multiple protocol versions offered by the server.
+             Specifying ``2,1'' is identical to ``1,2''.
 
      PubkeyAuthentication
-             Specifies whether public key authentication is allowed.  The
-             default is M-bM-^@M-^\yesM-bM-^@M-^].  Note that this option applies to protocol ver-
-             sion 2 only.  RhostsRSAAuthentication should be used instead,
-             because it performs RSA-based host authentication in addition to
-             normal rhosts or /etc/hosts.equiv authentication.  The default is
-             M-bM-^@M-^\noM-bM-^@M-^].  This option applies to protocol version 1 only.
+             Specifies whether public key authentication is allowed.  The de-
+             fault is ``yes''.  Note that this option applies to protocol ver-
+             sion 2 only.
 
      RhostsRSAAuthentication
-             Specifies whether rhosts or /etc/hosts.equiv authentication
-             together with successful RSA host authentication is allowed.  The
-             default is M-bM-^@M-^\noM-bM-^@M-^].  This option applies to protocol version 1 only.
+             Specifies whether rhosts or /etc/hosts.equiv authentication to-
+             gether with successful RSA host authentication is allowed.  The
+             default is ``no''.  This option applies to protocol version 1 on-
+             ly.
 
      RSAAuthentication
-             Specifies whether pure RSA authentication is allowed.  The
-             default is M-bM-^@M-^\yesM-bM-^@M-^].  This option applies to protocol version 1
-             only.
+             Specifies whether pure RSA authentication is allowed.  The de-
+             fault is ``yes''.  This option applies to protocol version 1 on-
+             ly.
 
      ServerKeyBits
              Defines the number of bits in the ephemeral protocol version 1
@@ -329,72 +312,89 @@ DESCRIPTION
 
      StrictModes
              Specifies whether sshd should check file modes and ownership of
-             the userM-bM-^@M-^Ys files and home directory before accepting login.  This
+             the user's files and home directory before accepting login.  This
              is normally desirable because novices sometimes accidentally
              leave their directory or files world-writable.  The default is
-             M-bM-^@M-^\yesM-bM-^@M-^].
+             ``yes''.
 
      Subsystem
              Configures an external subsystem (e.g., file transfer daemon).
-             Arguments should be a subsystem name and a command to execute
-             upon subsystem request.  The command sftp-server(8) implements
-             the M-bM-^@M-^\sftpM-bM-^@M-^] file transfer subsystem.  By default no subsystems are
-             defined.  Note that this option applies to protocol version 2
-             only.
+             Arguments should be a subsystem name and a command to execute up-
+             on subsystem request.  The command sftp-server(8) implements the
+             ``sftp'' file transfer subsystem.  By default no subsystems are
+             defined.  Note that this option applies to protocol version 2 on-
+             ly.
 
      SyslogFacility
              Gives the facility code that is used when logging messages from
-             sshd.  The possible values are: DAEMON, USER, AUTH, LOCAL0,
-             LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.  The
-             default is AUTH.
+             sshd.  The possible values are: DAEMON, USER, AUTH, LOCAL0, LO-
+             CAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.  The de-
+             fault is AUTH.
+
+     TCPKeepAlive
+             Specifies whether the system should send TCP keepalive messages
+             to the other side.  If they are sent, death of the connection or
+             crash of one of the machines will be properly noticed.  However,
+             this means that connections will die if the route is down tem-
+             porarily, and some people find it annoying.  On the other hand,
+             if TCP keepalives are not sent, sessions may hang indefinitely on
+             the server, leaving ``ghost'' users and consuming server re-
+             sources.
+
+             The default is ``yes'' (to send TCP keepalive messages), and the
+             server will notice if the network goes down or the client host
+             crashes.  This avoids infinitely hanging sessions.
+
+             To disable TCP keepalive messages, the value should be set to
+             ``no''.
 
      UseDNS  Specifies whether sshd should lookup the remote host name and
              check that the resolved host name for the remote IP address maps
-             back to the very same IP address.  The default is M-bM-^@M-^\yesM-bM-^@M-^].
+             back to the very same IP address.  The default is ``yes''.
 
