summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--readconf.c14
-rw-r--r--ssh_config.521
-rw-r--r--sshd_config.53
3 files changed, 34 insertions, 4 deletions
diff --git a/readconf.c b/readconf.c
index 22e5a3a61..2dcbf3187 100644
--- a/readconf.c
+++ b/readconf.c
@@ -141,6 +141,7 @@ typedef enum {
141 oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand, 141 oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand,
142 oVisualHostKey, oUseRoaming, oZeroKnowledgePasswordAuthentication, 142 oVisualHostKey, oUseRoaming, oZeroKnowledgePasswordAuthentication,
143 oKexAlgorithms, oIPQoS, oRequestTTY, oIgnoreUnknown, 143 oKexAlgorithms, oIPQoS, oRequestTTY, oIgnoreUnknown,
144 oProtocolKeepAlives, oSetupTimeOut,
144 oIgnoredUnknownOption, oDeprecated, oUnsupported 145 oIgnoredUnknownOption, oDeprecated, oUnsupported
145} OpCodes; 146} OpCodes;
146 147
@@ -263,6 +264,8 @@ static struct {
263 { "ipqos", oIPQoS }, 264 { "ipqos", oIPQoS },
264 { "requesttty", oRequestTTY }, 265 { "requesttty", oRequestTTY },
265 { "ignoreunknown", oIgnoreUnknown }, 266 { "ignoreunknown", oIgnoreUnknown },
267 { "protocolkeepalives", oProtocolKeepAlives },
268 { "setuptimeout", oSetupTimeOut },
266 269
267 { NULL, oBadOption } 270 { NULL, oBadOption }
268}; 271};
@@ -939,6 +942,8 @@ parse_int:
939 goto parse_flag; 942 goto parse_flag;
940 943
941 case oServerAliveInterval: 944 case oServerAliveInterval:
945 case oProtocolKeepAlives: /* Debian-specific compatibility alias */
946 case oSetupTimeOut: /* Debian-specific compatibility alias */
942 intptr = &options->server_alive_interval; 947 intptr = &options->server_alive_interval;
943 goto parse_time; 948 goto parse_time;
944 949
@@ -1404,8 +1409,13 @@ fill_default_options(Options * options)
1404 options->rekey_interval = 0; 1409 options->rekey_interval = 0;
1405 if (options->verify_host_key_dns == -1) 1410 if (options->verify_host_key_dns == -1)
1406 options->verify_host_key_dns = 0; 1411 options->verify_host_key_dns = 0;
1407 if (options->server_alive_interval == -1) 1412 if (options->server_alive_interval == -1) {
1408 options->server_alive_interval = 0; 1413 /* in batch mode, default is 5mins */
1414 if (options->batch_mode == 1)
1415 options->server_alive_interval = 300;
1416 else
1417 options->server_alive_interval = 0;
1418 }
1409 if (options->server_alive_count_max == -1) 1419 if (options->server_alive_count_max == -1)
1410 options->server_alive_count_max = 3; 1420 options->server_alive_count_max = 3;
1411 if (options->control_master == -1) 1421 if (options->control_master == -1)
diff --git a/ssh_config.5 b/ssh_config.5
index 89b25cdd5..135d83376 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -136,8 +136,12 @@ Valid arguments are
136If set to 136If set to
137.Dq yes , 137.Dq yes ,
138passphrase/password querying will be disabled. 138passphrase/password querying will be disabled.
139In addition, the
140.Cm ServerAliveInterval
141option will be set to 300 seconds by default.
139This option is useful in scripts and other batch jobs where no user 142This option is useful in scripts and other batch jobs where no user
140is present to supply the password. 143is present to supply the password,
144and where it is desirable to detect a broken network swiftly.
141The argument must be 145The argument must be
142.Dq yes 146.Dq yes
143or 147or
@@ -1141,8 +1145,15 @@ from the server,
1141will send a message through the encrypted 1145will send a message through the encrypted
1142channel to request a response from the server. 1146channel to request a response from the server.
1143The default 1147The default
1144is 0, indicating that these messages will not be sent to the server. 1148is 0, indicating that these messages will not be sent to the server,
1149or 300 if the
1150.Cm BatchMode
1151option is set.
1145This option applies to protocol version 2 only. 1152This option applies to protocol version 2 only.
1153.Cm ProtocolKeepAlives
1154and
1155.Cm SetupTimeOut
1156are Debian-specific compatibility aliases for this option.
1146.It Cm StrictHostKeyChecking 1157.It Cm StrictHostKeyChecking
1147If this flag is set to 1158If this flag is set to
1148.Dq yes , 1159.Dq yes ,
@@ -1181,6 +1192,12 @@ Specifies whether the system should send TCP keepalive messages to the
1181other side. 1192other side.
1182If they are sent, death of the connection or crash of one 1193If they are sent, death of the connection or crash of one
1183of the machines will be properly noticed. 1194of the machines will be properly noticed.
1195This option only uses TCP keepalives (as opposed to using ssh level
1196keepalives), so takes a long time to notice when the connection dies.
1197As such, you probably want
1198the
1199.Cm ServerAliveInterval
1200option as well.
1184However, this means that 1201However, this means that
1185connections will die if the route is down temporarily, and some people 1202connections will die if the route is down temporarily, and some people
1186find it annoying. 1203find it annoying.
diff --git a/sshd_config.5 b/sshd_config.5
index 18ec81fe8..510cc7cb2 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -1161,6 +1161,9 @@ This avoids infinitely hanging sessions.
1161.Pp 1161.Pp
1162To disable TCP keepalive messages, the value should be set to 1162To disable TCP keepalive messages, the value should be set to
1163.Dq no . 1163.Dq no .
1164.Pp
1165This option was formerly called
1166.Cm KeepAlive .
1164.It Cm TrustedUserCAKeys 1167.It Cm TrustedUserCAKeys
1165Specifies a file containing public keys of certificate authorities that are 1168Specifies a file containing public keys of certificate authorities that are
1166trusted to sign user certificates for authentication. 1169trusted to sign user certificates for authentication.