diff options
Diffstat (limited to 'ssh.1')
-rw-r--r-- | ssh.1 | 129 |
1 files changed, 108 insertions, 21 deletions
@@ -33,8 +33,8 @@ | |||
33 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | 33 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
34 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | 34 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
35 | .\" | 35 | .\" |
36 | .\" $OpenBSD: ssh.1,v 1.358 2015/05/22 05:28:45 djm Exp $ | 36 | .\" $OpenBSD: ssh.1,v 1.361 2015/07/20 18:44:12 millert Exp $ |
37 | .Dd $Mdocdate: May 22 2015 $ | 37 | .Dd $Mdocdate: July 20 2015 $ |
38 | .Dt SSH 1 | 38 | .Dt SSH 1 |
39 | .Os | 39 | .Os |
40 | .Sh NAME | 40 | .Sh NAME |
@@ -52,14 +52,14 @@ | |||
52 | .Op Fl F Ar configfile | 52 | .Op Fl F Ar configfile |
53 | .Op Fl I Ar pkcs11 | 53 | .Op Fl I Ar pkcs11 |
54 | .Op Fl i Ar identity_file | 54 | .Op Fl i Ar identity_file |
55 | .Op Fl L Oo Ar bind_address : Oc Ns Ar port : Ns Ar host : Ns Ar hostport | 55 | .Op Fl L Ar address |
56 | .Op Fl l Ar login_name | 56 | .Op Fl l Ar login_name |
57 | .Op Fl m Ar mac_spec | 57 | .Op Fl m Ar mac_spec |
58 | .Op Fl O Ar ctl_cmd | 58 | .Op Fl O Ar ctl_cmd |
59 | .Op Fl o Ar option | 59 | .Op Fl o Ar option |
60 | .Op Fl p Ar port | 60 | .Op Fl p Ar port |
61 | .Op Fl Q Cm cipher | cipher-auth | mac | kex | key | protocol-version | 61 | .Op Fl Q Cm cipher | cipher-auth | mac | kex | key | protocol-version |
62 | .Op Fl R Oo Ar bind_address : Oc Ns Ar port : Ns Ar host : Ns Ar hostport | 62 | .Op Fl R Ar address |
63 | .Op Fl S Ar ctl_path | 63 | .Op Fl S Ar ctl_path |
64 | .Op Fl W Ar host : Ns Ar port | 64 | .Op Fl W Ar host : Ns Ar port |
65 | .Op Fl w Ar local_tun Ns Op : Ns Ar remote_tun | 65 | .Op Fl w Ar local_tun Ns Op : Ns Ar remote_tun |
@@ -93,23 +93,28 @@ is specified, | |||
93 | it is executed on the remote host instead of a login shell. | 93 | it is executed on the remote host instead of a login shell. |
94 | .Pp | 94 | .Pp |
95 | The options are as follows: | 95 | The options are as follows: |
96 | .Bl -tag -width Ds | 96 | .Pp |
97 | .Bl -tag -width Ds -compact | ||
97 | .It Fl 1 | 98 | .It Fl 1 |
98 | Forces | 99 | Forces |
99 | .Nm | 100 | .Nm |
100 | to try protocol version 1 only. | 101 | to try protocol version 1 only. |
102 | .Pp | ||
101 | .It Fl 2 | 103 | .It Fl 2 |
102 | Forces | 104 | Forces |
103 | .Nm | 105 | .Nm |
104 | to try protocol version 2 only. | 106 | to try protocol version 2 only. |
107 | .Pp | ||
105 | .It Fl 4 | 108 | .It Fl 4 |
106 | Forces | 109 | Forces |
107 | .Nm | 110 | .Nm |
108 | to use IPv4 addresses only. | 111 | to use IPv4 addresses only. |
112 | .Pp | ||
109 | .It Fl 6 | 113 | .It Fl 6 |
110 | Forces | 114 | Forces |
111 | .Nm | 115 | .Nm |
112 | to use IPv6 addresses only. | 116 | to use IPv6 addresses only. |
117 | .Pp | ||
113 | .It Fl A | 118 | .It Fl A |
114 | Enables forwarding of the authentication agent connection. | 119 | Enables forwarding of the authentication agent connection. |
115 | This can also be specified on a per-host basis in a configuration file. | 120 | This can also be specified on a per-host basis in a configuration file. |
@@ -122,14 +127,17 @@ socket) can access the local agent through the forwarded connection. | |||
122 | An attacker cannot obtain key material from the agent, | 127 | An attacker cannot obtain key material from the agent, |
123 | however they can perform operations on the keys that enable them to | 128 | however they can perform operations on the keys that enable them to |