      UseLogin
              Specifies whether login(1) is used for interactive login ses-
-             sions.  The default is M-bM-^@M-^\noM-bM-^@M-^].  Note that login(1) is never used
-             for remote command execution.  Note also, that if this is
-             enabled, X11Forwarding will be disabled because login(1) does not
+             sions.  The default is ``no''.  Note that login(1) is never used
+             for remote command execution.  Note also, that if this is en-
+             abled, X11Forwarding will be disabled because login(1) does not
              know how to handle xauth(1) cookies.  If UsePrivilegeSeparation
              is specified, it will be disabled after authentication.
 
      UsePAM  Enables PAM authentication (via challenge-response) and session
              set up.  If you enable this, you should probably disable
              PasswordAuthentication.  If you enable then you will not be able
-             to run sshd as a non-root user.
+             to run sshd as a non-root user.  The default is ``no''.
 
      UsePrivilegeSeparation
-             Specifies whether sshd separates privileges by creating an
-             unprivileged child process to deal with incoming network traffic.
+             Specifies whether sshd separates privileges by creating an un-
+             privileged child process to deal with incoming network traffic.
              After successful authentication, another process will be created
              that has the privilege of the authenticated user.  The goal of
              privilege separation is to prevent privilege escalation by con-
              taining any corruption within the unprivileged processes.  The
-             default is M-bM-^@M-^\yesM-bM-^@M-^].
+             default is ``yes''.
 
      X11DisplayOffset
-             Specifies the first display number available for sshdM-bM-^@M-^Ys X11 for-
+             Specifies the first display number available for sshd's X11 for-
              warding.  This prevents sshd from interfering with real X11
              servers.  The default is 10.
 
      X11Forwarding
              Specifies whether X11 forwarding is permitted.  The argument must
-             be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^].  The default is M-bM-^@M-^\noM-bM-^@M-^].
+             be ``yes'' or ``no''.  The default is ``no''.
 
              When X11 forwarding is enabled, there may be additional exposure
              to the server and to client displays if the sshd proxy display is
              configured to listen on the wildcard address (see X11UseLocalhost
-             below), however this is not the default.  Additionally, the
-             authentication spoofing and authentication data verification and
-             substitution occur on the client side.  The security risk of
-             using X11 forwarding is that the clientM-bM-^@M-^Ys X11 display server may
-             be exposed to attack when the ssh client requests forwarding (see
+             below), however this is not the default.  Additionally, the au-
+             thentication spoofing and authentication data verification and
+             substitution occur on the client side.  The security risk of us-
+             ing X11 forwarding is that the client's X11 display server may be
+             exposed to attack when the ssh client requests forwarding (see
              the warnings for ForwardX11 in ssh_config(5)).  A system adminis-
              trator may have a stance in which they want to protect clients
              that may expose themselves to attack by unwittingly requesting
-             X11 forwarding, which can warrant a M-bM-^@M-^\noM-bM-^@M-^] setting.
+             X11 forwarding, which can warrant a ``no'' setting.
 
              Note that disabling X11 forwarding does not prevent users from
              forwarding X11 traffic, as users can always install their own
@@ -406,12 +406,12 @@ DESCRIPTION
              the loopback address or to the wildcard address.  By default,
              sshd binds the forwarding server to the loopback address and sets
              the hostname part of the DISPLAY environment variable to
-             M-bM-^@M-^\localhostM-bM-^@M-^].  This prevents remote hosts from connecting to the
+             ``localhost''.  This prevents remote hosts from connecting to the
              proxy display.  However, some older X11 clients may not function
-             with this configuration.  X11UseLocalhost may be set to M-bM-^@M-^\noM-bM-^@M-^] to
+             with this configuration.  X11UseLocalhost may be set to ``no'' to
              specify that the forwarding server should be bound to the wild-
-             card address.  The argument must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^].  The default
-             is M-bM-^@M-^\yesM-bM-^@M-^].
+             card address.  The argument must be ``yes'' or ``no''.  The de-
+             fault is ``yes''.
 
      XAuthLocation
              Specifies the full pathname of the xauth(1) program.  The default
@@ -456,4 +456,4 @@ AUTHORS
      versions 1.5 and 2.0.  Niels Provos and Markus Friedl contributed support
      for privilege separation.
 
-BSD                           September 25, 1999                           BSD
+OpenBSD 3.4                   September 25, 1999                             7