1 files changed, 71 insertions, 32 deletions

diff --git a/ssh.0 b/ssh.0
index 83c4b94eb..c31e17eaf 100644
--- a/ssh.0
+++ b/ssh.0
@@ -9,7 +9,7 @@ SYNOPSIS
          [-i identity_file] [-L [bind_address:]port:host:hostport]
          [-l login_name] [-m mac_spec] [-O ctl_cmd] [-o option] [-p port]
          [-R [bind_address:]port:host:hostport] [-S ctl_path]
-         [-w tunnel:tunnel] [user@]hostname [command]
+         [-w local_tun[:remote_tun]] [user@]hostname [command]
 
 DESCRIPTION
      ssh (SSH client) is a program for logging into a remote machine and for
@@ -225,6 +225,7 @@ DESCRIPTION
                    ControlPath
                    DynamicForward
                    EscapeChar
+                   ExitOnForwardFailure
                    ForwardAgent
                    ForwardX11
                    ForwardX11Trusted
@@ -315,7 +316,7 @@ DESCRIPTION
 
      -t      Force pseudo-tty allocation.  This can be used to execute arbi-
              trary screen-based programs on a remote machine, which can be
-             very useful, e.g., when implementing menu services.  Multiple -t
+             very useful, e.g. when implementing menu services.  Multiple -t
              options force tty allocation, even if ssh has no local tty.
 
      -V      Display the version number and exit.
@@ -325,11 +326,16 @@ DESCRIPTION
              tion, and configuration problems.  Multiple -v options increase
              the verbosity.  The maximum is 3.
 
-     -w tunnel:tunnel
-             Requests a tun(4) device on the client (first tunnel arg) and
-             server (second tunnel arg).  The devices may be specified by nu-
-             merical ID or the keyword ``any'', which uses the next available
-             tunnel device.  See also the Tunnel directive in ssh_config(5).
+     -w local_tun[:remote_tun]
+             Requests tunnel device forwarding with the specified tun(4) de-
+             vices between the client (local_tun) and the server (remote_tun).
+
+             The devices may be specified by numerical ID or the keyword
+             ``any'', which uses the next available tunnel device.  If
+             remote_tun is not specified, it defaults to ``any''.  See also
+             the Tunnel and TunnelDevice directives in ssh_config(5).  If the
+             Tunnel directive is unset, it is set to the default tunnel mode,
+             which is ``point-to-point''.
 
      -X      Enables X11 forwarding.  This can also be specified on a per-host
              basis in a configuration file.
@@ -368,11 +374,11 @@ AUTHENTICATION
      integrity (hmac-md5, hmac-sha1, hmac-ripemd160).  Protocol 1 lacks a
      strong mechanism for ensuring the integrity of the connection.
 
-     The methods available for authentication are: host-based authentication,
-     public key authentication, challenge-response authentication, and pass-
-     word authentication.  Authentication methods are tried in the order spec-
-     ified above, though protocol 2 has a configuration option to change the
-     default order: PreferredAuthentications.
+     The methods available for authentication are: GSSAPI-based authentica-
+     tion, host-based authentication, public key authentication, challenge-re-
+     sponse authentication, and password authentication.  Authentication meth-
+     ods are tried in the order specified above, though protocol 2 has a con-
+     figuration option to change the default order: PreferredAuthentications.
 
      Host-based authentication works as follows: If the machine the user logs
      in from is listed in /etc/hosts.equiv or /etc/shosts.equiv on the remote
@@ -487,8 +493,8 @@ ESCAPE CHARACTERS
      ~C      Open command line.  Currently this allows the addition of port
              forwardings using the -L and -R options (see above).  It also al-
              lows the cancellation of existing remote port-forwardings using
-             -KR hostport.  !command allows the user to execute a local com-
-             mand if the PermitLocalCommand option is enabled in
+             -KR[bind_address:]port.  !command allows the user to execute a
+             local command if the PermitLocalCommand option is enabled in
              ssh_config(5).  Basic help is available, using the -h option.
 
      ~R      Request rekeying of the connection (only useful for SSH protocol
@@ -573,8 +579,7 @@ VERIFYING HOST KEYS
      ``host.example.com''.  The SSHFP resource records should first be added
      to the zonefile for host.example.com:
 
-           $ ssh-keygen -f /etc/ssh/ssh_host_rsa_key.pub -r host.example.com.
-           $ ssh-keygen -f /etc/ssh/ssh_host_dsa_key.pub -r host.example.com.
+           $ ssh-keygen -r host.example.com.
 
      The output lines will have to be added to the zonefile.  To check that
      the zone is answering fingerprint queries:
@@ -598,24 +603,34 @@ SSH-BASED VIRTUAL PRIVATE NETWORKS
      fic).
 