124 | authenticate using the identities loaded into the agent. | 129 | authenticate using the identities loaded into the agent. |
130 | .Pp | ||
125 | .It Fl a | 131 | .It Fl a |
126 | Disables forwarding of the authentication agent connection. | 132 | Disables forwarding of the authentication agent connection. |
133 | .Pp | ||
127 | .It Fl b Ar bind_address | 134 | .It Fl b Ar bind_address |
128 | Use | 135 | Use |
129 | .Ar bind_address | 136 | .Ar bind_address |
130 | on the local machine as the source address | 137 | on the local machine as the source address |
131 | of the connection. | 138 | of the connection. |
132 | Only useful on systems with more than one address. | 139 | Only useful on systems with more than one address. |
140 | .Pp | ||
133 | .It Fl C | 141 | .It Fl C |
134 | Requests compression of all data (including stdin, stdout, stderr, and | 142 | Requests compression of all data (including stdin, stdout, stderr, and |
135 | data for forwarded X11, TCP and | 143 | data for forwarded X11, TCP and |
@@ -148,6 +156,7 @@ The default value can be set on a host-by-host basis in the | |||
148 | configuration files; see the | 156 | configuration files; see the |
149 | .Cm Compression | 157 | .Cm Compression |
150 | option. | 158 | option. |
159 | .Pp | ||
151 | .It Fl c Ar cipher_spec | 160 | .It Fl c Ar cipher_spec |
152 | Selects the cipher specification for encrypting the session. | 161 | Selects the cipher specification for encrypting the session. |
153 | .Pp | 162 | .Pp |
@@ -166,6 +175,7 @@ See the | |||
166 | keyword in | 175 | keyword in |
167 | .Xr ssh_config 5 | 176 | .Xr ssh_config 5 |
168 | for more information. | 177 | for more information. |
178 | .Pp | ||
169 | .It Fl D Xo | 179 | .It Fl D Xo |
170 | .Sm off | 180 | .Sm off |
171 | .Oo Ar bind_address : Oc | 181 | .Oo Ar bind_address : Oc |
@@ -205,10 +215,12 @@ indicates that the listening port be bound for local use only, while an | |||
205 | empty address or | 215 | empty address or |
206 | .Sq * | 216 | .Sq * |
207 | indicates that the port should be available from all interfaces. | 217 | indicates that the port should be available from all interfaces. |
218 | .Pp | ||
208 | .It Fl E Ar log_file | 219 | .It Fl E Ar log_file |
209 | Append debug logs to | 220 | Append debug logs to |
210 | .Ar log_file | 221 | .Ar log_file |
211 | instead of standard error. | 222 | instead of standard error. |
223 | .Pp | ||
212 | .It Fl e Ar escape_char | 224 | .It Fl e Ar escape_char |
213 | Sets the escape character for sessions with a pty (default: | 225 | Sets the escape character for sessions with a pty (default: |
214 | .Ql ~ ) . | 226 | .Ql ~ ) . |
@@ -221,6 +233,7 @@ and followed by itself sends the escape character once. | |||
221 | Setting the character to | 233 | Setting the character to |
222 | .Dq none | 234 | .Dq none |
223 | disables any escapes and makes the session fully transparent. | 235 | disables any escapes and makes the session fully transparent. |
236 | .Pp | ||
224 | .It Fl F Ar configfile | 237 | .It Fl F Ar configfile |
225 | Specifies an alternative per-user configuration file. | 238 | Specifies an alternative per-user configuration file. |
226 | If a configuration file is given on the command line, | 239 | If a configuration file is given on the command line, |
@@ -229,6 +242,7 @@ the system-wide configuration file | |||
229 | will be ignored. | 242 | will be ignored. |
230 | The default for the per-user configuration file is | 243 | The default for the per-user configuration file is |
