1 files changed, 64 insertions, 83 deletions

diff --git a/ssh_config.0 b/ssh_config.0
index ade8e6562..9493953ab 100644
--- a/ssh_config.0
+++ b/ssh_config.0
@@ -3,10 +3,6 @@ SSH_CONFIG(5)                 File Formats Manual                SSH_CONFIG(5)
 NAME
      ssh_config M-bM-^@M-^S OpenSSH SSH client configuration files
 
-SYNOPSIS
-     ~/.ssh/config
-     /etc/ssh/ssh_config
-
 DESCRIPTION
      ssh(1) obtains configuration data from the following sources in the
      following order:
@@ -189,21 +185,14 @@ DESCRIPTION
              process, regardless of the setting of StrictHostKeyChecking.  If
              the option is set to no, the check will not be executed.
 
-     Cipher  Specifies the cipher to use for encrypting the session in
-             protocol version 1.  Currently, blowfish, 3des (the default), and
-             des are supported, though des is only supported in the ssh(1)
-             client for interoperability with legacy protocol 1
-             implementations; its use is strongly discouraged due to
-             cryptographic weaknesses.
-
      Ciphers
-             Specifies the ciphers allowed for protocol version 2 in order of
-             preference.  Multiple ciphers must be comma-separated.  If the
-             specified value begins with a M-bM-^@M-^X+M-bM-^@M-^Y character, then the specified
-             ciphers will be appended to the default set instead of replacing
-             them.  If the specified value begins with a M-bM-^@M-^X-M-bM-^@M-^Y character, then
-             the specified ciphers (including wildcards) will be removed from
-             the default set instead of replacing them.
+             Specifies the ciphers allowed and their order of preference.
+             Multiple ciphers must be comma-separated.  If the specified value
+             begins with a M-bM-^@M-^X+M-bM-^@M-^Y character, then the specified ciphers will be
+             appended to the default set instead of replacing them.  If the
+             specified value begins with a M-bM-^@M-^X-M-bM-^@M-^Y character, then the specified
+             ciphers (including wildcards) will be removed from the default
+             set instead of replacing them.
 
              The supported ciphers are:
 
@@ -216,11 +205,6 @@ DESCRIPTION
                    aes256-ctr
                    aes128-gcm@openssh.com
                    aes256-gcm@openssh.com
-                   arcfour
-                   arcfour128
-                   arcfour256
-                   blowfish-cbc
-                   cast128-cbc
                    chacha20-poly1305@openssh.com
 
              The default is:
@@ -245,13 +229,6 @@ DESCRIPTION
              Specifies whether to use compression.  The argument must be yes
              or no (the default).
 
-     CompressionLevel
-             Specifies the compression level to use if compression is enabled.
-             The argument must be an integer from 1 (fast) to 9 (slow, best).
-             The default level is 6, which is good for most applications.  The
-             meaning of the values is the same as in gzip(1).  Note that this
-             option applies to protocol version 1 only.
-
      ConnectionAttempts
              Specifies the number of tries (one per second) to make before
              exiting.  The argument must be an integer.  This may be useful in
@@ -491,8 +468,9 @@ DESCRIPTION
      HostKeyAlias
              Specifies an alias that should be used instead of the real host
              name when looking up or saving the host key in the host key
-             database files.  This option is useful for tunneling SSH
-             connections or for multiple servers running on a single host.
+             database files and when validating host certificates.  This
+             option is useful for tunneling SSH connections or for multiple
+             servers running on a single host.
 