      The following example would connect client network 10.0.50.0/24 with re-
-     mote network 10.0.99.0/24, provided that the SSH server running on the
-     gateway to the remote network, at 192.168.1.15, allows it:
+     mote network 10.0.99.0/24 using a point-to-point connection from 10.1.1.1
+     to 10.1.1.2, provided that the SSH server running on the gateway to the
+     remote network, at 192.168.1.15, allows it.
+
+     On the client:
 
            # ssh -f -w 0:1 192.168.1.15 true
-           # ifconfig tun0 10.0.50.1 10.0.99.1 netmask 255.255.255.252
+           # ifconfig tun0 10.1.1.1 10.1.1.2 netmask 255.255.255.252
+           # route add 10.0.99.0/24 10.1.1.2
+
+     On the server:
+
+           # ifconfig tun1 10.1.1.2 10.1.1.1 netmask 255.255.255.252
+           # route add 10.0.50.0/24 10.1.1.1
 
      Client access may be more finely tuned via the /root/.ssh/authorized_keys
      file (see below) and the PermitRootLogin server option.  The following
-     entry would permit connections on the first tun(4) device from user
-     ``jane'' and on the second device from user ``john'', if PermitRootLogin
-     is set to ``forced-commands-only'':
+     entry would permit connections on tun(4) device 1 from user ``jane'' and
+     on tun device 2 from user ``john'', if PermitRootLogin is set to
+     ``forced-commands-only'':
 
        tunnel="1",command="sh /etc/netstart tun1" ssh-rsa ... jane
-       tunnel="2",command="sh /etc/netstart tun1" ssh-rsa ... john
+       tunnel="2",command="sh /etc/netstart tun2" ssh-rsa ... john
 
-     Since a SSH-based setup entails a fair amount of overhead, it may be more
-     suited to temporary setups, such as for wireless VPNs.  More permanent
-     VPNs are better provided by tools such as ipsecctl(8) and isakmpd(8).
+     Since an SSH-based setup entails a fair amount of overhead, it may be
+     more suited to temporary setups, such as for wireless VPNs.  More perma-
+     nent VPNs are better provided by tools such as ipsecctl(8) and
+     isakmpd(8).
 
 ENVIRONMENT
      ssh will normally set the following environment variables:
@@ -671,8 +686,8 @@ ENVIRONMENT
 
      TZ                    This variable is set to indicate the present time
                            zone if it was set when the daemon was started
-                           (i.e., the daemon passes the value on to new con-
-                           nections).
+                           (i.e. the daemon passes the value on to new connec-
+                           tions).
 
      USER                  Set to the name of the user logging in.
 
@@ -779,9 +794,33 @@ SEE ALSO
      scp(1), sftp(1), ssh-add(1), ssh-agent(1), ssh-keygen(1), ssh-keyscan(1),
      tun(4), hosts.equiv(5), ssh_config(5), ssh-keysign(8), sshd(8)
 
-     T. Ylonen, T. Kivinen, M. Saarinen, T. Rinne, and S. Lehtinen, SSH
-     Protocol Architecture, draft-ietf-secsh-architecture-12.txt, January
-     2002, work in progress material.
+     The Secure Shell (SSH) Protocol Assigned Numbers, RFC 4250, 2006.
+
+     The Secure Shell (SSH) Protocol Architecture, RFC 4251, 2006.
+
+     The Secure Shell (SSH) Authentication Protocol, RFC 4252, 2006.
+
+     The Secure Shell (SSH) Transport Layer Protocol, RFC 4253, 2006.
+
+     The Secure Shell (SSH) Connection Protocol, RFC 4254, 2006.
+
+     Using DNS to Securely Publish Secure Shell (SSH) Key Fingerprints, RFC
+     4255, 2006.
+
+     Generic Message Exchange Authentication for the Secure Shell Protocol
+     (SSH), RFC 4256, 2006.
+
+     The Secure Shell (SSH) Session Channel Break Extension, RFC 4335, 2006.
+
+     The Secure Shell (SSH) Transport Layer Encryption Modes, RFC 4344, 2006.
+
+     Improved Arcfour Modes for the Secure Shell (SSH) Transport Layer
+     Protocol, RFC 4345, 2006.
+
+     Diffie-Hellman Group Exchange for the Secure Shell (SSH) Transport Layer
+     Protocol, RFC 4419, 2006.
+
+     The Secure Shell (SSH) Public Key File Format, RFC 4716, 2006.
 
 AUTHORS
      OpenSSH is a derivative of the original and free ssh 1.2.12 release by
@@ -790,4 +829,4 @@ AUTHORS
      created OpenSSH.  Markus Friedl contributed the support for SSH protocol
      versions 1.5 and 2.0.
 
-OpenBSD 3.9                   September 25, 1999                            12
+OpenBSD 4.1                   September 25, 1999                            13