summaryrefslogtreecommitdiff
path: root/ssh_config.0
diff options
context:
space:
mode:
Diffstat (limited to 'ssh_config.0')
-rw-r--r--ssh_config.0403
1 files changed, 200 insertions, 203 deletions
diff --git a/ssh_config.0 b/ssh_config.0
index a5a44da14..559705343 100644
--- a/ssh_config.0
+++ b/ssh_config.0
@@ -1,403 +1,400 @@
1SSH_CONFIG(5) System File Formats Manual SSH_CONFIG(5) 1SSH_CONFIG(5) BSD File Formats Manual SSH_CONFIG(5)
2 2
3NAME 3^[[1mNAME^[[0m
4 ssh_config - OpenSSH SSH client configuration files 4 ^[[1mssh_config ^[[22mM-bMM-^R OpenSSH SSH client configuration files
5 5
6SYNOPSIS 6^[[1mSYNOPSIS^[[0m
7 $HOME/.ssh/config 7 ^[[4m$HOME/.ssh/config^[[0m
8 /etc/ssh/ssh_config 8 ^[[4m/etc/ssh/ssh_config^[[0m
9 9
10DESCRIPTION 10^[[1mDESCRIPTION^[[0m
11 ssh obtains configuration data from the following sources in the followM-- 11 ^[[1mssh ^[[22mobtains configuration data from the following sources in the followM-bM-^@M-^P
12 ing order: 12 ing order:
13 1. command-line options 13 1. commandM-bM-^@M-^Pline options
14 2. user's configuration file ($HOME/.ssh/config) 14 2. userM-bM-^@M-^Ys configuration file (^[[4m$HOME/.ssh/config^[[24m)
15 3. system-wide configuration file (/etc/ssh/ssh_config) 15 3. systemM-bM-^@M-^Pwide configuration file (^[[4m/etc/ssh/ssh_config^[[24m)
16 16
17 For each parameter, the first obtained value will be used. The configuM-- 17 For each parameter, the first obtained value will be used. The configuM-bM-^@M-^P
18 ration files contain sections bracketed by ``Host'' specifications, and 18 ration files contain sections bracketed by M-bM-^@M-^\HostM-bM-^@M-^] specifications, and
19 that section is only applied for hosts that match one of the patterns 19 that section is only applied for hosts that match one of the patterns
20 given in the specification. The matched host name is the one given on 20 given in the specification. The matched host name is the one given on
21 the command line. 21 the command line.
22 22
23 Since the first obtained value for each parameter is used, more host-speM-- 23 Since the first obtained value for each parameter is used, more hostM-bM-^@M-^PspeM-bM-^@M-^P
24 cific declarations should be given near the beginning of the file, and 24 cific declarations should be given near the beginning of the file, and
25 general defaults at the end. 25 general defaults at the end.
26 26
27 The configuration file has the following format: 27 The configuration file has the following format:
28 28
29 Empty lines and lines starting with `#' are comments. 29 Empty lines and lines starting with M-bM-^@M-^X#M-bM-^@M-^Y are comments.
30 30
31 Otherwise a line is of the format ``keyword arguments''. Configuration 31 Otherwise a line is of the format M-bM-^@M-^\keyword argumentsM-bM-^@M-^]. Configuration
32 options may be separated by whitespace or optional whitespace and exactly 32 options may be separated by whitespace or optional whitespace and exactly
33 one `='; the latter format is useful to avoid the need to quote whitesM-- 33 one M-bM-^@M-^X=M-bM-^@M-^Y; the latter format is useful to avoid the need to quote whitesM-bM-^@M-^P
34 pace when specifying configuration options using the ssh, scp and sftp -o 34 pace when specifying configuration options using the ^[[1mssh^[[22m, ^[[1mscp ^[[22mand ^[[1msftp M-bMM-^Ro^[[0m
35 option. 35 option.
36 36
37 The possible keywords and their meanings are as follows (note that keyM-- 37 The possible keywords and their meanings are as follows (note that keyM-bM-^@M-^P
38 words are case-insensitive and arguments are case-sensitive): 38 words are caseM-bM-^@M-^Pinsensitive and arguments are caseM-bM-^@M-^Psensitive):
39 39
40 Host Restricts the following declarations (up to the next Host keyM-- 40 ^[[1mHost ^[[22mRestricts the following declarations (up to the next ^[[1mHost ^[[22mkeyM-bM-^@M-^P
41 word) to be only for those hosts that match one of the patterns 41 word) to be only for those hosts that match one of the patterns
42 given after the keyword. `*' and `'? can be used as wildcards 42 given after the keyword. M-bM-^@M-^X*M-bM-^@M-^Y and M-bM-^@M-^XM-bM-^@M-^Y? can be used as wildcards
43 in the patterns. A single `*' as a pattern can be used to proM-- 43 in the patterns. A single M-bM-^@M-^X*M-bM-^@M-^Y as a pattern can be used to proM-bM-^@M-^P
44 vide global defaults for all hosts. The host is the hostname 44 vide global defaults for all hosts. The host is the ^[[4mhostname^[[0m
45 argument given on the command line (i.e., the name is not conM-- 45 argument given on the command line (i.e., the name is not conM-bM-^@M-^P
46 verted to a canonicalized host name before matching). 46 verted to a canonicalized host name before matching).