      HostName
              Specifies the real host name to log into.  This can be used to
@@ -526,9 +504,8 @@ DESCRIPTION
 
      IdentityFile
              Specifies a file from which the user's DSA, ECDSA, Ed25519 or RSA
-             authentication identity is read.  The default is ~/.ssh/identity
-             for protocol version 1, and ~/.ssh/id_dsa, ~/.ssh/id_ecdsa,
-             ~/.ssh/id_ed25519 and ~/.ssh/id_rsa for protocol version 2.
+             authentication identity is read.  The default is ~/.ssh/id_dsa,
+             ~/.ssh/id_ecdsa, ~/.ssh/id_ed25519 and ~/.ssh/id_rsa.
              Additionally, any identities represented by the authentication
              agent will be used for authentication unless IdentitiesOnly is
              set.  If no certificates have been explicitly specified by
@@ -573,13 +550,14 @@ DESCRIPTION
      IPQoS   Specifies the IPv4 type-of-service or DSCP class for connections.
              Accepted values are af11, af12, af13, af21, af22, af23, af31,
              af32, af33, af41, af42, af43, cs0, cs1, cs2, cs3, cs4, cs5, cs6,
-             cs7, ef, lowdelay, throughput, reliability, or a numeric value.
-             This option may take one or two arguments, separated by
-             whitespace.  If one argument is specified, it is used as the
-             packet class unconditionally.  If two values are specified, the
-             first is automatically selected for interactive sessions and the
-             second for non-interactive sessions.  The default is lowdelay for
-             interactive sessions and throughput for non-interactive sessions.
+             cs7, ef, lowdelay, throughput, reliability, a numeric value, or
+             none to use the operating system default.  This option may take
+             one or two arguments, separated by whitespace.  If one argument
+             is specified, it is used as the packet class unconditionally.  If
+             two values are specified, the first is automatically selected for
+             interactive sessions and the second for non-interactive sessions.
+             The default is lowdelay for interactive sessions and throughput
+             for non-interactive sessions.
 
      KbdInteractiveAuthentication
              Specifies whether to use keyboard-interactive authentication.
@@ -712,15 +690,6 @@ DESCRIPTION
                    gssapi-with-mic,hostbased,publickey,
                    keyboard-interactive,password
 
-     Protocol
-             Specifies the protocol versions ssh(1) should support in order of
-             preference.  The possible values are 1 and 2.  Multiple versions
-             must be comma-separated.  When this option is set to 2,1 ssh will
-             try version 2 and fall back to version 1 if version 2 is not
-             available.  The default is version 2.  Protocol 1 suffers from a
-             number of cryptographic weaknesses and should not be used.  It is
-             only offered to support legacy devices.
-
      ProxyCommand
              Specifies the command to use to connect to the server.  The
              command string extends to the end of the line, and is executed
@@ -799,15 +768,29 @@ DESCRIPTION
              rekeying is performed after the cipher's default amount of data
              has been sent or received and no time based rekeying is done.
 
+     RemoteCommand
+             Specifies a command to execute on the remote machine after
+             successfully connecting to the server.  The command string
+             extends to the end of the line, and is executed with the user's
+             shell.  Arguments to RemoteCommand accept the tokens described in
+             the TOKENS section.
+
      RemoteForward
              Specifies that a TCP port on the remote machine be forwarded over
-             the secure channel to the specified host and port from the local
-             machine.  The first argument must be [bind_address:]port and the
-             second argument must be host:hostport.  IPv6 addresses can be
-             specified by enclosing addresses in square brackets.  Multiple
-             forwardings may be specified, and additional forwardings can be
-             given on the command line.  Privileged ports can be forwarded
-             only when logging in as root on the remote machine.
+             the secure channel.  The remote port may either be fowarded to a
+             specified host and port from the local machine, or may act as a
+             SOCKS 4/5 proxy that allows a remote client to connect to
+             arbitrary destinations from the local machine.  The first
+             argument must be [bind_address:]port If forwarding to a specific
+             destination then the second argument must be host:hostport,
+             otherwise if no destination argument is specified then the remote
+             forwarding will be established as a SOCKS proxy.
+
+             IPv6 addresses can be specified by enclosing addresses in square
+             brackets.  Multiple forwardings may be specified, and additional
+             forwardings can be given on the command line.  Privileged ports
+             can be forwarded only when logging in as root on the remote
+             machine.
 
