summaryrefslogtreecommitdiff
path: root/sshd.8
diff options
context:
space:
mode:
Diffstat (limited to 'sshd.8')
-rw-r--r--sshd.842
1 files changed, 35 insertions, 7 deletions
diff --git a/sshd.8 b/sshd.8
index 968ba66bb..fb133c14b 100644
--- a/sshd.8
+++ b/sshd.8
@@ -33,8 +33,8 @@
33.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 33.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
34.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
35.\" 35.\"
36.\" $OpenBSD: sshd.8,v 1.299 2018/03/14 06:56:20 jmc Exp $ 36.\" $OpenBSD: sshd.8,v 1.304 2018/07/22 12:16:59 dtucker Exp $
37.Dd $Mdocdate: March 14 2018 $ 37.Dd $Mdocdate: July 22 2018 $
38.Dt SSHD 8 38.Dt SSHD 8
39.Os 39.Os
40.Sh NAME 40.Sh NAME
@@ -277,7 +277,7 @@ locked, listed in
277.Cm DenyUsers 277.Cm DenyUsers
278or its group is listed in 278or its group is listed in
279.Cm DenyGroups 279.Cm DenyGroups
280\&. The definition of a locked account is system dependant. Some platforms 280\&. The definition of a locked account is system dependent. Some platforms
281have their own account database (eg AIX) and some modify the passwd field ( 281have their own account database (eg AIX) and some modify the passwd field (
282.Ql \&*LK\&* 282.Ql \&*LK\&*
283on Solaris and UnixWare, 283on Solaris and UnixWare,
@@ -554,11 +554,37 @@ Disables execution of
554.It Cm no-X11-forwarding 554.It Cm no-X11-forwarding
555Forbids X11 forwarding when this key is used for authentication. 555Forbids X11 forwarding when this key is used for authentication.
556Any X11 forward requests by the client will return an error. 556Any X11 forward requests by the client will return an error.
557.It Cm permitlisten="[host:]port"
558Limit remote port forwarding with the
559.Xr ssh 1
560.Fl R
561option such that it may only listen on the specified host (optional) and port.
562IPv6 addresses can be specified by enclosing the address in square brackets.
563Multiple
564.Cm permitlisten
565options may be applied separated by commas.
566Hostnames may include wildcards as described in the PATTERNS section in
567.Xr ssh_config 5 .
568A port specification of
569.Cm *
570matches any port.
571Note that the setting of
572.Cm GatewayPorts
573may further restrict listen addresses.
574Note that
575.Xr ssh 1
576will send a hostname of
577.Dq localhost
578if a listen host was not specified when the forwarding was requested, and
579that this name is treated differently to the explicit localhost addresses
580.Dq 127.0.0.1
581and
582.Dq ::1 .
557.It Cm permitopen="host:port" 583.It Cm permitopen="host:port"
558Limit local port forwarding with 584Limit local port forwarding with the
559.Xr ssh 1 585.Xr ssh 1
560.Fl L 586.Fl L
561such that it may only connect to the specified host and port. 587option such that it may only connect to the specified host and port.
562IPv6 addresses can be specified by enclosing the address in square brackets. 588IPv6 addresses can be specified by enclosing the address in square brackets.
563Multiple 589Multiple
564.Cm permitopen 590.Cm permitopen
@@ -618,9 +644,11 @@ An example authorized_keys file:
618ssh-rsa AAAAB3Nza...LiPk== user@example.net 644ssh-rsa AAAAB3Nza...LiPk== user@example.net
619from="*.sales.example.net,!pc.sales.example.net" ssh-rsa 645from="*.sales.example.net,!pc.sales.example.net" ssh-rsa
620AAAAB2...19Q== john@example.net 646AAAAB2...19Q== john@example.net
621command="dump /home",no-pty,no-port-forwarding ssh-dss 647command="dump /home",no-pty,no-port-forwarding ssh-rsa
622AAAAC3...51R== example.net 648AAAAC3...51R== example.net
623permitopen="192.0.2.1:80",permitopen="192.0.2.2:25" ssh-dss 649permitopen="192.0.2.1:80",permitopen="192.0.2.2:25" ssh-rsa
650AAAAB5...21S==
651permitlisten="localhost:8080",permitopen="localhost:22000" ssh-rsa
624AAAAB5...21S== 652AAAAB5...21S==
625tunnel="0",command="sh /etc/netstart tun0" ssh-rsa AAAA...== 653tunnel="0",command="sh /etc/netstart tun0" ssh-rsa AAAA...==
626jane@example.net 654jane@example.net