47 47
48 AFSTokenPassing 48 ^[[1mAFSTokenPassing^[[0m
49 Specifies whether to pass AFS tokens to remote host. The arguM-- 49 Specifies whether to pass AFS tokens to remote host. The arguM-bM-^@M-^P
50 ment to this keyword must be ``yes'' or ``no''. This option 50 ment to this keyword must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. This option applies
51 applies to protocol version 1 only. 51 to protocol version 1 only.
52 52
53 BatchMode 53 ^[[1mBatchMode^[[0m
54 If set to ``yes'', passphrase/password querying will be disabled. 54 If set to M-bM-^@M-^\yesM-bM-^@M-^], passphrase/password querying will be disabled.
55 This option is useful in scripts and other batch jobs where no 55 This option is useful in scripts and other batch jobs where no
56 user is present to supply the password. The argument must be 56 user is present to supply the password. The argument must be
57 ``yes'' or ``no''. The default is ``no''. 57 M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The default is M-bM-^@M-^\noM-bM-^@M-^].
58 58
59 BindAddress 59 ^[[1mBindAddress^[[0m
60 Specify the interface to transmit from on machines with multiple 60 Specify the interface to transmit from on machines with multiple
61 interfaces or aliased addresses. Note that this option does not 61 interfaces or aliased addresses. Note that this option does not
62 work if UsePrivilegedPort is set to ``yes''. 62 work if ^[[1mUsePrivilegedPort ^[[22mis set to M-bM-^@M-^\yesM-bM-^@M-^].
63 63
64 ChallengeResponseAuthentication 64 ^[[1mChallengeResponseAuthentication^[[0m
65 Specifies whether to use challenge response authentication. The 65 Specifies whether to use challenge response authentication. The
66 argument to this keyword must be ``yes'' or ``no''. The default 66 argument to this keyword must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The default is
67 is ``yes''. 67 M-bM-^@M-^\yesM-bM-^@M-^].
68 68
69 CheckHostIP 69 ^[[1mCheckHostIP^[[0m
70 If this flag is set to ``yes'', ssh will additionally check the 70 If this flag is set to M-bM-^@M-^\yesM-bM-^@M-^], ssh will additionally check the
71 host IP address in the known_hosts file. This allows ssh to 71 host IP address in the ^[[4mknown_hosts^[[24m file. This allows ssh to
72 detect if a host key changed due to DNS spoofing. If the option 72 detect if a host key changed due to DNS spoofing. If the option
73 is set to ``no'', the check will not be executed. The default is 73 is set to M-bM-^@M-^\noM-bM-^@M-^], the check will not be executed. The default is
74 ``yes''. 74 M-bM-^@M-^\yesM-bM-^@M-^].
75 75
76 Cipher Specifies the cipher to use for encrypting the session in protoM-- 76 ^[[1mCipher ^[[22mSpecifies the cipher to use for encrypting the session in protoM-bM-^@M-^P
77 col version 1. Currently, ``blowfish'', ``3des'', and ``des'' 77 col version 1. Currently, M-bM-^@M-^\blowfishM-bM-^@M-^], M-bM-^@M-^\3desM-bM-^@M-^], and M-bM-^@M-^\desM-bM-^@M-^] are supM-bM-^@M-^P
78 are supported. des is only supported in the ssh client for 78 ported. ^[[4mdes^[[24m is only supported in the ^[[1mssh ^[[22mclient for interoperM-bM-^@M-^P
79 interoperability with legacy protocol 1 implementations that do 79 ability with legacy protocol 1 implementations that do not supM-bM-^@M-^P
80 not support the 3des cipher. Its use is strongly discouraged due 80 port the ^[[4m3des^[[24m cipher. Its use is strongly discouraged due to
81 to cryptographic weaknesses. The default is ``3des''. 81 cryptographic weaknesses. The default is M-bM-^@M-^\3desM-bM-^@M-^].
82 82
83 Ciphers 83 ^[[1mCiphers^[[0m
84 Specifies the ciphers allowed for protocol version 2 in order of 84 Specifies the ciphers allowed for protocol version 2 in order of
85 preference. Multiple ciphers must be comma-separated. The 85 preference. Multiple ciphers must be commaM-bM-^@M-^Pseparated. The
86 default is 86 default is
87 87
88 ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour, 88 M-bM-^@M-^XM-bM-^@M-^Xaes128M-bM-^@M-^Pcbc,3desM-bM-^@M-^Pcbc,blowfishM-bM-^@M-^Pcbc,cast128M-bM-^@M-^Pcbc,arcfour,
89 aes192-cbc,aes256-cbc'' 89 aes192M-bM-^@M-^Pcbc,aes256M-bM-^@M-^PcbcM-bM-^@M-^YM-bM-^@M-^Y
90 90
91 ClearAllForwardings 91 ^[[1mClearAllForwardings^[[0m
92 Specifies that all local, remote and dynamic port forwardings 92 Specifies that all local, remote and dynamic port forwardings
93 specified in the configuration files or on the command line be 93 specified in the configuration files or on the command line be
94 cleared. This option is primarily useful when used from the ssh 94 cleared. This option is primarily useful when used from the ^[[1mssh^[[0m
95 command line to clear port forwardings set in configuration 95 command line to clear port forwardings set in configuration
96 files, and is automatically set by scp(1) and sftp(1). The arguM-- 96 files, and is automatically set by scp(1) and sftp(1). The arguM-bM-^@M-^P
97 ment must be ``yes'' or ``no''. The default is ``no''. 97 ment must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The default is M-bM-^@M-^\noM-bM-^@M-^].
