1 files changed, 69 insertions, 23 deletions

diff --git a/ssh_config.0 b/ssh_config.0
index 8c84502cb..40e9d3001 100644
--- a/ssh_config.0
+++ b/ssh_config.0
@@ -132,7 +132,8 @@ DESCRIPTION
              Setting this option to ``yes'' in the global client configuration
              file /etc/ssh/ssh_config enables the use of the helper program
              ssh-keysign(8) during HostbasedAuthentication.  The argument must
-             be ``yes'' or ``no''.  The default is ``no''.  See ssh-keysign(8)
+             be ``yes'' or ``no''.  The default is ``no''.  This option should
+             be placed in the non-hostspecific section.  See ssh-keysign(8)
              for more information.
 
      EscapeChar
@@ -162,9 +163,22 @@ DESCRIPTION
 
              X11 forwarding should be enabled with caution.  Users with the
              ability to bypass file permissions on the remote host (for the
-             user's X authorization database) can access the local X11 display
-             through the forwarded connection.  An attacker may then be able
-             to perform activities such as keystroke monitoring.
+             user's X11 authorization database) can access the local X11 dis-
+             play through the forwarded connection.  An attacker may then be
+             able to perform activities such as keystroke monitoring if the
+             ForwardX11Trusted option is also enabled.
+
+     ForwardX11Trusted
+             If the this option is set to ``yes'' then remote X11 clients will
+             have full access to the original X11 display.  If this option is
+             set to ``no'' then remote X11 clients will be considered untrust-
+             ed and prevented from stealing or tampering with data belonging
+             to trusted X11 clients.
+
+             The default is ``no''.
+
+             See the X11 SECURITY extension specification for full details on
+             the restrictions imposed on untrusted clients.
 
      GatewayPorts
              Specifies whether remote hosts are allowed to connect to local
@@ -180,10 +194,9 @@ DESCRIPTION
              of /etc/ssh/ssh_known_hosts.
 
      GSSAPIAuthentication
-             Specifies whether authentication based on GSSAPI may be used, ei-
-             ther using the result of a successful key exchange, or using GSS-
-             API user authentication.  The default is ``yes''.  Note that this
-             option applies to protocol version 2 only.
+             Specifies whether user authentication based on GSSAPI is allowed.
+             The default is ``no''.  Note that this option applies to protocol
+             version 2 only.
 
      GSSAPIDelegateCredentials
              Forward (delegate) credentials to the server.  The default is
@@ -225,19 +238,6 @@ DESCRIPTION
              fied in configuration files; all these identities will be tried
              in sequence.
 
-     KeepAlive
-             Specifies whether the system should send TCP keepalive messages
-             to the other side.  If they are sent, death of the connection or
-             crash of one of the machines will be properly noticed.  However,
-             this means that connections will die if the route is down tem-
-             porarily, and some people find it annoying.
-
-             The default is ``yes'' (to send keepalives), and the client will
-             notice if the network goes down or the remote host dies.  This is
-             important in scripts, and many users want it too.
-
-             To disable keepalives, the value should be set to ``no''.
-
      LocalForward
              Specifies that a TCP/IP port on the local machine be forwarded
              over the secure channel to the specified host and port from the
@@ -336,6 +336,31 @@ DESCRIPTION
              tion agent is running.  The default is ``yes''.  Note that this
              option applies to protocol version 1 only.
 
+     ServerAliveInterval
+             Sets a timeout interval in seconds after which if no data has
+             been received from the server, ssh will send a message through
+             the encrypted channel to request a response from the server.  The
+             default is 0, indicating that these messages will not be sent to
+             the server.  This option applies to protocol version 2 only.
+
+     ServerAliveCountMax
+             Sets the number of server alive messages (see above) which may be
+             sent without ssh receiving any messages back from the server.  If
+             this threshold is reached while server alive messages are being
+             sent, ssh will disconnect from the server, terminating the ses-
+             sion.  It is important to note that the use of server alive mes-
+             sages is very different from TCPKeepAlive (below).  The server
+             alive messages are sent through the encrypted channel and there-
+             fore will not be spoofable.  The TCP keepalive option enabled by
+             TCPKeepAlive is spoofable.  The server alive mechanism is valu-
+             able when the client or server depend on knowing when a connec-
+             tion has become inactive.
+
+             The default value is 3.  If, for example, ServerAliveInterval
+             (above) is set to 15, and ServerAliveCountMax is left at the de-
+             fault, if the server becomes unresponsive ssh will disconnect af-
+             ter approximately 45 seconds.
+
      SmartcardDevice
              Specifies which smartcard device to use.  The argument to this
              keyword is the device ssh should use to communicate with a smart-
@@ -359,6 +384,20 @@ DESCRIPTION
              The argument must be ``yes'', ``no'' or ``ask''.  The default is
              ``ask''.
 
+     TCPKeepAlive
+             Specifies whether the system should send TCP keepalive messages
+             to the other side.  If they are sent, death of the connection or
+             crash of one of the machines will be properly noticed.  However,
+             this means that connections will die if the route is down tem-
+             porarily, and some people find it annoying.
+
+             The default is ``yes'' (to send TCP keepalive messages), and the
+             client will notice if the network goes down or the remote host
+             dies.  This is important in scripts, and many users want it too.
+
+             To disable TCP keepalive messages, the value should be set to
+             ``no''.
+
      UsePrivilegedPort
              Specifies whether to use a privileged port for outgoing connec-
              tions.  The argument must be ``yes'' or ``no''.  The default is
@@ -377,8 +416,15 @@ DESCRIPTION
 
      VerifyHostKeyDNS
              Specifies whether to verify the remote key using DNS and SSHFP
-             resource records.  The default is ``no''.  Note that this option
-             applies to protocol version 2 only.
+             resource records.  If this option is set to ``yes'', the client
+             will implicitly trust keys that match a secure fingerprint from
+             DNS.  Insecure fingerprints will be handled as if this option was
+             set to ``ask''.  If this option is set to ``ask'', information on
+             fingerprint match will be displayed, but the user will still need
+             to confirm new host keys according to the StrictHostKeyChecking
+             option.  The argument must be ``yes'', ``no'' or ``ask''.  The
+             default is ``no''.  Note that this option applies to protocol
+             version 2 only.
 
      XAuthLocation
              Specifies the full pathname of the xauth(1) program.  The default