1 files changed, 54 insertions, 40 deletions

diff --git a/ssh_config.0 b/ssh_config.0
index 10f1c2e9d..94ef73676 100644
--- a/ssh_config.0
+++ b/ssh_config.0
@@ -171,7 +171,7 @@ DESCRIPTION
              Specifies which algorithms are allowed for signing of
              certificates by certificate authorities (CAs).  The default is:
 
-                   ecdsa-sha2-nistp256.ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
+                   ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
                    ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
 
              ssh(1) will not accept host certificates signed using algorithms
@@ -206,12 +206,14 @@ DESCRIPTION
 
      Ciphers
              Specifies the ciphers allowed and their order of preference.
-             Multiple ciphers must be comma-separated.  If the specified value
+             Multiple ciphers must be comma-separated.  If the specified list
              begins with a M-bM-^@M-^X+M-bM-^@M-^Y character, then the specified ciphers will be
              appended to the default set instead of replacing them.  If the
-             specified value begins with a M-bM-^@M-^X-M-bM-^@M-^Y character, then the specified
+             specified list begins with a M-bM-^@M-^X-M-bM-^@M-^Y character, then the specified
              ciphers (including wildcards) will be removed from the default
-             set instead of replacing them.
+             set instead of replacing them.  If the specified list begins with
+             a M-bM-^@M-^X^M-bM-^@M-^Y character, then the specified ciphers will be placed at the
+             head of the default set.
 
              The supported ciphers are:
 
@@ -255,8 +257,9 @@ DESCRIPTION
      ConnectTimeout
              Specifies the timeout (in seconds) used when connecting to the
              SSH server, instead of using the default system TCP timeout.
-             This value is used only when the target is down or really
-             unreachable, not when it refuses the connection.
+             This timeout is applied both to establishing the connection and
+             to performing the initial SSH protocol handshake and key
+             exchange.
 
      ControlMaster
              Enables the sharing of multiple sessions over a single network
@@ -445,12 +448,14 @@ DESCRIPTION
      HostbasedKeyTypes
              Specifies the key types that will be used for hostbased
              authentication as a comma-separated list of patterns.
-             Alternately if the specified value begins with a M-bM-^@M-^X+M-bM-^@M-^Y character,
+             Alternately if the specified list begins with a M-bM-^@M-^X+M-bM-^@M-^Y character,
              then the specified key types will be appended to the default set
-             instead of replacing them.  If the specified value begins with a
+             instead of replacing them.  If the specified list begins with a
              M-bM-^@M-^X-M-bM-^@M-^Y character, then the specified key types (including wildcards)
              will be removed from the default set instead of replacing them.
-             The default for this option is:
+             If the specified list begins with a M-bM-^@M-^X^M-bM-^@M-^Y character, then the
+             specified key types will be placed at the head of the default
+             set.  The default for this option is:
 
                 ecdsa-sha2-nistp256-cert-v01@openssh.com,
                 ecdsa-sha2-nistp384-cert-v01@openssh.com,
@@ -465,12 +470,14 @@ DESCRIPTION
 
      HostKeyAlgorithms
              Specifies the host key algorithms that the client wants to use in
-             order of preference.  Alternately if the specified value begins
+             order of preference.  Alternately if the specified list begins
              with a M-bM-^@M-^X+M-bM-^@M-^Y character, then the specified key types will be
              appended to the default set instead of replacing them.  If the
-             specified value begins with a M-bM-^@M-^X-M-bM-^@M-^Y character, then the specified
+             specified list begins with a M-bM-^@M-^X-M-bM-^@M-^Y character, then the specified
              key types (including wildcards) will be removed from the default
-             set instead of replacing them.  The default for this option is:
+             set instead of replacing them.  If the specified list begins with
+             a M-bM-^@M-^X^M-bM-^@M-^Y character, then the specified key types will be placed at
+             the head of the default set.  The default for this option is:
 
                 ecdsa-sha2-nistp256-cert-v01@openssh.com,
                 ecdsa-sha2-nistp384-cert-v01@openssh.com,
@@ -494,19 +501,20 @@ DESCRIPTION
              option is useful for tunneling SSH connections or for multiple
              servers running on a single host.
 
-     HostName
+     Hostname
              Specifies the real host name to log into.  This can be used to
              specify nicknames or abbreviations for hosts.  Arguments to
-             HostName accept the tokens described in the TOKENS section.
+             Hostname accept the tokens described in the TOKENS section.
              Numeric IP addresses are also permitted (both on the command line
-             and in HostName specifications).  The default is the name given
+             and in Hostname specifications).  The default is the name given
              on the command line.
 
      IdentitiesOnly
-             Specifies that ssh(1) should only use the authentication identity
-             and certificate files explicitly configured in the ssh_config
-             files or passed on the ssh(1) command-line, even if ssh-agent(1)
-             or a PKCS11Provider offers more identities.  The argument to this
+             Specifies that ssh(1) should only use the configured
+             authentication identity and certificate files (either the default
+             files, or those explicitly configured in the ssh_config files or
+             passed on the ssh(1) command-line), even if ssh-agent(1) or a
+             PKCS11Provider offers more identities.  The argument to this
              keyword must be yes or no (the default).  This option is intended
              for situations where ssh-agent offers many different identities.
 
