1 files changed, 102 insertions, 60 deletions

diff --git a/ssh_config.0 b/ssh_config.0
index a2706b69c..46a0543c3 100644
--- a/ssh_config.0
+++ b/ssh_config.0
@@ -129,16 +129,19 @@ DESCRIPTION
              on a control socket specified using the ControlPath argument.
              Additional sessions can connect to this socket using the same
              ControlPath with ControlMaster set to ``no'' (the default).
-             These sessions will reuse the master instance's network connec-
-             tion rather than initiating new ones.  Setting this to ``ask''
-             will cause ssh to listen for control connections, but require
-             confirmation using the SSH_ASKPASS program before they are ac-
-             cepted (see ssh-add(1) for details).  If the ControlPath can not
-             be opened, ssh will continue without connecting to a master in-
-             stance.
+             These sessions will try to reuse the master instance's network
+             connection rather than initiating new ones, but will fall back to
+             connecting normally if the control socket does not exist, or is
+             not listening.
+
+             Setting this to ``ask'' will cause ssh to listen for control con-
+             nections, but require confirmation using the SSH_ASKPASS program
+             before they are accepted (see ssh-add(1) for details).  If the
+             ControlPath can not be opened, ssh will continue without connect-
+             ing to a master instance.
 
              X11 and ssh-agent(1) forwarding is supported over these multi-
-             plexed connections, however the display and agent fowarded will
+             plexed connections, however the display and agent forwarded will
              be the one belonging to the master connection i.e. it is not pos-
              sible to forward multiple displays or agents.
 
@@ -159,14 +162,24 @@ DESCRIPTION
              nections are uniquely identified.
 
      DynamicForward
-             Specifies that a TCP/IP port on the local machine be forwarded
-             over the secure channel, and the application protocol is then
-             used to determine where to connect to from the remote machine.
-             The argument must be a port number.  Currently the SOCKS4 and
-             SOCKS5 protocols are supported, and ssh will act as a SOCKS serv-
-             er.  Multiple forwardings may be specified, and additional for-
-             wardings can be given on the command line.  Only the superuser
-             can forward privileged ports.
+             Specifies that a TCP port on the local machine be forwarded over
+             the secure channel, and the application protocol is then used to
+             determine where to connect to from the remote machine.
+
+             The argument must be [bind_address:]port.  IPv6 addresses can be
+             specified by enclosing addresses in square brackets or by using
+             an alternative syntax: [bind_address/]port.  By default, the lo-
+             cal port is bound in accordance with the GatewayPorts setting.
+             However, an explicit bind_address may be used to bind the connec-
+             tion to a specific address.  The bind_address of ``localhost''
+             indicates that the listening port be bound for local use only,
+             while an empty address or `*' indicates that the port should be
+             available from all interfaces.
+
+             Currently the SOCKS4 and SOCKS5 protocols are supported, and ssh
+             will act as a SOCKS server.  Multiple forwardings may be speci-
+             fied, and additional forwardings can be given on the command
+             line.  Only the superuser can forward privileged ports.
 
      EnableSSHKeysign
              Setting this option to ``yes'' in the global client configuration
@@ -280,6 +293,14 @@ DESCRIPTION
              permitted (both on the command line and in HostName specifica-
              tions).
 
+     IdentitiesOnly
+             Specifies that ssh should only use the authentication identity
+             files configured in the ssh_config files, even if the ssh-agent
+             offers more identities.  The argument to this keyword must be
+             ``yes'' or ``no''.  This option is intended for situations where
+             ssh-agent offers many different identities.  The default is
+             ``no''.
+
      IdentityFile
              Specifies a file from which the user's RSA or DSA authentication
              identity is read.  The default is ~/.ssh/identity for protocol
@@ -290,35 +311,33 @@ DESCRIPTION
              is possible to have multiple identity files specified in configu-
              ration files; all these identities will be tried in sequence.
 
-     IdentitiesOnly
-             Specifies that ssh should only use the authentication identity
-             files configured in the ssh_config files, even if the ssh-agent
-             offers more identities.  The argument to this keyword must be
-             ``yes'' or ``no''.  This option is intented for situations where
-             ssh-agent offers many different identities.  The default is
-             ``no''.
-
      KbdInteractiveDevices
              Specifies the list of methods to use in keyboard-interactive au-
              thentication.  Multiple method names must be comma-separated.
              The default is to use the server specified list.
 
+     LocalCommand
+             Specifies a command to execute on the local machine after suc-
+             cessfully connecting to the server.  The command string extends
+             to the end of the line, and is executed with /bin/sh.  This di-
+             rective is ignored unless PermitLocalCommand has been enabled.
+
      LocalForward
-             Specifies that a TCP/IP port on the local machine be forwarded
-             over the secure channel to the specified host and port from the
-             remote machine.  The first argument must be [bind_address:]port
-             and the second argument must be host:hostport.  IPv6 addresses
-             can be specified by enclosing addresses in square brackets or by
-             using an alternative syntax: [bind_address/]port and
-             host/hostport.  Multiple forwardings may be specified, and addi-
-             tional forwardings can be given on the command line.  Only the
-             superuser can forward privileged ports.  By default, the local
-             port is bound in accordance with the GatewayPorts setting.  How-
-             ever, an explicit bind_address may be used to bind the connection
-             to a specific address.  The bind_address of ``localhost'' indi-
-             cates that the listening port be bound for local use only, while
-             an empty address or `*' indicates that the port should be avail-
-             able from all interfaces.
+             Specifies that a TCP port on the local machine be forwarded over
+             the secure channel to the specified host and port from the remote
+             machine.  The first argument must be [bind_address:]port and the
+             second argument must be host:hostport.  IPv6 addresses can be
+             specified by enclosing addresses in square brackets or by using
+             an alternative syntax: [bind_address/]port and host/hostport.
+             Multiple forwardings may be specified, and additional forwardings
+             can be given on the command line.  Only the superuser can forward
+             privileged ports.  By default, the local port is bound in accor-
+             dance with the GatewayPorts setting.  However, an explicit
+             bind_address may be used to bind the connection to a specific ad-
+             dress.  The bind_address of ``localhost'' indicates that the lis-
+             tening port be bound for local use only, while an empty address
+             or `*' indicates that the port should be available from all in-
+             terfaces.
 