98 98
99 Compression 99 ^[[1mCompression^[[0m
100 Specifies whether to use compression. The argument must be 100 Specifies whether to use compression. The argument must be M-bM-^@M-^\yesM-bM-^@M-^]
101 ``yes'' or ``no''. The default is ``no''. 101 or M-bM-^@M-^\noM-bM-^@M-^]. The default is M-bM-^@M-^\noM-bM-^@M-^].
102 102
103 CompressionLevel 103 ^[[1mCompressionLevel^[[0m
104 Specifies the compression level to use if compression is enabled. 104 Specifies the compression level to use if compression is enabled.
105 The argument must be an integer from 1 (fast) to 9 (slow, best). 105 The argument must be an integer from 1 (fast) to 9 (slow, best).
106 The default level is 6, which is good for most applications. The 106 The default level is 6, which is good for most applications. The
107 meaning of the values is the same as in gzip(1). Note that this 107 meaning of the values is the same as in gzip(1). Note that this
108 option applies to protocol version 1 only. 108 option applies to protocol version 1 only.
109 109
110 ConnectionAttempts 110 ^[[1mConnectionAttempts^[[0m
111 Specifies the number of tries (one per second) to make before 111 Specifies the number of tries (one per second) to make before
112 exiting. The argument must be an integer. This may be useful in 112 exiting. The argument must be an integer. This may be useful in
113 scripts if the connection sometimes fails. The default is 1. 113 scripts if the connection sometimes fails. The default is 1.
114 114
115 DynamicForward 115 ^[[1mDynamicForward^[[0m
116 Specifies that a TCP/IP port on the local machine be forwarded 116 Specifies that a TCP/IP port on the local machine be forwarded
117 over the secure channel, and the application protocol is then 117 over the secure channel, and the application protocol is then
118 used to determine where to connect to from the remote machine. 118 used to determine where to connect to from the remote machine.
119 The argument must be a port number. Currently the SOCKS4 protoM-- 119 The argument must be a port number. Currently the SOCKS4 protoM-bM-^@M-^P
120 col is supported, and ssh will act as a SOCKS4 server. Multiple 120 col is supported, and ^[[1mssh ^[[22mwill act as a SOCKS4 server. Multiple
121 forwardings may be specified, and additional forwardings can be 121 forwardings may be specified, and additional forwardings can be
122 given on the command line. Only the superuser can forward priviM-- 122 given on the command line. Only the superuser can forward priviM-bM-^@M-^P
123 leged ports. 123 leged ports.
124 124
125 EscapeChar 125 ^[[1mEscapeChar^[[0m
126 Sets the escape character (default: `~'). The escape character 126 Sets the escape character (default: M-bM-^@M-^X~M-bM-^@M-^Y). The escape character
127 can also be set on the command line. The argument should be a 127 can also be set on the command line. The argument should be a
128 single character, `^' followed by a letter, or ``none'' to disM-- 128 single character, M-bM-^@M-^X^M-bM-^@M-^Y followed by a letter, or M-bM-^@M-^\noneM-bM-^@M-^] to disable
129 able the escape character entirely (making the connection transM-- 129 the escape character entirely (making the connection transparent
130 parent for binary data). 130 for binary data).
131 131
132 ForwardAgent 132 ^[[1mForwardAgent^[[0m
133 Specifies whether the connection to the authentication agent (if 133 Specifies whether the connection to the authentication agent (if
134 any) will be forwarded to the remote machine. The argument must 134 any) will be forwarded to the remote machine. The argument must
135 be ``yes'' or ``no''. The default is ``no''. 135 be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The default is M-bM-^@M-^\noM-bM-^@M-^].
136 136
137 Agent forwarding should be enabled with caution. Users with the 137 Agent forwarding should be enabled with caution. Users with the
138 ability to bypass file permissions on the remote host (for the 138 ability to bypass file permissions on the remote host (for the
139 agent's Unix-domain socket) can access the local agent through 139 agentM-bM-^@M-^Ys UnixM-bM-^@M-^Pdomain socket) can access the local agent through
140 the forwarded connection. An attacker cannot obtain key material 140 the forwarded connection. An attacker cannot obtain key material
141 from the agent, however they can perform operations on the keys 141 from the agent, however they can perform operations on the keys
142 that enable them to authenticate using the identities loaded into 142 that enable them to authenticate using the identities loaded into
143 the agent. 143 the agent.
144 144
145 ForwardX11 145 ^[[1mForwardX11^[[0m
146 Specifies whether X11 connections will be automatically rediM-- 146 Specifies whether X11 connections will be automatically rediM-bM-^@M-^P
147 rected over the secure channel and DISPLAY set. The argument 147 rected over the secure channel and DISPLAY set. The argument
148 must be ``yes'' or ``no''. The default is ``no''. 148 must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The default is M-bM-^@M-^\noM-bM-^@M-^].