@@ -597,12 +605,14 @@ DESCRIPTION
 
      KexAlgorithms
              Specifies the available KEX (Key Exchange) algorithms.  Multiple
-             algorithms must be comma-separated.  Alternately if the specified
-             value begins with a M-bM-^@M-^X+M-bM-^@M-^Y character, then the specified methods
-             will be appended to the default set instead of replacing them.
-             If the specified value begins with a M-bM-^@M-^X-M-bM-^@M-^Y character, then the
-             specified methods (including wildcards) will be removed from the
-             default set instead of replacing them.  The default is:
+             algorithms must be comma-separated.  If the specified list begins
+             with a M-bM-^@M-^X+M-bM-^@M-^Y character, then the specified methods will be appended
+             to the default set instead of replacing them.  If the specified
+             list begins with a M-bM-^@M-^X-M-bM-^@M-^Y character, then the specified methods
+             (including wildcards) will be removed from the default set
+             instead of replacing them.  If the specified list begins with a
+             M-bM-^@M-^X^M-bM-^@M-^Y character, then the specified methods will be placed at the
+             head of the default set.  The default is:
 
                    curve25519-sha256,curve25519-sha256@libssh.org,
                    ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
@@ -655,12 +665,14 @@ DESCRIPTION
      MACs    Specifies the MAC (message authentication code) algorithms in
              order of preference.  The MAC algorithm is used for data
              integrity protection.  Multiple algorithms must be comma-
-             separated.  If the specified value begins with a M-bM-^@M-^X+M-bM-^@M-^Y character,
+             separated.  If the specified list begins with a M-bM-^@M-^X+M-bM-^@M-^Y character,
              then the specified algorithms will be appended to the default set
-             instead of replacing them.  If the specified value begins with a
+             instead of replacing them.  If the specified list begins with a
              M-bM-^@M-^X-M-bM-^@M-^Y character, then the specified algorithms (including
              wildcards) will be removed from the default set instead of
-             replacing them.
+             replacing them.  If the specified list begins with a M-bM-^@M-^X^M-bM-^@M-^Y
+             character, then the specified algorithms will be placed at the
+             head of the default set.
 
              The algorithms that contain "-etm" calculate the MAC after
              encryption (encrypt-then-mac).  These are considered safer and
@@ -724,7 +736,7 @@ DESCRIPTION
              should read from its standard input and write to its standard
              output.  It should eventually connect an sshd(8) server running
              on some machine, or execute sshd -i somewhere.  Host key
-             management will be done using the HostName of the host being
+             management will be done using the Hostname of the host being
              connected (defaulting to the name typed by the user).  Setting
              the command to none disables this option entirely.  Note that
              CheckHostIP is not available for connects with a proxy command.
@@ -759,13 +771,15 @@ DESCRIPTION
 
      PubkeyAcceptedKeyTypes
              Specifies the key types that will be used for public key
-             authentication as a comma-separated list of patterns.
-             Alternately if the specified value begins with a M-bM-^@M-^X+M-bM-^@M-^Y character,
-             then the key types after it will be appended to the default
-             instead of replacing it.  If the specified value begins with a
-             M-bM-^@M-^X-M-bM-^@M-^Y character, then the specified key types (including wildcards)
-             will be removed from the default set instead of replacing them.
-             The default for this option is:
+             authentication as a comma-separated list of patterns.  If the
+             specified list begins with a M-bM-^@M-^X+M-bM-^@M-^Y character, then the key types
+             after it will be appended to the default instead of replacing it.
+             If the specified list begins with a M-bM-^@M-^X-M-bM-^@M-^Y character, then the
+             specified key types (including wildcards) will be removed from
+             the default set instead of replacing them.  If the specified list
+             begins with a M-bM-^@M-^X^M-bM-^@M-^Y character, then the specified key types will be
+             placed at the head of the default set.  The default for this
+             option is:
 
                 ecdsa-sha2-nistp256-cert-v01@openssh.com,
                 ecdsa-sha2-nistp384-cert-v01@openssh.com,
@@ -876,7 +890,7 @@ DESCRIPTION
              therefore will not be spoofable.  The TCP keepalive option
              enabled by TCPKeepAlive is spoofable.  The server alive mechanism
              is valuable when the client or server depend on knowing when a
-             connection has become inactive.
+             connection has become unresponsive.
 
              The default value is 3.  If, for example, ServerAliveInterval
              (see below) is set to 15 and ServerAliveCountMax is left at the
@@ -1080,7 +1094,7 @@ TOKENS
      ControlPath accepts the tokens %%, %C, %h, %i, %L, %l, %n, %p, %r, and
      %u.
 
-     HostName accepts the tokens %% and %h.
+     Hostname accepts the tokens %% and %h.
 
      IdentityAgent and IdentityFile accept the tokens %%, %d, %h, %i, %l, %r,
      and %u.
@@ -1088,7 +1102,7 @@ TOKENS
      LocalCommand accepts the tokens %%, %C, %d, %h, %i, %l, %n, %p, %r, %T,
      and %u.
 
-     ProxyCommand accepts the tokens %%, %h, %p, and %r.
+     ProxyCommand accepts the tokens %%, %h, %n, %p, and %r.
 
      RemoteCommand accepts the tokens %%, %C, %d, %h, %i, %l, %n, %p, %r, and
      %u.
@@ -1116,4 +1130,4 @@ AUTHORS
      created OpenSSH.  Markus Friedl contributed the support for SSH protocol
      versions 1.5 and 2.0.
 
-OpenBSD 6.5                      March 1, 2019                     OpenBSD 6.5
+OpenBSD 6.6                   September 13, 2019                   OpenBSD 6.6