              If the port argument is 0, the listen port will be dynamically
              allocated on the server and reported to the client at run time.
@@ -835,19 +818,6 @@ DESCRIPTION
              List (KRL) as generated by ssh-keygen(1).  For more information
              on KRLs, see the KEY REVOCATION LISTS section in ssh-keygen(1).
 
-     RhostsRSAAuthentication
-             Specifies whether to try rhosts based authentication with RSA
-             host authentication.  The argument must be yes or no (the
-             default).  This option applies to protocol version 1 only and
-             requires ssh(1) to be setuid root.
-
-     RSAAuthentication
-             Specifies whether to try RSA authentication.  The argument to
-             this keyword must be yes (the default) or no.  RSA authentication
-             will only be attempted if the identity file exists, or an
-             authentication agent is running.  Note that this option applies
-             to protocol version 1 only.
-
      SendEnv
              Specifies what variables from the local environ(7) should be sent
              to the server.  The server must also support it, and the server
@@ -916,14 +886,25 @@ DESCRIPTION
              protection against trojan horse attacks, though it can be
              annoying when the /etc/ssh/ssh_known_hosts file is poorly
              maintained or when connections to new hosts are frequently made.
-             This option forces the user to manually add all new hosts.  If
-             this flag is set to no, ssh will automatically add new host keys
-             to the user known hosts files.  If this flag is set to ask (the
-             default), new host keys will be added to the user known host
-             files only after the user has confirmed that is what they really
-             want to do, and ssh will refuse to connect to hosts whose host
-             key has changed.  The host keys of known hosts will be verified
-             automatically in all cases.
+             This option forces the user to manually add all new hosts.
+
+             If this flag is set to M-bM-^@M-^\accept-newM-bM-^@M-^] then ssh will automatically
+             add new host keys to the user known hosts files, but will not
+             permit connections to hosts with changed host keys.  If this flag
+             is set to M-bM-^@M-^\noM-bM-^@M-^] or M-bM-^@M-^\offM-bM-^@M-^], ssh will automatically add new host keys
+             to the user known hosts files and allow connections to hosts with
+             changed hostkeys to proceed, subject to some restrictions.  If
+             this flag is set to ask (the default), new host keys will be
+             added to the user known host files only after the user has
+             confirmed that is what they really want to do, and ssh will
+             refuse to connect to hosts whose host key has changed.  The host
+             keys of known hosts will be verified automatically in all cases.
+
+     SyslogFacility
+             Gives the facility code that is used when logging messages from
+             ssh(1).  The possible values are: DAEMON, USER, AUTH, LOCAL0,
+             LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.  The
+             default is USER.
 
      TCPKeepAlive
              Specifies whether the system should send TCP keepalive messages
@@ -973,9 +954,7 @@ DESCRIPTION
      UsePrivilegedPort
              Specifies whether to use a privileged port for outgoing
              connections.  The argument must be yes or no (the default).  If
-             set to yes, ssh(1) must be setuid root.  Note that this option
-             must be set to yes for RhostsRSAAuthentication with older
-             servers.
+             set to yes, ssh(1) must be setuid root.
 
      User    Specifies the user to log in as.  This can be useful when a
              different user name is used on different machines.  This saves
@@ -1065,6 +1044,8 @@ TOKENS
 
      ProxyCommand accepts the tokens %%, %h, %p, and %r.
 
+     RemoteCommand accepts the tokens %%, %C, %d, %h, %l, %n, %p, %r, and %u.
+
 FILES
      ~/.ssh/config
              This is the per-user configuration file.  The format of this file
@@ -1089,4 +1070,4 @@ AUTHORS
      created OpenSSH.  Markus Friedl contributed the support for SSH protocol
      versions 1.5 and 2.0.
 
-OpenBSD 6.0                    February 27, 2017                   OpenBSD 6.0
+OpenBSD 6.2                   September 21, 2017                   OpenBSD 6.2