149 149
150 X11 forwarding should be enabled with caution. Users with the 150 X11 forwarding should be enabled with caution. Users with the
151 ability to bypass file permissions on the remote host (for the 151 ability to bypass file permissions on the remote host (for the
152 user's X authorization database) can access the local X11 display 152 userM-bM-^@M-^Ys X authorization database) can access the local X11 display
153 through the forwarded connection. An attacker may then be able 153 through the forwarded connection. An attacker may then be able
154 to perform activities such as keystroke monitoring. 154 to perform activities such as keystroke monitoring.
155 155
156 GatewayPorts 156 ^[[1mGatewayPorts^[[0m
157 Specifies whether remote hosts are allowed to connect to local 157 Specifies whether remote hosts are allowed to connect to local
158 forwarded ports. By default, ssh binds local port forwardings to 158 forwarded ports. By default, ^[[1mssh ^[[22mbinds local port forwardings to
159 the loopback address. This prevents other remote hosts from conM-- 159 the loopback address. This prevents other remote hosts from conM-bM-^@M-^P
160 necting to forwarded ports. GatewayPorts can be used to specify 160 necting to forwarded ports. ^[[1mGatewayPorts ^[[22mcan be used to specify
161 that ssh should bind local port forwardings to the wildcard 161 that ^[[1mssh ^[[22mshould bind local port forwardings to the wildcard
162 address, thus allowing remote hosts to connect to forwarded 162 address, thus allowing remote hosts to connect to forwarded
163 ports. The argument must be ``yes'' or ``no''. The default is 163 ports. The argument must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The default is M-bM-^@M-^\noM-bM-^@M-^].
164 ``no''.
165 164
166 GlobalKnownHostsFile 165 ^[[1mGlobalKnownHostsFile^[[0m
167 Specifies a file to use for the global host key database instead 166 Specifies a file to use for the global host key database instead
168 of /etc/ssh/ssh_known_hosts. 167 of ^[[4m/etc/ssh/ssh_known_hosts^[[24m.
169 168
170 HostbasedAuthentication 169 ^[[1mHostbasedAuthentication^[[0m
171 Specifies whether to try rhosts based authentication with public 170 Specifies whether to try rhosts based authentication with public
172 key authentication. The argument must be ``yes'' or ``no''. The 171 key authentication. The argument must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The
173 default is ``no''. This option applies to protocol version 2 172 default is M-bM-^@M-^\noM-bM-^@M-^]. This option applies to protocol version 2 only
174 only and is similar to RhostsRSAAuthentication. 173 and is similar to ^[[1mRhostsRSAAuthentication^[[22m.
175 174
176 HostKeyAlgorithms 175 ^[[1mHostKeyAlgorithms^[[0m
177 Specifies the protocol version 2 host key algorithms that the 176 Specifies the protocol version 2 host key algorithms that the
178 client wants to use in order of preference. The default for this 177 client wants to use in order of preference. The default for this
179 option is: ``ssh-rsa,ssh-dss''. 178 option is: M-bM-^@M-^\sshM-bM-^@M-^Prsa,sshM-bM-^@M-^PdssM-bM-^@M-^].
180 179
181 HostKeyAlias 180 ^[[1mHostKeyAlias^[[0m
182 Specifies an alias that should be used instead of the real host 181 Specifies an alias that should be used instead of the real host
183 name when looking up or saving the host key in the host key 182 name when looking up or saving the host key in the host key
184 database files. This option is useful for tunneling ssh connecM-- 183 database files. This option is useful for tunneling ssh connecM-bM-^@M-^P
185 tions or for multiple servers running on a single host. 184 tions or for multiple servers running on a single host.
186 185
187 HostName 186 ^[[1mHostName^[[0m
188 Specifies the real host name to log into. This can be used to 187 Specifies the real host name to log into. This can be used to
189 specify nicknames or abbreviations for hosts. Default is the 188 specify nicknames or abbreviations for hosts. Default is the
190 name given on the command line. Numeric IP addresses are also 189 name given on the command line. Numeric IP addresses are also
191 permitted (both on the command line and in HostName specificaM-- 190 permitted (both on the command line and in ^[[1mHostName ^[[22mspecificaM-bM-^@M-^P
192 tions). 191 tions).
193 192
194 IdentityFile 193 ^[[1mIdentityFile^[[0m
195 Specifies a file from which the user's RSA or DSA authentication 194 Specifies a file from which the userM-bM-^@M-^Ys RSA or DSA authentication
196 identity is read. The default is $HOME/.ssh/identity for protocol 195 identity is read. The default is ^[[4m$HOME/.ssh/identity^[[24m for protocol
197 version 1, and $HOME/.ssh/id_rsa and $HOME/.ssh/id_dsa for protoM-- 196 version 1, and ^[[4m$HOME/.ssh/id_rsa^[[24m and ^[[4m$HOME/.ssh/id_dsa^[[24m for protoM-bM-^@M-^P
198 col version 2. Additionally, any identities represented by the 197 col version 2. Additionally, any identities represented by the
199 authentication agent will be used for authentication. The file 198 authentication agent will be used for authentication. The file
200 name may use the tilde syntax to refer to a user's home direcM-- 199 name may use the tilde syntax to refer to a userM-bM-^@M-^Ys home direcM-bM-^@M-^P
201 tory. It is possible to have multiple identity files specified 200 tory. It is possible to have multiple identity files specified
202 in configuration files; all these identities will be tried in 201 in configuration files; all these identities will be tried in
203 sequence. 202 sequence.