231 | .Pa ~/.ssh/config . | 244 | .Pa ~/.ssh/config . |
245 | .Pp | ||
232 | .It Fl f | 246 | .It Fl f |
233 | Requests | 247 | Requests |
234 | .Nm | 248 | .Nm |
@@ -251,6 +265,7 @@ then a client started with | |||
251 | .Fl f | 265 | .Fl f |
252 | will wait for all remote port forwards to be successfully established | 266 | will wait for all remote port forwards to be successfully established |
253 | before placing itself in the background. | 267 | before placing itself in the background. |
268 | .Pp | ||
254 | .It Fl G | 269 | .It Fl G |
255 | Causes | 270 | Causes |
256 | .Nm | 271 | .Nm |
@@ -259,15 +274,18 @@ to print its configuration after evaluating | |||
259 | and | 274 | and |
260 | .Cm Match | 275 | .Cm Match |
261 | blocks and exit. | 276 | blocks and exit. |
277 | .Pp | ||
262 | .It Fl g | 278 | .It Fl g |
263 | Allows remote hosts to connect to local forwarded ports. | 279 | Allows remote hosts to connect to local forwarded ports. |
264 | If used on a multiplexed connection, then this option must be specified | 280 | If used on a multiplexed connection, then this option must be specified |
265 | on the master process. | 281 | on the master process. |
282 | .Pp | ||
266 | .It Fl I Ar pkcs11 | 283 | .It Fl I Ar pkcs11 |
267 | Specify the PKCS#11 shared library | 284 | Specify the PKCS#11 shared library |
268 | .Nm | 285 | .Nm |
269 | should use to communicate with a PKCS#11 token providing the user's | 286 | should use to communicate with a PKCS#11 token providing the user's |
270 | private RSA key. | 287 | private RSA key. |
288 | .Pp | ||
271 | .It Fl i Ar identity_file | 289 | .It Fl i Ar identity_file |
272 | Selects a file from which the identity (private key) for | 290 | Selects a file from which the identity (private key) for |
273 | public key authentication is read. | 291 | public key authentication is read. |
@@ -291,33 +309,58 @@ will also try to load certificate information from the filename obtained | |||
291 | by appending | 309 | by appending |
292 | .Pa -cert.pub | 310 | .Pa -cert.pub |
293 | to identity filenames. | 311 | to identity filenames. |
312 | .Pp | ||
294 | .It Fl K | 313 | .It Fl K |
295 | Enables GSSAPI-based authentication and forwarding (delegation) of GSSAPI | 314 | Enables GSSAPI-based authentication and forwarding (delegation) of GSSAPI |
296 | credentials to the server. | 315 | credentials to the server. |
316 | .Pp | ||
297 | .It Fl k | 317 | .It Fl k |
298 | Disables forwarding (delegation) of GSSAPI credentials to the server. | 318 | Disables forwarding (delegation) of GSSAPI credentials to the server. |
319 | .Pp | ||
299 | .It Fl L Xo | 320 | .It Fl L Xo |
300 | .Sm off | 321 | .Sm off |
301 | .Oo Ar bind_address : Oc | 322 | .Oo Ar bind_address : Oc |
302 | .Ar port : host : hostport | 323 | .Ar port : host : hostport |
303 | .Sm on | 324 | .Sm on |
304 | .Xc | 325 | .Xc |
305 | Specifies that the given port on the local (client) host is to be | 326 | .It Fl L Xo |
306 | forwarded to the given host and port on the remote side. | 327 | .Sm off |
307 | This works by allocating a socket to listen to | 328 | .Oo Ar bind_address : Oc |
329 | .Ar port : remote_socket | ||
330 | .Sm on | ||
331 | .Xc | ||
332 | .It Fl L Xo | ||
333 | .Sm off | ||
334 | .Ar local_socket : host : hostport | ||
335 | .Sm on | ||
336 | .Xc | ||
337 | .It Fl L Xo | ||
338 | .Sm off | ||
339 | .Ar local_socket : remote_socket | ||
340 | .Sm on | ||
341 | .Xc | ||
