1 files changed, 46 insertions, 16 deletions

diff --git a/sshd.0 b/sshd.0
index d2ffaacfa..04d64776e 100644
--- a/sshd.0
+++ b/sshd.0
@@ -4,8 +4,9 @@ NAME
      sshd - OpenSSH SSH daemon
 
 SYNOPSIS
-     sshd [-46Ddeiqt] [-b bits] [-f config_file] [-g login_grace_time]
-          [-h host_key_file] [-k key_gen_time] [-o option] [-p port] [-u len]
+     sshd [-46DdeiqTt] [-b bits] [-C connection_spec] [-f config_file]
+          [-g login_grace_time] [-h host_key_file] [-k key_gen_time]
+          [-o option] [-p port] [-u len]
 
 DESCRIPTION
      sshd (OpenSSH Daemon) is the daemon program for ssh(1).  Together these
@@ -31,7 +32,17 @@ DESCRIPTION
 
      -b bits
              Specifies the number of bits in the ephemeral protocol version 1
-             server key (default 768).
+             server key (default 1024).
+
+     -C connection_spec
+             Specify the connection parameters to use for the -T extended test
+             mode.  If provided, any Match directives in the configuration
+             file that would apply to the specified user, host, and address
+             will be set before the configuration is written to standard out-
+             put.  The connection parameters are supplied as keyword=value
+             pairs.  The keywords are ``user'', ``host'', and ``addr''.  All
+             are required and may be supplied in any order, either with multi-
+             ple -C options or as a comma-separated list.
 
      -D      When this option is specified, sshd will not detach and does not
              become a daemon.  This allows easy monitoring of sshd.
@@ -98,6 +109,11 @@ DESCRIPTION
              ginning, authentication, and termination of each connection is
              logged.
 
+     -T      Extended test mode.  Check the validity of the configuration
+             file, output the effective configuration to stdout and then exit.
+             Optionally, Match rules may be applied by specifying the connec-
+             tion parameters using one or more -C options.
+
      -t      Test mode.  Only check the validity of the configuration file and
              sanity of the keys.  This is useful for updating sshd reliably as
              configuration options may change.
@@ -289,18 +305,22 @@ AUTHORIZED_KEYS FILE FORMAT
              This option is automatically disabled if UseLogin is enabled.
 
      from="pattern-list"
-             Specifies that in addition to public key authentication, the
-             canonical name of the remote host must be present in the comma-
-             separated list of patterns.  The purpose of this option is to op-
-             tionally increase security: public key authentication by itself
-             does not trust the network or name servers or anything (but the
-             key); however, if somebody somehow steals the key, the key per-
-             mits an intruder to log in from anywhere in the world.  This ad-
-             ditional option makes using a stolen key more difficult (name
-             servers and/or routers would have to be compromised in addition
-             to just the key).
-
-             See PATTERNS in ssh_config(5) for more information on patterns.
+             Specifies that in addition to public key authentication, either
+             the canonical name of the remote host or its IP address must be
+             present in the comma-separated list of patterns.  See PATTERNS in
+             ssh_config(5) for more information on patterns.
+
+             In addition to the wildcard matching that may be applied to host-
+             names or addresses, a from stanza may match IP addressess using
+             CIDR address/masklen notation.
+
+             The purpose of this option is to optionally increase security:
+             public key authentication by itself does not trust the network or
+             name servers or anything (but the key); however, if somebody
+             somehow steals the key, the key permits an intruder to log in
+             from anywhere in the world.  This additional option makes using a
+             stolen key more difficult (name servers and/or routers would have
+             to be compromised in addition to just the key).
 
      no-agent-forwarding
              Forbids authentication agent forwarding when this key is used for
@@ -313,6 +333,9 @@ AUTHORIZED_KEYS FILE FORMAT
 
      no-pty  Prevents tty allocation (a request to allocate a pty will fail).
 
+     no-user-rc
+             Disables execution of ~/.ssh/rc.
+
      no-X11-forwarding
              Forbids X11 forwarding when this key is used for authentication.
              Any X11 forward requests by the client will return an error.
@@ -417,6 +440,13 @@ FILES
              host-based authentication without permitting login with
              rlogin/rsh.
 
+     ~/.ssh/
+             This directory is the default location for all user-specific con-
+             figuration and authentication information.  There is no general
+             requirement to keep the entire contents of this directory secret,
+             but the recommended permissions are read/write/execute for the
+             user, and not accessible by others.
+
      ~/.ssh/authorized_keys
              Lists the public keys (RSA/DSA) that can be used for logging in
              as this user.  The format of this file is described above.  The
@@ -542,4 +572,4 @@ CAVEATS
      System security is not improved unless rshd, rlogind, and rexecd are dis-
      abled (thus completely disabling rlogin and rsh into the machine).
 
-OpenBSD 4.2                     August 16, 2007                              9
+OpenBSD 4.4                      July 2, 2008                                9