204 203
205 KeepAlive 204 ^[[1mKeepAlive^[[0m
206 Specifies whether the system should send TCP keepalive messages 205 Specifies whether the system should send TCP keepalive messages
207 to the other side. If they are sent, death of the connection or 206 to the other side. If they are sent, death of the connection or
208 crash of one of the machines will be properly noticed. However, 207 crash of one of the machines will be properly noticed. However,
209 this means that connections will die if the route is down temM-- 208 this means that connections will die if the route is down temM-bM-^@M-^P
210 porarily, and some people find it annoying. 209 porarily, and some people find it annoying.
211 210
212 The default is ``yes'' (to send keepalives), and the client will 211 The default is M-bM-^@M-^\yesM-bM-^@M-^] (to send keepalives), and the client will
213 notice if the network goes down or the remote host dies. This is 212 notice if the network goes down or the remote host dies. This is
214 important in scripts, and many users want it too. 213 important in scripts, and many users want it too.
215 214
216 To disable keepalives, the value should be set to ``no''. 215 To disable keepalives, the value should be set to M-bM-^@M-^\noM-bM-^@M-^].
217 216
218 KerberosAuthentication 217 ^[[1mKerberosAuthentication^[[0m
219 Specifies whether Kerberos authentication will be used. The 218 Specifies whether Kerberos authentication will be used. The
220 argument to this keyword must be ``yes'' or ``no''. 219 argument to this keyword must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^].
221 220
222 KerberosTgtPassing 221 ^[[1mKerberosTgtPassing^[[0m
223 Specifies whether a Kerberos TGT will be forwarded to the server. 222 Specifies whether a Kerberos TGT will be forwarded to the server.
224 This will only work if the Kerberos server is actually an AFS 223 This will only work if the Kerberos server is actually an AFS
225 kaserver. The argument to this keyword must be ``yes'' or 224 kaserver. The argument to this keyword must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^].
226 ``no''.
227 225
228 LocalForward 226 ^[[1mLocalForward^[[0m
229 Specifies that a TCP/IP port on the local machine be forwarded 227 Specifies that a TCP/IP port on the local machine be forwarded
230 over the secure channel to the specified host and port from the 228 over the secure channel to the specified host and port from the
231 remote machine. The first argument must be a port number, and 229 remote machine. The first argument must be a port number, and
232 the second must be host:port. IPv6 addresses can be specified 230 the second must be ^[[4mhost:port^[[24m. IPv6 addresses can be specified
233 with an alternative syntax: host/port. Multiple forwardings may 231 with an alternative syntax: ^[[4mhost/port^[[24m. Multiple forwardings may
234 be specified, and additional forwardings can be given on the comM-- 232 be specified, and additional forwardings can be given on the comM-bM-^@M-^P
235 mand line. Only the superuser can forward privileged ports. 233 mand line. Only the superuser can forward privileged ports.
236 234
237 LogLevel 235 ^[[1mLogLevel^[[0m
238 Gives the verbosity level that is used when logging messages from 236 Gives the verbosity level that is used when logging messages from
239 ssh. The possible values are: QUIET, FATAL, ERROR, INFO, VERM-- 237 ^[[1mssh^[[22m. The possible values are: QUIET, FATAL, ERROR, INFO, VERM-bM-^@M-^P
240 BOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3. The default is INFO. 238 BOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3. The default is INFO.
241 DEBUG and DEBUG1 are equivalent. DEBUG2 and DEBUG3 each specify 239 DEBUG and DEBUG1 are equivalent. DEBUG2 and DEBUG3 each specify
242 higher levels of verbose output. 240 higher levels of verbose output.
243 241
244 MACs Specifies the MAC (message authentication code) algorithms in 242 ^[[1mMACs ^[[22mSpecifies the MAC (message authentication code) algorithms in
245 order of preference. The MAC algorithm is used in protocol verM-- 243 order of preference. The MAC algorithm is used in protocol verM-bM-^@M-^P
246 sion 2 for data integrity protection. Multiple algorithms must 244 sion 2 for data integrity protection. Multiple algorithms must
247 be comma-separated. The default is 245 be commaM-bM-^@M-^Pseparated. The default is
248 ``hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96''. 246 M-bM-^@M-^\hmacM-bM-^@M-^Pmd5,hmacM-bM-^@M-^Psha1,hmacM-bM-^@M-^Pripemd160,hmacM-bM-^@M-^Psha1M-bM-^@M-^P96,hmacM-bM-^@M-^Pmd5M-bM-^@M-^P96M-bM-^@M-^].