342 | Specifies that connections to the given TCP port or Unix socket on the local | ||
343 | (client) host are to be forwarded to the given host and port, or Unix socket, | ||
344 | on the remote side. | ||
345 | This works by allocating a socket to listen to either a TCP | ||
308 | .Ar port | 346 | .Ar port |
309 | on the local side, optionally bound to the specified | 347 | on the local side, optionally bound to the specified |
310 | .Ar bind_address . | 348 | .Ar bind_address , |
311 | Whenever a connection is made to this port, the | 349 | or to a Unix socket. |
350 | Whenever a connection is made to the local port or socket, the | ||
312 | connection is forwarded over the secure channel, and a connection is | 351 | connection is forwarded over the secure channel, and a connection is |
313 | made to | 352 | made to either |
314 | .Ar host | 353 | .Ar host |
315 | port | 354 | port |
316 | .Ar hostport | 355 | .Ar hostport , |
356 | or the Unix socket | ||
357 | .Ar remote_socket , | ||
317 | from the remote machine. | 358 | from the remote machine. |
359 | .Pp | ||
318 | Port forwardings can also be specified in the configuration file. | 360 | Port forwardings can also be specified in the configuration file. |
319 | IPv6 addresses can be specified by enclosing the address in square brackets. | ||
320 | Only the superuser can forward privileged ports. | 361 | Only the superuser can forward privileged ports. |
362 | IPv6 addresses can be specified by enclosing the address in square brackets. | ||
363 | .Pp | ||
321 | By default, the local port is bound in accordance with the | 364 | By default, the local port is bound in accordance with the |
322 | .Cm GatewayPorts | 365 | .Cm GatewayPorts |
323 | setting. | 366 | setting. |
@@ -332,9 +375,11 @@ indicates that the listening port be bound for local use only, while an | |||
332 | empty address or | 375 | empty address or |
333 | .Sq * | 376 | .Sq * |
334 | indicates that the port should be available from all interfaces. | 377 | indicates that the port should be available from all interfaces. |
378 | .Pp | ||
335 | .It Fl l Ar login_name | 379 | .It Fl l Ar login_name |
336 | Specifies the user to log in as on the remote machine. | 380 | Specifies the user to log in as on the remote machine. |
337 | This also may be specified on a per-host basis in the configuration file. | 381 | This also may be specified on a per-host basis in the configuration file. |
382 | .Pp | ||
338 | .It Fl M | 383 | .It Fl M |
339 | Places the | 384 | Places the |
340 | .Nm | 385 | .Nm |
@@ -353,6 +398,7 @@ Refer to the description of | |||
353 | in | 398 | in |
354 | .Xr ssh_config 5 | 399 | .Xr ssh_config 5 |
355 | for details. | 400 | for details. |
401 | .Pp | ||
356 | .It Fl m Ar mac_spec | 402 | .It Fl m Ar mac_spec |
357 | Additionally, for protocol version 2 a comma-separated list of MAC | 403 | Additionally, for protocol version 2 a comma-separated list of MAC |
358 | (message authentication code) algorithms can | 404 | (message authentication code) algorithms can |
@@ -360,10 +406,12 @@ be specified in order of preference. | |||
360 | See the | 406 | See the |
361 | .Cm MACs | 407 | .Cm MACs |
362 | keyword for more information. | 408 | keyword for more information. |
409 | .Pp | ||
363 | .It Fl N | 410 | .It Fl N |
364 | Do not execute a remote command. | 411 | Do not execute a remote command. |
365 | This is useful for just forwarding ports | 412 | This is useful for just forwarding ports |
366 | (protocol version 2 only). | 413 | (protocol version 2 only). |
