1 files changed, 13 insertions, 4 deletions

diff --git a/ssh-keysign.0 b/ssh-keysign.0
index d6a59c068..b5ad6627a 100644
--- a/ssh-keysign.0
+++ b/ssh-keysign.0
@@ -9,11 +9,20 @@ SYNOPSIS
 DESCRIPTION
      ssh-keysign is used by ssh(1) to access the local host keys and generate
      the digital signature required during hostbased authentication with SSH
-     protocol version 2.  ssh-keysign is not intended to be invoked by the
-     user, but from ssh(1).  See ssh(1) and sshd(8) for more information about
-     hostbased authentication.
+     protocol version 2.
+
+     ssh-keysign is disabled by default and can only be enabled in the the
+     global client configuration file /etc/ssh/ssh_config by setting
+     HostbasedAuthentication to ``yes''.
+
+     ssh-keysign is not intended to be invoked by the user, but from ssh(1).
+     See ssh(1) and sshd(8) for more information about hostbased authenticaM--
+     tion.
 
 FILES
+     /etc/ssh/ssh_config
+             Controls whether ssh-keysign is enabled.
+
      /etc/ssh/ssh_host_dsa_key, /etc/ssh/ssh_host_rsa_key
              These files contain the private parts of the host keys used to
              generate the digital signature.  They should be owned by root,
@@ -22,7 +31,7 @@ FILES
              hostbased authentication is used.
 
 SEE ALSO
-     ssh(1), ssh-keygen(1), sshd(8)
+     ssh(1), ssh-keygen(1), ssh_config(5), sshd(8)
 
 AUTHORS
      Markus Friedl <markus@openbsd.org>