      LogLevel
              Gives the verbosity level that is used when logging messages from
@@ -351,6 +370,11 @@ DESCRIPTION
              to this keyword must be ``yes'' or ``no''.  The default is
              ``yes''.
 
+     PermitLocalCommand
+             Allow local command execution via the LocalCommand option or us-
+             ing the !command escape sequence in ssh(1).  The argument must be
+             ``yes'' or ``no''.  The default is ``no''.
+
      Port    Specifies the port number to connect on the remote host.  Default
              is 22.
 
@@ -393,16 +417,24 @@ DESCRIPTION
              to this keyword must be ``yes'' or ``no''.  The default is
              ``yes''.  This option applies to protocol version 2 only.
 
+     RekeyLimit
+             Specifies the maximum amount of data that may be transmitted be-
+             fore the session key is renegotiated.  The argument is the number
+             of bytes, with an optional suffix of `K', `M', or `G' to indicate
+             Kilobytes, Megabytes, or Gigabytes, respectively.  The default is
+             between ``1G'' and ``4G'', depending on the cipher.  This option
+             applies to protocol version 2 only.
+
      RemoteForward
-             Specifies that a TCP/IP port on the remote machine be forwarded
-             over the secure channel to the specified host and port from the
-             local machine.  The first argument must be [bind_address:]port
-             and the second argument must be host:hostport.  IPv6 addresses
-             can be specified by enclosing addresses in square brackets or by
-             using an alternative syntax: [bind_address/]port and
-             host/hostport.  Multiple forwardings may be specified, and addi-
-             tional forwardings can be given on the command line.  Only the
-             superuser can forward privileged ports.
+             Specifies that a TCP port on the remote machine be forwarded over
+             the secure channel to the specified host and port from the local
+             machine.  The first argument must be [bind_address:]port and the
+             second argument must be host:hostport.  IPv6 addresses can be
+             specified by enclosing addresses in square brackets or by using
+             an alternative syntax: [bind_address/]port and host/hostport.
+             Multiple forwardings may be specified, and additional forwardings
+             can be given on the command line.  Only the superuser can forward
+             privileged ports.
 
              If the bind_address is not specified, the default is to only bind
              to loopback addresses.  If the bind_address is `*' or an empty
@@ -434,15 +466,8 @@ DESCRIPTION
              separated by whitespace or spread across multiple SendEnv direc-
              tives.  The default is not to send any environment variables.
 
-     ServerAliveInterval
-             Sets a timeout interval in seconds after which if no data has
-             been received from the server, ssh will send a message through
-             the encrypted channel to request a response from the server.  The
-             default is 0, indicating that these messages will not be sent to
-             the server.  This option applies to protocol version 2 only.
-
      ServerAliveCountMax
-             Sets the number of server alive messages (see above) which may be
+             Sets the number of server alive messages (see below) which may be
              sent without ssh receiving any messages back from the server.  If
              this threshold is reached while server alive messages are being
              sent, ssh will disconnect from the server, terminating the ses-
@@ -455,9 +480,16 @@ DESCRIPTION
              tion has become inactive.
 
              The default value is 3.  If, for example, ServerAliveInterval
-             (above) is set to 15, and ServerAliveCountMax is left at the de-
-             fault, if the server becomes unresponsive ssh will disconnect af-
-             ter approximately 45 seconds.
+             (see below) is set to 15, and ServerAliveCountMax is left at the
+             default, if the server becomes unresponsive ssh will disconnect
+             after approximately 45 seconds.
+
+     ServerAliveInterval
+             Sets a timeout interval in seconds after which if no data has
+             been received from the server, ssh will send a message through
+             the encrypted channel to request a response from the server.  The
+             default is 0, indicating that these messages will not be sent to
+             the server.  This option applies to protocol version 2 only.
 
      SmartcardDevice
              Specifies which smartcard device to use.  The argument to this
@@ -496,6 +528,16 @@ DESCRIPTION
              To disable TCP keepalive messages, the value should be set to
              ``no''.
 
+     Tunnel  Request starting tun(4) device forwarding between the client and
+             the server.  This option also allows requesting layer 2 (ether-
+             net) instead of layer 3 (point-to-point) tunneling from the serv-
+             er.  The argument must be ``yes'', ``point-to-point'',
+             ``ethernet'' or ``no''.  The default is ``no''.
+
+     TunnelDevice
+             Force a specified tun(4) device on the client.  Without this op-
+             tion, the next available device will be used.
+
      UsePrivilegedPort
              Specifies whether to use a privileged port for outgoing connec-
              tions.  The argument must be ``yes'' or ``no''.  The default is
@@ -551,4 +593,4 @@ AUTHORS
      ated OpenSSH.  Markus Friedl contributed the support for SSH protocol
      versions 1.5 and 2.0.
 
-OpenBSD 3.8                   September 25, 1999                             9
+OpenBSD 3.9                   September 25, 1999                             9