414 | .Pp | ||
367 | .It Fl n | 415 | .It Fl n |
368 | Redirects stdin from | 416 | Redirects stdin from |
369 | .Pa /dev/null | 417 | .Pa /dev/null |
@@ -384,6 +432,7 @@ program will be put in the background. | |||
384 | needs to ask for a password or passphrase; see also the | 432 | needs to ask for a password or passphrase; see also the |
385 | .Fl f | 433 | .Fl f |
386 | option.) | 434 | option.) |
435 | .Pp | ||
387 | .It Fl O Ar ctl_cmd | 436 | .It Fl O Ar ctl_cmd |
388 | Control an active connection multiplexing master process. | 437 | Control an active connection multiplexing master process. |
389 | When the | 438 | When the |
@@ -402,6 +451,7 @@ Valid commands are: | |||
402 | (request the master to exit), and | 451 | (request the master to exit), and |
403 | .Dq stop | 452 | .Dq stop |
404 | (request the master to stop accepting further multiplexing requests). | 453 | (request the master to stop accepting further multiplexing requests). |
454 | .Pp | ||
405 | .It Fl o Ar option | 455 | .It Fl o Ar option |
406 | Can be used to give options in the format used in the configuration file. | 456 | Can be used to give options in the format used in the configuration file. |
407 | This is useful for specifying options for which there is no separate | 457 | This is useful for specifying options for which there is no separate |
@@ -470,6 +520,7 @@ For full details of the options listed below, and their possible values, see | |||
470 | .It Protocol | 520 | .It Protocol |
471 | .It ProxyCommand | 521 | .It ProxyCommand |
472 | .It ProxyUseFdpass | 522 | .It ProxyUseFdpass |
523 | .It PubkeyAcceptedKeyTypes | ||
473 | .It PubkeyAuthentication | 524 | .It PubkeyAuthentication |
474 | .It RekeyLimit | 525 | .It RekeyLimit |
475 | .It RemoteForward | 526 | .It RemoteForward |
@@ -493,10 +544,12 @@ For full details of the options listed below, and their possible values, see | |||
493 | .It VisualHostKey | 544 | .It VisualHostKey |
494 | .It XAuthLocation | 545 | .It XAuthLocation |
495 | .El | 546 | .El |
547 | .Pp | ||
496 | .It Fl p Ar port | 548 | .It Fl p Ar port |
497 | Port to connect to on the remote host. | 549 | Port to connect to on the remote host. |
498 | This can be specified on a | 550 | This can be specified on a |
499 | per-host basis in the configuration file. | 551 | per-host basis in the configuration file. |
552 | .Pp | ||
500 | .It Fl Q Cm cipher | cipher-auth | mac | kex | key | protocol-version | 553 | .It Fl Q Cm cipher | cipher-auth | mac | kex | key | protocol-version |
501 | Queries | 554 | Queries |
502 | .Nm | 555 | .Nm |
@@ -514,25 +567,47 @@ The available features are: | |||
514 | (key types) and | 567 | (key types) and |
515 | .Ar protocol-version | 568 | .Ar protocol-version |
516 | (supported SSH protocol versions). | 569 | (supported SSH protocol versions). |
570 | .Pp | ||
517 | .It Fl q | 571 | .It Fl q |
518 | Quiet mode. | 572 | Quiet mode. |
519 | Causes most warning and diagnostic messages to be suppressed. | 573 | Causes most warning and diagnostic messages to be suppressed. |
574 | .Pp | ||
520 | .It Fl R Xo | 575 | .It Fl R Xo |
521 | .Sm off | 576 | .Sm off |
522 | .Oo Ar bind_address : Oc | 577 | .Oo Ar bind_address : Oc |
523 | .Ar port : host : hostport | 578 | .Ar port : host : hostport |
524 | .Sm on | 579 | .Sm on |
525 | .Xc | 580 | .Xc |
526 | Specifies that the given port on the remote (server) host is to be | 581 | .It Fl R Xo |
527 | forwarded to the given host and port on the local side. | 582 | .Sm off |