249 247
250 NoHostAuthenticationForLocalhost 248 ^[[1mNoHostAuthenticationForLocalhost^[[0m
251 This option can be used if the home directory is shared across 249 This option can be used if the home directory is shared across
252 machines. In this case localhost will refer to a different 250 machines. In this case localhost will refer to a different
253 machine on each of the machines and the user will get many warnM-- 251 machine on each of the machines and the user will get many warnM-bM-^@M-^P
254 ings about changed host keys. However, this option disables host 252 ings about changed host keys. However, this option disables host
255 authentication for localhost. The argument to this keyword must 253 authentication for localhost. The argument to this keyword must
256 be ``yes'' or ``no''. The default is to check the host key for 254 be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The default is to check the host key for
257 localhost. 255 localhost.
258 256
259 NumberOfPasswordPrompts 257 ^[[1mNumberOfPasswordPrompts^[[0m
260 Specifies the number of password prompts before giving up. The 258 Specifies the number of password prompts before giving up. The
261 argument to this keyword must be an integer. Default is 3. 259 argument to this keyword must be an integer. Default is 3.
262 260
263 PasswordAuthentication 261 ^[[1mPasswordAuthentication^[[0m
264 Specifies whether to use password authentication. The argument 262 Specifies whether to use password authentication. The argument
265 to this keyword must be ``yes'' or ``no''. The default is 263 to this keyword must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The default is M-bM-^@M-^\yesM-bM-^@M-^].
266 ``yes''.
267 264
268 Port Specifies the port number to connect on the remote host. Default 265 ^[[1mPort ^[[22mSpecifies the port number to connect on the remote host. Default
269 is 22. 266 is 22.
270 267
271 PreferredAuthentications 268 ^[[1mPreferredAuthentications^[[0m
272 Specifies the order in which the client should try protocol 2 269 Specifies the order in which the client should try protocol 2
273 authentication methods. This allows a client to prefer one method 270 authentication methods. This allows a client to prefer one method
274 (e.g. keyboard-interactive) over another method (e.g. password) 271 (e.g. ^[[1mkeyboardM-bM-^@M-^Pinteractive^[[22m) over another method (e.g. ^[[1mpassword^[[22m)
275 The default for this option is: 272 The default for this option is:
276 ``hostbased,publickey,keyboard-interactive,password''. 273 M-bM-^@M-^\hostbased,publickey,keyboardM-bM-^@M-^Pinteractive,passwordM-bM-^@M-^].
277 274
278 Protocol 275 ^[[1mProtocol^[[0m
279 Specifies the protocol versions ssh should support in order of 276 Specifies the protocol versions ^[[1mssh ^[[22mshould support in order of
280 preference. The possible values are ``1'' and ``2''. Multiple 277 preference. The possible values are M-bM-^@M-^\1M-bM-^@M-^] and M-bM-^@M-^\2M-bM-^@M-^]. Multiple verM-bM-^@M-^P
281 versions must be comma-separated. The default is ``2,1''. This 278 sions must be commaM-bM-^@M-^Pseparated. The default is M-bM-^@M-^\2,1M-bM-^@M-^]. This means
282 means that ssh tries version 2 and falls back to version 1 if 279 that ^[[1mssh ^[[22mtries version 2 and falls back to version 1 if version 2
283 version 2 is not available. 280 is not available.
284 281
285 ProxyCommand 282 ^[[1mProxyCommand^[[0m
286 Specifies the command to use to connect to the server. The comM-- 283 Specifies the command to use to connect to the server. The comM-bM-^@M-^P
287 mand string extends to the end of the line, and is executed with 284 mand string extends to the end of the line, and is executed with
288 /bin/sh. In the command string, `%h' will be substituted by the 285 ^[[4m/bin/sh^[[24m. In the command string, M-bM-^@M-^X%hM-bM-^@M-^Y will be substituted by the
289 host name to connect and `%p' by the port. The command can be 286 host name to connect and M-bM-^@M-^X%pM-bM-^@M-^Y by the port. The command can be
290 basically anything, and should read from its standard input and 287 basically anything, and should read from its standard input and
291 write to its standard output. It should eventually connect an 288 write to its standard output. It should eventually connect an
292 sshd(8) server running on some machine, or execute sshd -i someM-- 289 sshd(8) server running on some machine, or execute ^[[1msshd M-bM-^@M-^Pi ^[[22msomeM-bM-^@M-^P
293 where. Host key management will be done using the HostName of 290 where. Host key management will be done using the HostName of
294 the host being connected (defaulting to the name typed by the 291 the host being connected (defaulting to the name typed by the
295 user). Note that CheckHostIP is not available for connects with 292 user). Setting the command to M-bM-^@M-^\noneM-bM-^@M-^] disables this option
296 a proxy command. 293 entirely. Note that ^[[1mCheckHostIP ^[[22mis not available for connects
294 with a proxy command.
297 295
298 PubkeyAuthentication 296 ^[[1mPubkeyAuthentication^[[0m
299 Specifies whether to try public key authentication. The argument 297 Specifies whether to try public key authentication. The argument
300 to this keyword must be ``yes'' or ``no''. The default is 298 to this keyword must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The default is M-bM-^@M-^\yesM-bM-^@M-^].
301 ``yes''. This option applies to protocol version 2 only. 299 This option applies to protocol version 2 only.
