1 files changed, 33 insertions, 28 deletions

diff --git a/sshd.0 b/sshd.0
index cf9fc8ae6..7c88c953f 100644
--- a/sshd.0
+++ b/sshd.0
@@ -115,7 +115,7 @@ DESCRIPTION
 
      -g login_grace_time
              Gives the grace time for clients to authenticate themselves
-             (default 600 seconds).  If the client fails to authenticate the
+             (default 120 seconds).  If the client fails to authenticate the
              user within this many seconds, the server disconnects and exits.
              A value of zero indicates no limit.
 
@@ -206,7 +206,9 @@ LOGIN PROCESS
 
            5.   Sets up basic environment.
 
-           6.   Reads $HOME/.ssh/environment if it exists.
+           6.   Reads $HOME/.ssh/environment if it exists and users are
+                allowed to change their environment.  See the
+                PermitUserEnvironment option in sshd_config(5).
 
            7.   Changes to user's home directory.
 
@@ -227,16 +229,16 @@ AUTHORIZED_KEYS FILE FORMAT
      with a `#' are ignored as comments).  Each RSA public key consists of the
      following fields, separated by spaces: options, bits, exponent, modulus,
      comment.  Each protocol version 2 public key consists of: options, keyM--
-     type, base64 encoded key, comment.  The options fields are optional; its
+     type, base64 encoded key, comment.  The options field is optional; its
      presence is determined by whether the line starts with a number or not
-     (the option field never starts with a number).  The bits, exponent, moduM--
-     lus and comment fields give the RSA key for protocol version 1; the comM--
+     (the options field never starts with a number).  The bits, exponent, modM--
+     ulus and comment fields give the RSA key for protocol version 1; the comM--
      ment field is not used for anything (but may be convenient for the user
      to identify the key).  For protocol version 2 the keytype is ``ssh-dss''
      or ``ssh-rsa''.
 
      Note that lines in this file are usually several hundred bytes long
-     (because of the size of the RSA key modulus).  You don't want to type
+     (because of the size of the public key encoding).  You don't want to type
      them in; instead, copy the identity.pub, id_dsa.pub or the id_rsa.pub
      file and edit it.
 
@@ -249,18 +251,19 @@ AUTHORIZED_KEYS FILE FORMAT
      case-insensitive):
 
      from="pattern-list"
-             Specifies that in addition to RSA authentication, the canonical
-             name of the remote host must be present in the comma-separated
-             list of patterns (`*' and `'?  serve as wildcards).  The list may
-             also contain patterns negated by prefixing them with `'!; if the
-             canonical host name matches a negated pattern, the key is not
-             accepted.  The purpose of this option is to optionally increase
-             security: RSA authentication by itself does not trust the network
-             or name servers or anything (but the key); however, if somebody
-             somehow steals the key, the key permits an intruder to log in
-             from anywhere in the world.  This additional option makes using a
-             stolen key more difficult (name servers and/or routers would have
-             to be compromised in addition to just the key).
+             Specifies that in addition to public key authentication, the
+             canonical name of the remote host must be present in the comma-
+             separated list of patterns (`*' and `'?  serve as wildcards).
+             The list may also contain patterns negated by prefixing them with
+             `'!; if the canonical host name matches a negated pattern, the
+             key is not accepted.  The purpose of this option is to optionally
+             increase security: public key authentication by itself does not
+             trust the network or name servers or anything (but the key); howM--
+             ever, if somebody somehow steals the key, the key permits an
+             intruder to log in from anywhere in the world.  This additional
+             option makes using a stolen key more difficult (name servers
+             and/or routers would have to be compromised in addition to just
+             the key).
 
      command="command"
              Specifies that the command is executed whenever this key is used
@@ -269,9 +272,9 @@ AUTHORIZED_KEYS FILE FORMAT
              pty; otherwise it is run without a tty.  If a 8-bit clean channel
              is required, one must not request a pty or should specify no-pty.
              A quote may be included in the command by quoting it with a backM--
-             slash.  This option might be useful to restrict certain RSA keys
-             to perform just a specific operation.  An example might be a key
-             that permits remote backups but nothing else.  Note that the
+             slash.  This option might be useful to restrict certain public
+             keys to perform just a specific operation.  An example might be a
+             key that permits remote backups but nothing else.  Note that the
              client may specify TCP/IP and/or X11 forwarding unless they are
              explicitly prohibited.  Note that this option applies to shell,
              command or subsystem execution.
@@ -280,8 +283,9 @@ AUTHORIZED_KEYS FILE FORMAT
              Specifies that the string is to be added to the environment when
              logging in using this key.  Environment variables set this way
              override other default environment values.  Multiple options of
-             this type are permitted.  This option is automatically disabled
-             if UseLogin is enabled.
+             this type are permitted.  Environment processing is disabled by
+             default and is controlled via the PermitUserEnvironment option.
+             This option is automatically disabled if UseLogin is enabled.
 
      no-port-forwarding
              Forbids TCP/IP forwarding when this key is used for authenticaM--
@@ -381,7 +385,7 @@ FILES
 
      /etc/moduli
              Contains Diffie-Hellman groups used for the "Diffie-Hellman Group
-             Exchange".
+             Exchange".  The file format is described in moduli(5).
 
      /var/empty
              chroot(2) directory used by sshd during privilege separation in
@@ -478,7 +482,8 @@ FILES
              It can only contain empty lines, comment lines (that start with
              `#'), and assignment lines of the form name=value.  The file
              should be writable only by the user; it need not be readable by
-             anyone else.
+             anyone else.  Environment processing is disabled by default and
+             is controlled via the PermitUserEnvironment option.
 
      $HOME/.ssh/rc
              If this file exists, it is run with /bin/sh after reading the
@@ -500,12 +505,12 @@ FILES
              if read proto cookie && [ -n "$DISPLAY" ]; then
                      if [ `echo $DISPLAY | cut -c1-10` = 'localhost:' ]; then
                              # X11UseLocalhost=yes
-                             xauth add unix:`echo $DISPLAY |
+                             echo add unix:`echo $DISPLAY |
                                  cut -c11-` $proto $cookie
                      else
                              # X11UseLocalhost=no
-                             xauth add $DISPLAY $proto $cookie
-                     fi
+                             echo add $DISPLAY $proto $cookie
+                     fi | xauth -q -
              fi
 
              If this file does not exist, /etc/ssh/sshrc is run, and if that