528 | This works by allocating a socket to listen to | 583 | .Oo Ar bind_address : Oc |
584 | .Ar port : local_socket | ||
585 | .Sm on | ||
586 | .Xc | ||
587 | .It Fl R Xo | ||
588 | .Sm off | ||
589 | .Ar remote_socket : host : hostport | ||
590 | .Sm on | ||
591 | .Xc | ||
592 | .It Fl R Xo | ||
593 | .Sm off | ||
594 | .Ar remote_socket : local_socket | ||
595 | .Sm on | ||
596 | .Xc | ||
597 | Specifies that connections to the given TCP port or Unix socket on the remote | ||
598 | (server) host are to be forwarded to the given host and port, or Unix socket, | ||
599 | on the local side. | ||
600 | This works by allocating a socket to listen to either a TCP | ||
529 | .Ar port | 601 | .Ar port |
530 | on the remote side, and whenever a connection is made to this port, the | 602 | or to a Unix socket on the remote side. |
531 | connection is forwarded over the secure channel, and a connection is | 603 | Whenever a connection is made to this port or Unix socket, the |
532 | made to | 604 | connection is forwarded over the secure channel, and a connection |
605 | is made to either | ||
533 | .Ar host | 606 | .Ar host |
534 | port | 607 | port |
535 | .Ar hostport | 608 | .Ar hostport , |
609 | or | ||
610 | .Ar local_socket , | ||
536 | from the local machine. | 611 | from the local machine. |
537 | .Pp | 612 | .Pp |
538 | Port forwardings can also be specified in the configuration file. | 613 | Port forwardings can also be specified in the configuration file. |
@@ -540,7 +615,7 @@ Privileged ports can be forwarded only when | |||
540 | logging in as root on the remote machine. | 615 | logging in as root on the remote machine. |
541 | IPv6 addresses can be specified by enclosing the address in square brackets. | 616 | IPv6 addresses can be specified by enclosing the address in square brackets. |
542 | .Pp | 617 | .Pp |
543 | By default, the listening socket on the server will be bound to the loopback | 618 | By default, TCP listening sockets on the server will be bound to the loopback |
544 | interface only. | 619 | interface only. |
545 | This may be overridden by specifying a | 620 | This may be overridden by specifying a |
546 | .Ar bind_address . | 621 | .Ar bind_address . |
@@ -565,6 +640,7 @@ to the client at run time. | |||
565 | When used together with | 640 | When used together with |
566 | .Ic -O forward | 641 | .Ic -O forward |
567 | the allocated port will be printed to the standard output. | 642 | the allocated port will be printed to the standard output. |
643 | .Pp | ||
568 | .It Fl S Ar ctl_path | 644 | .It Fl S Ar ctl_path |
569 | Specifies the location of a control socket for connection sharing, | 645 | Specifies the location of a control socket for connection sharing, |
570 | or the string | 646 | or the string |
@@ -577,14 +653,17 @@ and | |||
577 | in | 653 | in |
578 | .Xr ssh_config 5 | 654 | .Xr ssh_config 5 |
579 | for details. | 655 | for details. |
656 | .Pp | ||
580 | .It Fl s | 657 | .It Fl s |
581 | May be used to request invocation of a subsystem on the remote system. | 658 | May be used to request invocation of a subsystem on the remote system. |
582 | Subsystems are a feature of the SSH2 protocol which facilitate the use | 659 | Subsystems are a feature of the SSH2 protocol which facilitate the use |
583 | of SSH as a secure transport for other applications (eg.\& | 660 | of SSH as a secure transport for other applications (eg.\& |
584 | .Xr sftp 1 ) . | 661 | .Xr sftp 1 ) . |