302 300
303 RemoteForward 301 ^[[1mRemoteForward^[[0m
304 Specifies that a TCP/IP port on the remote machine be forwarded 302 Specifies that a TCP/IP port on the remote machine be forwarded
305 over the secure channel to the specified host and port from the 303 over the secure channel to the specified host and port from the
306 local machine. The first argument must be a port number, and the 304 local machine. The first argument must be a port number, and the
307 second must be host:port. IPv6 addresses can be specified with 305 second must be ^[[4mhost:port^[[24m. IPv6 addresses can be specified with
308 an alternative syntax: host/port. Multiple forwardings may be 306 an alternative syntax: ^[[4mhost/port^[[24m. Multiple forwardings may be
309 specified, and additional forwardings can be given on the command 307 specified, and additional forwardings can be given on the command
310 line. Only the superuser can forward privileged ports. 308 line. Only the superuser can forward privileged ports.
311 309
312 RhostsAuthentication 310 ^[[1mRhostsAuthentication^[[0m
313 Specifies whether to try rhosts based authentication. Note that 311 Specifies whether to try rhosts based authentication. Note that
314 this declaration only affects the client side and has no effect 312 this declaration only affects the client side and has no effect
315 whatsoever on security. Most servers do not permit RhostsAuthenM-- 313 whatsoever on security. Most servers do not permit RhostsAuthenM-bM-^@M-^P
316 tication because it is not secure (see RhostsRSAAuthentication). 314 tication because it is not secure (see ^[[1mRhostsRSAAuthentication^[[22m).
317 The argument to this keyword must be ``yes'' or ``no''. The 315 The argument to this keyword must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The default
318 default is ``no''. This option applies to protocol version 1 316 is M-bM-^@M-^\noM-bM-^@M-^]. This option applies to protocol version 1 only and
319 only and requires ssh to be setuid root and UsePrivilegedPort to 317 requires ^[[1mssh ^[[22mto be setuid root and ^[[1mUsePrivilegedPort ^[[22mto be set to
320 be set to ``yes''. 318 M-bM-^@M-^\yesM-bM-^@M-^].
321 319
322 RhostsRSAAuthentication 320 ^[[1mRhostsRSAAuthentication^[[0m
323 Specifies whether to try rhosts based authentication with RSA 321 Specifies whether to try rhosts based authentication with RSA
324 host authentication. The argument must be ``yes'' or ``no''. 322 host authentication. The argument must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The
325 The default is ``no''. This option applies to protocol version 1 323 default is M-bM-^@M-^\noM-bM-^@M-^]. This option applies to protocol version 1 only
326 only and requires ssh to be setuid root. 324 and requires ^[[1mssh ^[[22mto be setuid root.
327 325
328 RSAAuthentication 326 ^[[1mRSAAuthentication^[[0m
329 Specifies whether to try RSA authentication. The argument to 327 Specifies whether to try RSA authentication. The argument to
330 this keyword must be ``yes'' or ``no''. RSA authentication will 328 this keyword must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. RSA authentication will only
331 only be attempted if the identity file exists, or an authenticaM-- 329 be attempted if the identity file exists, or an authentication
332 tion agent is running. The default is ``yes''. Note that this 330 agent is running. The default is M-bM-^@M-^\yesM-bM-^@M-^]. Note that this option
333 option applies to protocol version 1 only. 331 applies to protocol version 1 only.
334 332
335 SmartcardDevice 333 ^[[1mSmartcardDevice^[[0m
336 Specifies which smartcard device to use. The argument to this 334 Specifies which smartcard device to use. The argument to this
337 keyword is the device ssh should use to communicate with a smartM-- 335 keyword is the device ^[[1mssh ^[[22mshould use to communicate with a smartM-bM-^@M-^P
338 card used for storing the user's private RSA key. By default, no 336 card used for storing the userM-bM-^@M-^Ys private RSA key. By default, no
339 device is specified and smartcard support is not activated. 337 device is specified and smartcard support is not activated.
340 338
341 StrictHostKeyChecking 339 ^[[1mStrictHostKeyChecking^[[0m
342 If this flag is set to ``yes'', ssh will never automatically add 340 If this flag is set to M-bM-^@M-^\yesM-bM-^@M-^], ^[[1mssh ^[[22mwill never automatically add
343 host keys to the $HOME/.ssh/known_hosts file, and refuses to conM-- 341 host keys to the ^[[4m$HOME/.ssh/known_hosts^[[24m file, and refuses to conM-bM-^@M-^P
344 nect to hosts whose host key has changed. This provides maximum 342 nect to hosts whose host key has changed. This provides maximum
345 protection against trojan horse attacks, however, can be annoying 343 protection against trojan horse attacks, however, can be annoying
346 when the /etc/ssh/ssh_known_hosts file is poorly maintained, or 344 when the ^[[4m/etc/ssh/ssh_known_hosts^[[24m file is poorly maintained, or
347 connections to new hosts are frequently made. This option forces 345 connections to new hosts are frequently made. This option forces
348 the user to manually add all new hosts. If this flag is set to 346 the user to manually add all new hosts. If this flag is set to
349 ``no'', ssh will automatically add new host keys to the user 347 M-bM-^@M-^\noM-bM-^@M-^], ^[[1mssh ^[[22mwill automatically add new host keys to the user known
350 known hosts files. If this flag is set to ``ask'', new host keys 348 hosts files. If this flag is set to M-bM-^@M-^\askM-bM-^@M-^], new host keys will be
351 will be added to the user known host files only after the user 349 added to the user known host files only after the user has conM-bM-^@M-^P
352 has confirmed that is what they really want to do, and ssh will 350 firmed that is what they really want to do, and ^[[1mssh ^[[22mwill refuse
353 refuse to connect to hosts whose host key has changed. The host 351 to connect to hosts whose host key has changed. The host keys of
354 keys of known hosts will be verified automatically in all cases. 352 known hosts will be verified automatically in all cases. The
355 The argument must be ``yes'', ``no'' or ``ask''. The default is 353 argument must be M-bM-^@M-^\yesM-bM-^@M-^], M-bM-^@M-^\noM-bM-^@M-^] or M-bM-^@M-^\askM-bM-^@M-^]. The default is M-bM-^@M-^\askM-bM-^@M-^].
356 ``ask''. 354
357 355 ^[[1mUsePrivilegedPort^[[0m
358 UsePrivilegedPort 356 Specifies whether to use a privileged port for outgoing connecM-bM-^@M-^P
359 Specifies whether to use a privileged port for outgoing connecM-- 357 tions. The argument must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The default is M-bM-^@M-^\noM-bM-^@M-^].
360 tions. The argument must be ``yes'' or ``no''. The default is 358 If set to M-bM-^@M-^\yesM-bM-^@M-^] ^[[1mssh ^[[22mmust be setuid root. Note that this option
361 ``no''. If set to ``yes'' ssh must be setuid root. Note that 359 must be set to M-bM-^@M-^\yesM-bM-^@M-^] if ^[[1mRhostsAuthentication ^[[22mand
362 this option must be set to ``yes'' if RhostsAuthentication and 360 ^[[1mRhostsRSAAuthentication ^[[22mauthentications are needed with older
363 RhostsRSAAuthentication authentications are needed with older
364 servers. 361 servers.
365 362
366 User Specifies the user to log in as. This can be useful when a difM-- 363 ^[[1mUser ^[[22mSpecifies the user to log in as. This can be useful when a difM-bM-^@M-^P
367 ferent user name is used on different machines. This saves the 364 ferent user name is used on different machines. This saves the
368 trouble of having to remember to give the user name on the comM-- 365 trouble of having to remember to give the user name on the comM-bM-^@M-^P
369 mand line. 366 mand line.
370 367
371 UserKnownHostsFile 368 ^[[1mUserKnownHostsFile^[[0m
372 Specifies a file to use for the user host key database instead of 369 Specifies a file to use for the user host key database instead of
373 $HOME/.ssh/known_hosts. 370 ^[[4m$HOME/.ssh/known_hosts^[[24m.
374 371
375 XAuthLocation 372 ^[[1mXAuthLocation^[[0m
376 Specifies the full pathname of the xauth(1) program. The default 373 Specifies the full pathname of the xauth(1) program. The default
377 is /usr/X11R6/bin/xauth. 374 is ^[[4m/usr/X11R6/bin/xauth^[[24m.
378 375
379FILES 376^[[1mFILES^[[0m
380 $HOME/.ssh/config 377 $HOME/.ssh/config
381 This is the per-user configuration file. The format of this file 378 This is the perM-bM-^@M-^Puser configuration file. The format of this file
382 is described above. This file is used by the ssh client. This 379 is described above. This file is used by the ^[[1mssh ^[[22mclient. This
383 file does not usually contain any sensitive information, but the 380 file does not usually contain any sensitive information, but the
384 recommended permissions are read/write for the user, and not 381 recommended permissions are read/write for the user, and not
385 accessible by others. 382 accessible by others.
386 383
387 /etc/ssh/ssh_config 384 /etc/ssh/ssh_config
388 Systemwide configuration file. This file provides defaults for 385 Systemwide configuration file. This file provides defaults for
389 those values that are not specified in the user's configuration 386 those values that are not specified in the userM-bM-^@M-^Ys configuration
390 file, and for those users who do not have a configuration file. 387 file, and for those users who do not have a configuration file.
391 This file must be world-readable. 388 This file must be worldM-bM-^@M-^Preadable.
392 389
393AUTHORS 390^[[1mAUTHORS^[[0m
394 OpenSSH is a derivative of the original and free ssh 1.2.12 release by 391 OpenSSH is a derivative of the original and free ssh 1.2.12 release by
395 Tatu Ylonen. Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, Theo 392 Tatu Ylonen. Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, Theo
396 de Raadt and Dug Song removed many bugs, re-added newer features and creM-- 393 de Raadt and Dug Song removed many bugs, reM-bM-^@M-^Padded newer features and creM-bM-^@M-^P
397 ated OpenSSH. Markus Friedl contributed the support for SSH protocol 394 ated OpenSSH. Markus Friedl contributed the support for SSH protocol
398 versions 1.5 and 2.0. 395 versions 1.5 and 2.0.
399 396
400SEE ALSO 397^[[1mSEE ALSO^[[0m
401 ssh(1) 398 ssh(1)
402 399
403BSD September 25, 1999 BSD 400BSD September 25, 1999 BSD
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-10 13:41:53 +0000