585 | The subsystem is specified as the remote command. | 662 | The subsystem is specified as the remote command. |
663 | .Pp | ||
586 | .It Fl T | 664 | .It Fl T |
587 | Disable pseudo-terminal allocation. | 665 | Disable pseudo-terminal allocation. |
666 | .Pp | ||
588 | .It Fl t | 667 | .It Fl t |
589 | Force pseudo-terminal allocation. | 668 | Force pseudo-terminal allocation. |
590 | This can be used to execute arbitrary | 669 | This can be used to execute arbitrary |
@@ -595,8 +674,10 @@ Multiple | |||
595 | options force tty allocation, even if | 674 | options force tty allocation, even if |
596 | .Nm | 675 | .Nm |
597 | has no local tty. | 676 | has no local tty. |
677 | .Pp | ||
598 | .It Fl V | 678 | .It Fl V |
599 | Display the version number and exit. | 679 | Display the version number and exit. |
680 | .Pp | ||
600 | .It Fl v | 681 | .It Fl v |
601 | Verbose mode. | 682 | Verbose mode. |
602 | Causes | 683 | Causes |
@@ -608,6 +689,7 @@ Multiple | |||
608 | .Fl v | 689 | .Fl v |
609 | options increase the verbosity. | 690 | options increase the verbosity. |
610 | The maximum is 3. | 691 | The maximum is 3. |
692 | .Pp | ||
611 | .It Fl W Ar host : Ns Ar port | 693 | .It Fl W Ar host : Ns Ar port |
612 | Requests that standard input and output on the client be forwarded to | 694 | Requests that standard input and output on the client be forwarded to |
613 | .Ar host | 695 | .Ar host |
@@ -621,6 +703,7 @@ Implies | |||
621 | and | 703 | and |
622 | .Cm ClearAllForwardings . | 704 | .Cm ClearAllForwardings . |
623 | Works with Protocol version 2 only. | 705 | Works with Protocol version 2 only. |
706 | .Pp | ||
624 | .It Fl w Xo | 707 | .It Fl w Xo |
625 | .Ar local_tun Ns Op : Ns Ar remote_tun | 708 | .Ar local_tun Ns Op : Ns Ar remote_tun |
626 | .Xc | 709 | .Xc |
@@ -650,6 +733,7 @@ If the | |||
650 | .Cm Tunnel | 733 | .Cm Tunnel |
651 | directive is unset, it is set to the default tunnel mode, which is | 734 | directive is unset, it is set to the default tunnel mode, which is |
652 | .Dq point-to-point . | 735 | .Dq point-to-point . |
736 | .Pp | ||
653 | .It Fl X | 737 | .It Fl X |
654 | Enables X11 forwarding. | 738 | Enables X11 forwarding. |
655 | This can also be specified on a per-host basis in a configuration file. | 739 | This can also be specified on a per-host basis in a configuration file. |
@@ -680,8 +764,10 @@ option to | |||
680 | .Dq no | 764 | .Dq no |
681 | to restore the upstream behaviour. | 765 | to restore the upstream behaviour. |
682 | This may change in future depending on client-side improvements.) | 766 | This may change in future depending on client-side improvements.) |
767 | .Pp | ||
683 | .It Fl x | 768 | .It Fl x |
684 | Disables X11 forwarding. | 769 | Disables X11 forwarding. |
770 | .Pp | ||
685 | .It Fl Y | 771 | .It Fl Y |
686 | Enables trusted X11 forwarding. | 772 | Enables trusted X11 forwarding. |
687 | Trusted X11 forwardings are not subjected to the X11 SECURITY extension | 773 | Trusted X11 forwardings are not subjected to the X11 SECURITY extension |
@@ -697,6 +783,7 @@ option to | |||
697 | .Dq no | 783 | .Dq no |
698 | to restore the upstream behaviour. | 784 | to restore the upstream behaviour. |
699 | This may change in future depending on client-side improvements.) | 785 | This may change in future depending on client-side improvements.) |
786 | .Pp | ||
700 | .It Fl y | 787 | .It Fl y |
701 | Send log information using the | 788 | Send log information using the |
702 | .Xr syslog 3 | 789 | .Xr syslog 3 |